Connection security profiles for batch connections
Profiles for checking batch-type connections are composed of the queue manager or queue sharing group name followed by the word BATCH. Give the user ID associated with the connecting address space READ access to the connection profile.
Profiles for checking batch and batch-type connections take the form:hlq.BATCH
where hlq can be either the qmgr-name (queue manager name) or qsg-name (queue sharing group name). If we are using both queue manager and queue sharing group level security, IBM MQ checks for a profile prefixed by the queue manager name. If it does not find one, it looks for a profile prefixed by the queue sharing group name. If it fails to find either profile, the connection request fails.
For batch or batch-type connection requests, we must permit the user ID associated with the connecting address space to access the connection profile. For example, the following RACF command allows users in the CONNTQM1 group to connect to the queue manager TQM1; these user IDs will be permitted to use any batch or batch-type connection.RDEFINE MQCONN TQM1.BATCH UACC(NONE) PERMIT TQM1.BATCH CLASS(MQCONN) ID(CONNTQM1) ACCESS(READ)
- Use CHCKLOCL on locally bound applications
CHCKLOCL only applies to connections that are made through BATCH connections and does not apply to connections made from CICS or IMS. Connections made through the channel initiator are controlled by CHCKCLNT.
Parent topic: Profiles for connection security