Thanks for the reply Dennis. Yes, I agree that I am lacking the set
context privilege. I was hoping someone could see in the list of security
profiles I provided where I am falling short. For instance does the
MAINFRAME .QUEUE profile for group aixgroup1 override the ** profile for
that same group? Do I need set context privilege on the transmission queue
as well as the qremote? My other questions below concerning allmqi and
setid are pertinent too. I have no problem on the z/OS side.
R. Lee Eshleman
AES/PHEAA - IT Tech Services
(717) 720-2936
"Miller, Dennis"
<[EMAIL PROTECTED]
OM> To
Sent by: MQSeries [EMAIL PROTECTED]
List cc
<[EMAIL PROTECTED]
n.AC.AT> Subject
Re: Authorization for changing user
id between AIX and z/OS
10/04/2004 01:16
PM
Please respond to
MQSeries List
<[EMAIL PROTECTED]
n.AC.AT>
Lee,
To get messages from AIX to z/OS, there are two OAM "opportunities" that
need consideration. The first is so the AIX application can write to
the qremote and the second is so the channel can write to the local
queue on z/OS. Your failure occurs on the AIX side and needs to be
addressed with the OAM there. Probably all you are lacking is permission
for setting context. You need to establish that permission on AIX, not
with RACF on z/OS.
On the mainframe side, the MCA channel agent needs permission to connect
and put to the qlocal there. The MCA can have it's own dedicated user
id, so it's not necessarily true that you need to pass the z/OS userids
from AIX. Whether you want to do that is a design choice, and frankly,
a little messy.
-----Original Message-----
From: Lee Eshleman [mailto:[EMAIL PROTECTED]
Sent: Monday, October 04, 2004 8:42 AM
To: [EMAIL PROTECTED]
Subject: Authorization for changing user id between AIX and z/OS
Good morning,
I have an application that is running on an AIX server that needs to
write to a qremote which points to a queue on our z/OS platform. Our
user ids are different between AIX and z/OS and none are common between
the two platforms. Therefore, I need the AIX application to supply the
z/OS user id in the message so that this user id is used for RACF
authentication on the mainframe. I can't get this to work an have been
through the documentation multiple times. The MQOPEN of the qremote on
AIX is failing for NOT AUTHORIZED (2035).
Current Setup on AIX:
qremote = MAINFRAME.QUEUE
user running aix application = aix1
primary group of the user aix1 = aixgroup1
aix1 is a member of group mqdev
Transmission queue = MD01
Access Profiles:
profile: MD01
object type: queue
entity: aixgroup1
entity type: group
authority: allmqi dlt chg dsp clr
*
profile: MAINFRAME.QUEUE
object type: queue
entity: mqm
entity type: group
authority: allmqi dlt chg dsp clr
*
profile: **
object type: queue
entity: aixgroup1
entity type: group
authority: passid passall setid setall
*
profile: **
object type: queue
entity: mqdev
entity type: group
authority: allmqi dsp clr
My application tries to open qremote with MQOO_SET_IDENTITY_CONTEXT.
The open fails for not auth. I can successfully open the queue if I
remove the MQOO_SET_IDENTITY_CONTEXT.
Questions:
1) What is causing the NOTAUTH on the OPEN. Shouldn't the ** profile
for group aixgroup1 allow this?
2) Does allmqi include setid?
3) Why can't we add set id to a profile that has allmqi. the setmqaut
is successful but setid does not display.
4) Am I using the proper procedure to switch user id's going across
platforms?
We are relatively new to MQ and are still going through related growing
pains. Any help you can provide with these questions and any other
comments on this situation will be appreciated. Also, I wanted to
mention that on the z/OS side I think we are good. Added RACF profiles
per MQ Documentation and I am fairly certain we are good to go on
z/OS.......thanks.
R. Lee Eshleman
AES/PHEAA - IT Tech Services
Instructions for managing your mailing list subscription are provided in
the Listserv General Users Guide available at http://www.lsoft.com
Archive: http://vm.akh-wien.ac.at/MQSeries.archive
Instructions for managing your mailing list subscription are provided in
the Listserv General Users Guide available at http://www.lsoft.com
Archive: http://vm.akh-wien.ac.at/MQSeries.archive
Instructions for managing your mailing list subscription are provided in
the Listserv General Users Guide available at http://www.lsoft.com
Archive: http://vm.akh-wien.ac.at/MQSeries.archive
