Security profiles and accesses required
Table 73 through Table 76 show the security profiles that are required to enable the scenario to work:
Table 73. Security profiles for the example scenario Class Profile User ID Access MQCONN QSGA.CHIN MOVER1 MOVER2 READ MQADMIN QSGA.RESLEVEL BATCHID MOVER1 MOVER2 NONE MQADMIN QSGA.CONTEXT.** MOVER1 MOVER2 CONTROL MQQUEUE QSGA.SYSTEM.COMMAND.INPUT MOVER1 MOVER2 UPDATE MQQUEUE QSGA.SYSTEM.CHANNEL.SYNCQ MOVER1 MOVER UPDATE MQQUEUE QSGA.SYSTEM.CHANNEL.INITQ MOVER1 MOVER2 UPDATE MQQUEUE QSGA.SYSTEM.COMMAND.REPLY.MODEL MOVER1 MOVER2 UPDATE MQQUEUE QSGA.SYSTEM.ADMIN.CHANNEL.EVENT MOVER1 MOVER2 UPDATE MQQUEUE QSGA.SYSTEM.QSG.CHANNEL.SYNCQ MOVER1 MOVER2 UPDATE MQQUEUE QSGA.SYSTEM.QSG.TRANSMIT.QUEUE MOVER1 MOVER2 UPDATE MQQUEUE QSGA.QM1.TO.QM2.TCP MOVER1 ALTER MQQUEUE QSGA.QM1.TO.QM2.LU62 MOVER1 ALTER MQQUEUE QSGA.DLQ MOVER2 UPDATE
Security profiles required for a batch application
The batch application runs under user ID BATCHID on QM1. It connects to queue manager QM1 and puts messages to the following queues:
- LQ1
- RQA
- RQB
It uses the MQPMO_SET_ALL_CONTEXT and MQPMO_ALTERNATE_USER_AUTHORITY options. The alternate user ID found in the UserIdentifier field of the message descriptor (MQMD) is MSGUSR.
The following profiles are required on queue manager QM1:
Table 74. Sample security profiles for the batch application on queue manager QM1 Class Profile User ID Access MQCONN QSGA.BATCH BATCHID READ MQADMIN QSGA.CONTEXT.** BATCHID CONTROL MQQUEUE QSGA.LQ1 BATCHID UPDATE MQQUEUE QSGA.RQA BATCHID UPDATE MQQUEUE QSGA.RQB BATCHID UPDATE The following profiles are required on queue manager QM2 for messages put to queue RQA on queue manager QM1 (for the TCP/IP channel):
Table 75. Sample security profiles for queue manager QM2 using TCP/IP Class Profile User ID Access MQADMIN QSGA.ALTERNATE.USER.MSGUSR MCATCP MOVER2 UPDATE MQADMIN QSGA.CONTEXT.** MCATCP MOVER2 CONTROL MQQUEUE QSGA.LQA MOVER2 MSGUSR UPDATE MQQUEUE QSGA.DLQ MOVER2 MSGUSR UPDATE Notes:
- The user ID passed in the MQMD of the message is used as the user ID for the MQPUT1 on queue manager QM2 because the receiver channel was defined with PUTAUT(CTX) and MCAUSER(MCATCP).
- The MCAUSER field of the receiver channel definition is set to MCATCP; this user ID is used in addition to the channel initiator address space user ID for the checks carried out against the alternate user ID and context profile.
- The MOVER2 user ID and the UserIdentifier in the message descriptor (MQMD) are used for the resource checks against the queue.
- The MOVER2 and MSGUSR user IDs both need access to the dead-letter queue so that messages that cannot be put to the destination queue can be sent there.
- Two user IDs are checked on all three checks performed because RESLEVEL is set to NONE.
The following profiles are required on queue manager QM2 for messages put to queue RQB on queue manager QM1 (for the LU 6.2 channel):
Table 76. Sample security profiles for queue manager QM2 using LU 6.2 Class Profile User ID Access MQADMIN QSGA.ALTERNATE.USER.MSGUSR MCALU62 MOVER1 UPDATE MQADMIN QSGA.CONTEXT.** MCALU62 MOVER1 CONTROL MQQUEUE QSGA.LQB MOVER1 MSGUSR UPDATE MQQUEUE QSGA.DLQ MOVER1 MSGUSR UPDATE Notes:
- The user ID passed in the MQMD of the message is used as the user ID for the MQPUT1 on queue manager QM2 because the receiver channel was defined with PUTAUT(CTX) and MCAUSER(MCALU62).
- The MCA user ID is set to the value of the MCAUSER field of the receiver channel definition (MCALU62).
- Because LU 6.2 supports security on the communications system for the channel, the user ID received from the network is used as the channel user ID (MOVER1).
- Two user IDs are checked on all three checks performed because RESLEVEL is set to NONE.
- MCALU62 and MOVER1 are used for the checks performed against the alternate user ID and Context profiles, and MSGUSR and MOVER1 are used for the checks against the queue profile.
- The MOVER1 and MSGUSR user IDs both need access to the dead-letter queue so that messages that cannot be put to the destination queue can be sent there.