Grant access to a user to subscribe to a topic deeper within the tree

This topic is the second in a list of tasks that tells you how to grant access to topics by more than one user.

Before you begin

This topic uses the setup described in Grant access to a user to subscribe to a topic.

About this task

If the point in the topic tree where the application makes the subscription is not represented by an administrative topic object, move up the tree until the closest parent administrative topic object is located. The security profile is checked, based on the name of that topic object.

Table 1. Access requirements for example topics and topic objects

Topic	Subscribe access required	Topic object
Price	No user	None
Price/Fruit	USER1	FRUIT
Price/Fruit/Apples	USER1
Price/Fruit/Oranges	USER1

In the previous task USER1 was granted access to subscribe to topic Price/Fruit by granting it access to the hlq.SUBSCRIBE.FRUIT profile on z/OS® and subscribe access to the FRUIT profile on other platforms. This single profile also grants USER1 access to subscribe to Price/Fruit/Apples, Price/Fruit/Oranges and Price/Fruit/#.

When USER1 attempts to subscribe to topic Price/Fruit/Apples the result is success.

When USER2 attempts to subscribe to topic Price/Fruit/Apples the result is failure with an MQRC_NOT_AUTHORIZED message, together with:

• On z/OS, the following messages seen on the console that show the full security path through the topic tree that has been attempted:

  ICH408I USER(USER2   ) ...
    hlq.SUBSCRIBE.FRUIT ...
  
  ICH408I USER(USER2   ) ...
    hlq.SUBSCRIBE.SYSTEM.BASE.TOPIC ...
  

• On other platforms, the following authorization event:

  MQRC_NOT_AUTHORIZED
  ReasonQualifier	  MQRQ_SUB_NOT_AUTHORIZED
  UserIdentifier	    USER2
  AdminTopicNames	  FRUIT, SYSTEM.BASE.TOPIC
  TopicString		   "Price/Fruit/Apples"
  

Note the following:

• The messages you receive on z/OS are identical to those received in the previous task as the same topic objects and profiles are controlling the access.
• The event message you receive on other platforms is similar to the one received in the previous task, but the actual topic string is different.