Receive channels using TCP/IP
The user IDs checked depend on the PUTAUT option of the channel and on whether one or two checks are to be performed.
| PUTAUT option specified on receiver or requester channel | hlq.ALTERNATE.USER.userid profile | hlq.CONTEXT.queuename profile | hlq.resourcename profile |
|---|---|---|---|
| DEF, 1 check | - | CHL | CHL |
| DEF, 2 checks | - | CHL + MCA | CHL + MCA |
| CTX, 1 check | CHL | CHL | CHL |
| CTX, 2 checks | CHL + MCA | CHL + MCA | CHL + ALT |
| ONLYMCA, 1 check | - | MCA | MCA |
| ONLYMCA, 2 checks | - | MCA | MCA |
| ALTMCA, 1 check | MCA | MCA | MCA |
| ALTMCA, 2 checks | MCA | MCA | MCA + ALT |
- MCA (MCA user ID)
- The user ID specified for the MCAUSER channel attribute at the receiver; if blank, the channel initiator address space user ID of the receiver or requester side is used.
- CHL (Channel user ID)
- On TCP/IP, security is not supported by the communication system for the channel. If Transport
Layer Security (TLS) is being used and a digital certificate has been flowed from the partner, the
user ID associated with this certificate (if installed), or the user ID associated with a matching
filter found by using RACF Certificate Name
Filtering (CNF), is used. If no associated user ID is found, or if TLS is not being used, the user
ID of the channel initiator address space of the receiver or requester end is used as the channel
user ID on channels defined with the PUTAUT parameter set to DEF or CTX. Note: The use of RACF Certificate Name Filtering (CNF) allows you to assign
the same RACF user ID to multiple remote users, for
example all the users in the same organization unit, who would naturally all have the same security
authority. This means that the server does not have to have a copy of the certificate of every
possible remote user across the world, and greatly simplifies certificate management and
distribution.
If the PUTAUT parameter is set to ONLYMCA or ALTMCA for the channel, the channel user ID is ignored and the MCA user ID of the receiver or requester is used. This also applies to TCP/IP channels using TLS.
- ALT (Alternate user ID)
- The user ID from the context information (that is, the UserIdentifier field) within the message descriptor of the message. This user ID is moved into the AlternateUserID field in the object descriptor before an MQOPEN or MQPUT1 call is issued for the target destination queue.
Parent topic: User IDs used by the channel initiator