MQSeries.net :: View topic - iSeries Platform: Triggered jobs run under which user query

jd00h

Hi,

I've been tightening up security of our iSeries (or AS/400/System i) MQ environments lately and I have hit across a weird situation that has me stumped.

I have a triggered queue with the following process definition defined:

Queue manager name . . . . . . : MQCM01

Process name . . . . . . . . . : TSM.PROCESS.CLIENTACCT.UPDATE.START

Text 'description' . . . . . . : TSM: Trigger client account update

Application type . . . . . . . : *OS400
Application identifier . . . . : *LIBL/CA203401

Environment data . . . . . . . : JOB(CA203401) JOBD(*LIBL/CAPRD) INLLIBL (*JOBD) JOBQ(ESINGLE) JOBPTY(7)

The *JOBD specified in the environment data (CAPRD) has a user called CAUSR associated with it and this user is also a member of a group called PRDDTA.

Now, if I assign *GET authority to the PRDDTA group, everything works just fine - the trigger message gets created the program is called and gets the message from the queue and processes it. However, if I remove the *GET authority for PRDDTA I receive a 2035 authorisation error when attempting to open the queue for input. User QMQMADM has all rights to the queue in question.

The weird thing is that the SBMJOB command is not overriding the user as one can see from the environment data. By all rights the job submitted by the trigger monitor should be running with the QMQM profile as *CURRENT is the default value for the USER parameter on the SBMJOB command. When I check the job, it definitely is running with user QMQM but for some reason if the PRDDTA profile is not given *GET authority the 2035 error is received.

I have checked the application code and it is not using alternate user identities/authority.

I have also checked that the command defaults for the SBMJOB command have not been changed for the USER parameter to something like *JOBD (if this were the case, then everything would make sense).

I have been cracking my head on this for the better part of today/tonight now and it's driving me batty.

If anyone out there has any ideas as to what is going on here I'd really appreciate it.

Thanks,
John Dell'Oso