| |
|
RSS Feed - WebSphere MQ Support
|
RSS Feed - Message Broker Support
|
  |
|
| create svrconn channel with out MCAUSER |
« View previous topic :: View next topic » |
| Author |
Message
|
| immaculate |
 Posted: Sun Sep 21, 2014 10:31 pm Post subject: create svrconn channel with out MCAUSER |
 |
|
Novice
Joined: 15 Sep 2014
Posts: 17
|
can we define svrconn channel with out MCAUSER or leave it blank.so that any user can connect to the channel.
what is the defference between defining MCAUSER blank and with specific id |
|
| Back to top |
|
 |
| hughson |
| Posted: Mon Sep 22, 2014 2:08 am Post subject: Re: create svrconn channel with out MCAUSER |
|
|
Padawan
Joined: 09 May 2013
Posts: 1959
Location: Bay of Plenty, New Zealand
|
| immaculate wrote: |
| can we define svrconn channel with out MCAUSER or leave it blank. |
Yes
| immaculate wrote: |
| so that any user can connect to the channel. |
Having MCAUSER blank or not is not what controls whether any user can connect to the channel.
| immaculate wrote: |
| what is the difference between defining MCAUSER blank and with specific id |
If you leave the MCAUSER blank, and have nothing else setting the MCAUSER up (like a security exit or a CHLAUTH rule), then the client machine user ID will be flowed across. If it is recognised on the queue manager's machine, it will be used. This leaves you open to a client machine defining itself a user called 'mqm' and becoming fully privileged when it connects remotely to your queue manager - a bad thing!
If you set the MCAUSER to a value, then that value is used by every connection that finds its way to your queue manager over that channel. Without some other level of authentication, this means that any user who knows the IP address, port and channel name gets the same level of access to your queue manager as the application that is supposed to use that channel.
Therefore, we recommend that you set the MCAUSER to something that will never be recognised on the queue manager machine, e.g. 'rubbish' and then use CHLAUTH rules to over-ride the MCAUSER user of 'rubbish' with a valid user ID for connections that you recognise.
So you might have these commands:-
| Code: |
ALTER CHANNEL(APP1.SVRCONN) CHLTYPE(SVRCONN) MCAUSER('rubbish')
SET CHLAUTH(APP1.SVRCONN) TYPE(ADDRESSMAP) ADDRESS('1.2.3.4')
MCAUSER('app1usr')
|
where '1.2.3.4' is the IP address of the client machine that is supposed to be connecting. Any other IP address would end up with a user ID of 'rubbish' and not be able to do anything further.
Cheers
Morag
_________________
Morag Hughson @MoragHughson
IBM MQ Technical Education Specialist
Get your IBM MQ training here!
MQGem Software |
|
| Back to top |
|
|
| fjb_saper |
| Posted: Mon Sep 22, 2014 6:00 am Post subject: Re: create svrconn channel with out MCAUSER |
|
|
Grand High Poobah
Joined: 18 Nov 2003
Posts: 20756
Location: LI,NY
|
| immaculate wrote: |
can we define svrconn channel with out MCAUSER or leave it blank.so that any user can connect to the channel.
what is the defference between defining MCAUSER blank and with specific id |
The mcauser has nothing to do with who can connect.
It is all about whom you'll appear to be... in short it is a proxy mechanism...
Have fun 
_________________
MQ & Broker admin |
|
| Back to top |
|
|
| bruce2359 |
| Posted: Mon Sep 22, 2014 6:03 am Post subject: Re: create svrconn channel with out MCAUSER |
|
|
Poobah
Joined: 05 Jan 2008
Posts: 9469
Location: US: west coast, almost. Otherwise, enroute.
|
| fjb_saper wrote: |
The mcauser has nothing to do with who can connect.
It is all about whom you'll appear to be... |
... and what permissions, if any, they will have to MQ objects.
_________________
I like deadlines. I like to wave as they pass by.
ב''ה
Lex Orandi, Lex Credendi, Lex Vivendi. As we Worship, So we Believe, So we Live. |
|
| Back to top |
|
|
| immaculate |
| Posted: Mon Sep 22, 2014 8:49 am Post subject: |
|
|
Novice
Joined: 15 Sep 2014
Posts: 17
|
thank you for you valuable inputs 
will try and check it out. |
|
| Back to top |
|
|
| Michael Dag |
| Posted: Tue Sep 23, 2014 3:55 am Post subject: |
|
|
Jedi Knight
Joined: 13 Jun 2002
Posts: 2607
Location: The Netherlands (Amsterdam)
|
if you are on V8 and use the built-in client authentication, blank mcauser is perfectly acceptable!
_________________
Michael
MQSystems Facebook page |
|
| Back to top |
|
|
|
|
|
| |
|
Page 1 of 1 |
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
|
|
|
