| |
|
RSS Feed - WebSphere MQ Support
|
RSS Feed - Message Broker Support
|
  |
|
| Windows Client to z Host security |
« View previous topic :: View next topic » |
| Author |
Message
|
| SB |
 Posted: Tue Aug 31, 2004 12:44 pm Post subject: Windows Client to z Host security |
 |
|
Newbie
Joined: 30 Aug 2004
Posts: 2
|
We are investigating the implementation of security to control appropriate access from Windows Clients to queues on a z host QMGR. It looks like the solution involves a combination of queue level security, including specific MCAUSERs in the Server Connection channel, plus SSL. If you stick with this client/host MQ configuration, are there any other better options?
The Windows Clients use JAVA programs.
Thanks
Last edited by SB on Wed Sep 01, 2004 5:04 am; edited 1 time in total |
|
| Back to top |
|
 |
| fjb_saper |
| Posted: Tue Aug 31, 2004 2:11 pm Post subject: |
|
|
Grand High Poobah
Joined: 18 Nov 2003
Posts: 20756
Location: LI,NY
|
You do not specify whether your windows clients will use Java or C to connect. With the C model all you should really need is to setup your authorization on MQ.
Remember anybody accessing queues will also need access to the qmgr.
Don't know enough about the RACF and security on the MF to be of more help. You'll need to talk to a mainframe expert there.
Enjoy |
|
| Back to top |
|
|
| EddieA |
| Posted: Tue Aug 31, 2004 3:47 pm Post subject: |
|
|
Jedi
Joined: 28 Jun 2001
Posts: 2453
Location: Los Angeles
|
If you have a value for MCAUSER in the SVRCONN channel, then every connection through that channel will use that userID, unless you write a security exit.
Cheers,
_________________
Eddie Atherton
IBM Certified Solution Developer - WebSphere Message Broker V6.1
IBM Certified Solution Developer - WebSphere Message Broker V7.0 |
|
| Back to top |
|
|
| PeterPotkay |
| Posted: Tue Aug 31, 2004 4:26 pm Post subject: |
|
|
Poobah
Joined: 15 May 2001
Posts: 7722
|
| Quote: |
You do not specify whether your windows clients will use Java or C to connect. With the C model all you should really need is to setup your authorization on MQ.
|
Yes, Java apps make it very easy to send any ID, or no ID at all, which then defaults to the ID that started the channel on the QM side. And yes, C apps, or any apps beside Java, do force the the actual logged ID over.
But since anyone can create a use called mqm on their Windows machine and run their app as mqm, it is not wise to rely on the logged on IDs of Windows machines for Authentication purposes. Never leave your MCAUSER blank on a SVRCONN channel unless you also have SSL and or a security exit.
_________________
Peter Potkay
Keep Calm and MQ On |
|
| Back to top |
|
|
|
|
|
| |
|
Page 1 of 1 |
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
|
|
|
