Authorizing putting messages on remote cluster queues

On z/OS® set up authorization to put to a cluster queue using RACF®. On other platforms, authorize access to connect to the queue managers, and to put to the queues on those queue managers.

About this task

The default behavior is to perform access control against the SYSTEM.CLUSTER.TRANSMIT.QUEUE. Note that this behavior applies, even if you are using multiple transmission queues.

The specific behavior described in this topic applies only when we have configured the ClusterQueueAccessControl attribute in the qm.ini file to be RQMName, as described in the Security stanza topic, and restarted the queue manager.

Procedure

• For z/OS, issue the following commands:

  RDEFINE MQQUEUE QMgrName.QUEUE. QueueName UACC(NONE)
  PERMIT QMgrName.QUEUE. QueueName CLASS(MQADMIN) ID(GroupName) ACCESS(UPDATE)
  

• For UNIX, Linux , and Windows systems, issue the following commands:

  setmqaut -m QMgrName -t qmgr -g GroupName +connect
  setmqaut -m QMgrName -t queue -n QueueName -g GroupName -all +put
  

• For IBM® i, issue the following commands:

  GRTMQMAUT OBJ(' QMgrName ') OBJTYPE(*MQM) USER(GroupName) AUT(*CONNECT)
  GRTMQMAUT OBJ(' QueueName ') OBJTYPE(*Q) USER(GroupName) AUT(*PUT) MQMNAME(' QMgrName ')
  

  The user can put messages only to the specified cluster queue, and no other cluster queues. The variable names have the following meanings:

  QMgrName

  The name of the queue manager. On z/OS, this value can also be the name of a queue sharing group.

  GroupName

  The name of the group to be granted access.

  QueueName

  Name of the queue or generic profile for which to change authorizations.

What to do next

If you specify a reply-to queue when you put a message on a cluster queue, the consuming application must have authority to send the reply. Set this authority by following the instructions in Granting authority to put messages to a remote cluster queue.