The authorization service is an installable service that enables queue managers to invoke authorization facilities, for example, checking that a user ID has authority to open a queue.
This service is a component of the IBM MQ security enabling interface (SEI), which is part of the IBM MQ framework. The following subjects are discussed:
The authorization service component supplied with the IBM MQ products is called the object authority manager (OAM). By default, the OAM is active and works with the following control commands:
The syntax of these commands and how to use them are described in the CL command help. The OAM works with the entity of a principal or group.
When an MQI request is made or a command is issued, the OAM checks the authorization of the entity associated with the operation to see whether it can do the following actions:
Perform the requested operation.
Access the specified queue manager resources.
The authorization service enables you to augment or replace the authority checking provided for queue managers by writing your own authorization service component.
Authorizations can be granted or revoked at the group level only. A request to grant or revoke a user's authority updates the primary group for that user.
The Service stanza and the ServiceComponent stanza for the default authorization component are added to qm.ini automatically, but can be overridden by WRKENVVAR. Any other ServiceComponent stanzas must be added manually.
For example, the following stanzas in the queue manager configuration file define two authorization service components:
Figure 1. Authorization service stanzas in qm.ini on IBM i
Service:
Name=AuthorizationService
EntryPoints=7
ServiceComponent:
Service=AuthorizationService
Name=MQ.UNIX.authorization.service
Module=QMQM/AMQZFU
ComponentDataSize=0
ServiceComponent:
Service=AuthorizationService
Name=user.defined.authorization.service
Module=LIBRARY/SERVICE PROGRAM NAME
ComponentDataSize=96
The first service component stanza MQ.UNIX.authorization.service defines the default authorization service component, the OAM. If you remove this stanza and restart the queue manager, the OAM is disabled and no authorization checks are made.