Marty,
Not explicitly but if setid is included when you grant allmqi authority
then mqdev does have setid authority...........Lee
R. Lee Eshleman
AES/PHEAA - IT Tech Services
(717) 720-2936
marty
<[EMAIL PROTECTED]
NK.NET> To
Sent by: MQSeries [EMAIL PROTECTED]
List cc
<[EMAIL PROTECTED]
n.AC.AT> Subject
Re: Authorization for changing user
id between AIX and z/OS
10/04/2004 02:50
PM
Please respond to
MQSeries List
<[EMAIL PROTECTED]
n.AC.AT>
Lee,
Did you give the group 'mqdev' setid permissions on the AIX qmgr? You
need to set it there as a sort of global permission, as well as each for
queue that needs it set.
hth,
marty
Lee Eshleman wrote:
>Good morning,
>I have an application that is running on an AIX server that needs to write
>to a qremote which points to a queue on our z/OS platform. Our user ids
>are different between AIX and z/OS and none are common between the two
>platforms. Therefore, I need the AIX application to supply the z/OS user
>id in the message so that this user id is used for RACF authentication on
>the mainframe. I can't get this to work an have been through the
>documentation multiple times. The MQOPEN of the qremote on AIX is failing
>for NOT AUTHORIZED (2035).
>
>Current Setup on AIX:
>qremote = MAINFRAME.QUEUE
>user running aix application = aix1
>primary group of the user aix1 = aixgroup1
>aix1 is a member of group mqdev
>Transmission queue = MD01
>
>Access Profiles:
>profile: MD01
>object type: queue
>entity: aixgroup1
>entity type: group
>authority: allmqi dlt chg dsp clr
>* >profile: MAINFRAME.QUEUE
>object type: queue
>entity: mqm
>entity type: group
>authority: allmqi dlt chg dsp clr
>* >profile: **
>object type: queue
>entity: aixgroup1
>entity type: group
>authority: passid passall setid setall
>* >profile: **
>object type: queue
>entity: mqdev
>entity type: group
>authority: allmqi dsp clr
>
>My application tries to open qremote with MQOO_SET_IDENTITY_CONTEXT. The
>open fails for not auth. I can successfully open the queue if I remove
the
>MQOO_SET_IDENTITY_CONTEXT.
>
>Questions:
>1) What is causing the NOTAUTH on the OPEN. Shouldn't the ** profile for
>group aixgroup1 allow this?
>2) Does allmqi include setid?
>3) Why can't we add set id to a profile that has allmqi. the setmqaut is
>successful but setid does not display.
>4) Am I using the proper procedure to switch user id's going across
>platforms?
>
>We are relatively new to MQ and are still going through related growing
>pains. Any help you can provide with these questions and any other
>comments on this situation will be appreciated. Also, I wanted to mention
>that on the z/OS side I think we are good. Added RACF profiles per MQ
>Documentation and I am fairly certain we are good to go on
>z/OS.......thanks.
>
>
>R. Lee Eshleman
>AES/PHEAA - IT Tech Services
>
>Instructions for managing your mailing list subscription are provided in
>the Listserv General Users Guide available at http://www.lsoft.com
>Archive: http://vm.akh-wien.ac.at/MQSeries.archive
>
>
>
Instructions for managing your mailing list subscription are provided in
the Listserv General Users Guide available at http://www.lsoft.com
Archive: http://vm.akh-wien.ac.at/MQSeries.archive
Instructions for managing your mailing list subscription are provided in
the Listserv General Users Guide available at http://www.lsoft.com
Archive: http://vm.akh-wien.ac.at/MQSeries.archive
