Inquire Channel Authentication Records (Response)

The response to the Inquire Channel Authentication Records (MQCMD_INQUIRE_CHLAUTH_RECS) command consists of the response header followed by the requested combination of attribute parameter structures.

    Always returned:
    ChlAuth, Type, Warn(yes)

    Always returned if type is MQCAUT_BLOCKUSER:
    UserList

    Always returned if type is MQCAUT_BLOCKADDR:
    AddrList

    Always returned if type is MQCAUT_SSLPEERMAP:
    Address (unless blanks), MCAUser (unless blanks), SSLCertIssuer, SSLPeer, UserSrc

    Always returned if type is MQCAUT_ADDRESSMAP:
    Address (unless blanks), MCAUser (unless blanks), UserSrc

    Always returned if type is MQCAUT_USERMAP:
    Address (unless blanks), CintUser, MCAUser (unless blanks), UserSrc

    Always returned if type is MQCAUT_QMGRMAP:
    Address (unless blanks), MCAUser (unless blanks), QMName, UserSrc

    Returned if requested:
    Address, AlterationDate, AlterationTime, Custom, Description, MCAUser, SSLPeer, UserSrc, Warn


Response data

    AlterationDate (MQCFST)
    Alteration date (parameter identifier: MQCA_ALTERATION_DATE).

    The date when the information was last altered, in the form yyyy-mm-dd.

    AlterationTime (MQCFST)
    Alteration time (parameter identifier: MQCA_ALTERATION_TIME).

    The time when the information was last altered, in the form hh.mm.ss.

    Address (MQCFST)
    The filter used to compare with the IP address, or host name, of the partner queue manager or client at the other end of the channel (parameter identifier: MQCACH_CONNECTION_NAME).
    AddrList (MQCFSL)
    A list of up to 100 IP address patterns which are banned from accessing this queue manager on any channel (parameter identifier: MQCACH_CONNECTION_NAME_LIST).
    Chlauth (MQCFST)
    The name of the channel, or pattern that matches a set of channels, to which the channel authentication record applies (parameter identifier: MQCACH_CHANNEL_NAME).
    CheckClient (MQCFIN)
    The user ID and password requirements for the client connection to be successful (parameter identifier: MQIA_CHECK_CLIENT_BINDING).
    ClntUser (MQCFST)
    The client asserted user ID to be mapped to a new user ID, allowed through unchanged, or blocked (parameter identifier: MQCACH_CLIENT_USER_ID).
    Description (MQCFST)
    Descriptive information about the channel authentication record (parameter identifier: MQCA_CHLAUTH_DESC).
    MCAUser (MQCFST)
    The user identifier to be used when the inbound connection matches the TLS DN, IP address, client asserted user ID or remote queue manager name supplied (parameter identifier: MQCACH_MCA_USER_ID).
    QMName (MQCFST)
    The name of the remote partner queue manager to be mapped to a user ID, allowed through unchanged, or blocked (parameter identifier: MQCA_REMOTE_Q_MGR_NAME).
    SSLCertIssuer (MQCFST)
    This parameter is additional to the SSLPeer parameter.

    SSLCertIssuer restricts matches to being within certificates issued by a particular Certificate Authority (parameter identifier: MQCA_SSL_CERT_ISSUER_NAME).

    SSLPeer (MQCFST)
    The filter to use to compare with the Distinguished Name of the certificate from the peer queue manager or client at the other end of the channel (parameter identifier: MQCACH_SSL_PEER_NAME).
    Type (MQCFIN)
    The type of channel authentication record for which to set allowed partner details or mappings to MCAUSER (parameter identifier: MQIACF_CHLAUTH_TYPE). The following values can be returned:

      MQCAUT_BLOCKUSER
      This channel authentication record prevents a specified user or users from connecting.

      MQCAUT_BLOCKADDR
      This channel authentication record prevents connections from a specified IP address or addresses.

      MQCAUT_SSLPEERMAP
      This channel authentication record maps TLS Distinguished Names (DNs) to MCAUSER values.

      MQCAUT_ADDRESSMAP
      This channel authentication record maps IP addresses to MCAUSER values.

      MQCAUT_USERMAP
      This channel authentication record maps asserted user IDs to MCAUSER values.

      MQCAUT_QMGRMAP
      This channel authentication record maps remote queue manager names to MCAUSER values.

    UserList (MQCFSL)
    A list of up to 100 user IDs which are banned from use of this channel or set of channels (parameter identifier: MQCACH_MCA_USER_ID_LIST). Use the special value *MQADMIN to mean privileged or administrative users. The definition of this value depends on the operating system, as follows:

    • On Windows, all members of the mqm group, the Administrators group and SYSTEM.
    • On UNIX and Linux , all members of the mqm group.
    • On IBM® i, the profiles (users) qmqm and qmqmadm and all members of the qmqmadm group, and any user defined with the *ALLOBJ special setting.
    • On z/OS®, the user ID that the channel initiator, queue manager and advanced message security address spaces are running under.
    UserSrc (MQCFIN)
    The source of the user ID to be used for MCAUSER at run time (parameter identifier: MQIACH_USER_SOURCE). The following values can be returned:

      MQUSRC_MAP
      Inbound connections that match this mapping use the user ID specified in the MCAUser attribute.

      MQUSRC_NOACCESS
      Inbound connections that match this mapping have no access to the queue manager and the channel ends immediately.

      MQUSRC_CHANNEL
      Inbound connections that match this mapping use the flowed user ID or any user defined on the channel object in the MCAUSER field.

    Warn (MQCFIN)
    Indicates whether this record operates in warning mode (parameter identifier: MQIACH_WARNING).

      MQWARN_NO
      This record does not operate in warning mode. Any inbound connection that matches this record is blocked. This is the default value.

      MQWARN_YES
      This record operates in warning mode. Any inbound connection that matches this record and would therefore be blocked is allowed access. An error message is written and, if events are configured, an event message is created showing the details of what would have been blocked. The connection is allowed to continue.