Java and JMS client connectivity to batch applications running on z/OS

A JMS, or IBM MQ classes for Java™, application on z/OS® can connect to a queue manager on z/OS, that has the ADVCAP(ENABLED) attribute, by using a client connection.

A value of ADVCAP(ENABLED) applies only to a z/OS queue manager, licensed as IBM MQ Advanced for z/OS, Value Unit Edition (see IBM MQ product identifiers and export information), running with QMGRPROD set to ADVANCEDVUE.

See DISPLAY QMGR for more information on ADVCAP and START QMGR for more information on QMGRPROD.

Note that batch is the only environment supported; there is no support for JMS for CICS® or JMS for IMS.

An IBM MQ classes for JMS, or IBM MQ classes for Java, application on z/OS cannot connect, using client mode connection, to a queue manager that is not running on z/OS, or to a queue manager that does not have the ADVCAP(ENABLED) option.

If a JMS application attempts to connect using client mode, and the application is not allowed to do so, exception message JMSFMQ0005 is issued.

If an IBM MQ classes for Java application on z/OS attempts to connect using client mode, and it is not allowed to do so, MQRC_ENVIRONMENT_ERROR is returned.

Advanced Message Security (AMS) support

From IBM MQ Version 9.0.5, IBM MQ classes for JMS or IBM MQ classes for Java client applications can use AMS when connecting to IBM MQ Advanced for z/OS, Value Unit Edition queue managers on remote z/OS systems.

A new key store type, jceracfks, is supported in keystore.conf on z/OS only, where:

  • The property name prefix is jceracfks and this name prefix is case insensitive.
  • The key store is a RACF keyring.
  • Passwords are not required, and will be ignored. This is because RACF keyrings do not use passwords.
  • If you specify the provider, the provider must be IBMJCE.
When we use jceracfks with AMS, the key store must be in the form: safkeyring://user/keyring, where:

  • safkeyring is a literal and this name is case insensitive
  • user is the RACF user id that owns the keyring
  • keyring is the name of the RACF keyring and the name of the keyring is case sensitive
The following example uses the standard AMS keyring for user JOHNDOE: 
jceracfks.keystore=safkeyring://JOHNDOE/drq.ams.keyring