Lee, To get messages from AIX to z/OS, there are two OAM "opportunities" that need consideration. The first is so the AIX application can write to the qremote and the second is so the channel can write to the local queue on z/OS. Your failure occurs on the AIX side and needs to be addressed with the OAM there. Probably all you are lacking is permission for setting context. You need to establish that permission on AIX, not with RACF on z/OS.
On the mainframe side, the MCA channel agent needs permission to connect and put to the qlocal there. The MCA can have it's own dedicated user id, so it's not necessarily true that you need to pass the z/OS userids from AIX. Whether you want to do that is a design choice, and frankly, a little messy. -----Original Message----- From: Lee Eshleman [mailto:[EMAIL PROTECTED] Sent: Monday, October 04, 2004 8:42 AM To: [EMAIL PROTECTED] Subject: Authorization for changing user id between AIX and z/OS Good morning, I have an application that is running on an AIX server that needs to write to a qremote which points to a queue on our z/OS platform. Our user ids are different between AIX and z/OS and none are common between the two platforms. Therefore, I need the AIX application to supply the z/OS user id in the message so that this user id is used for RACF authentication on the mainframe. I can't get this to work an have been through the documentation multiple times. The MQOPEN of the qremote on AIX is failing for NOT AUTHORIZED (2035). Current Setup on AIX: qremote = MAINFRAME.QUEUE user running aix application = aix1 primary group of the user aix1 = aixgroup1 aix1 is a member of group mqdev Transmission queue = MD01 Access Profiles: profile: MD01 object type: queue entity: aixgroup1 entity type: group authority: allmqi dlt chg dsp clr * profile: MAINFRAME.QUEUE object type: queue entity: mqm entity type: group authority: allmqi dlt chg dsp clr * profile: ** object type: queue entity: aixgroup1 entity type: group authority: passid passall setid setall * profile: ** object type: queue entity: mqdev entity type: group authority: allmqi dsp clr My application tries to open qremote with MQOO_SET_IDENTITY_CONTEXT. The open fails for not auth. I can successfully open the queue if I remove the MQOO_SET_IDENTITY_CONTEXT. Questions: 1) What is causing the NOTAUTH on the OPEN. Shouldn't the ** profile for group aixgroup1 allow this? 2) Does allmqi include setid? 3) Why can't we add set id to a profile that has allmqi. the setmqaut is successful but setid does not display. 4) Am I using the proper procedure to switch user id's going across platforms? We are relatively new to MQ and are still going through related growing pains. Any help you can provide with these questions and any other comments on this situation will be appreciated. Also, I wanted to mention that on the z/OS side I think we are good. Added RACF profiles per MQ Documentation and I am fairly certain we are good to go on z/OS.......thanks. R. Lee Eshleman AES/PHEAA - IT Tech Services Instructions for managing your mailing list subscription are provided in the Listserv General Users Guide available at http://www.lsoft.com Archive: http://vm.akh-wien.ac.at/MQSeries.archive Instructions for managing your mailing list subscription are provided in the Listserv General Users Guide available at http://www.lsoft.com Archive: http://vm.akh-wien.ac.at/MQSeries.archive
