MQSeries.net :: View topic

Mangesh1187 · Posted: Wed Jul 20, 2016 1:56 am Post subject:

Gone through several docs ,posts about the CHLAUTH in MQ, I was trying to summarize the overall steps to define it.

Following are the steps you can consider one-by-one while creating the channel authentication rules :
1. Decide the name of channel or channel pattern to which rule should be applied to. Can use wildcard also.
Syntax : SET SET CHLAUTH('CHANNEL1') , SET CHLAUTH('CHANNEL*')

2. Choose whether to allow or blcok the inbound connections.
If you chooese to allow then decide you want to use the userd id flowing with channel to use for further autherization in MQ or to map to Fixed User ID.
Syntax (If Allow & map the userid ): USERSRC (MAP) MCAUSER('usr1) { usr1 is the userid that will be mapped to the flowing user id of channel
(If Allow & use channel user id ): USERSRC (CHANNEL)

If decided to block , decide if you want to block it in WARN mode or not.
If run in WARN mode, the rule will only throw a warning & won't actually block the inbound connection.
Syntax : USERSRC(NOACCESS) WARN(YES/NO) { Default WARN(NO)

3. Decide depending on which identity of the inbound connection , you wanna ALLOW or BLOCK it. Below are the possiilities:
(a) SSL/TLS : TYPE(SSLPEERMAP) SSLPEER('Dn-Names') ADDRESS('Ip Address') { ADDRESS is optional
Distinguished Names can be CN,L etc and can use wild card.

(b) Client App user Id: TYPE(SSLPEERMAP) CLNTUSER('user1') ADDRESS('Ip Address') { ADDRESS is optional
Block/Allow if client application is running with id 'user1'

(c) Remote QM Name : TYPE(QMGRMAP) QMNAME('QM_Name') ADDRESS('Ip Address') { ADDRESS is optional
Block/Allow the inbound connection if its coming from remote QM whoes name matches with QM_Name.

(d) IP address : TYPE(ADDRESSMAP) ADDRESS('Ip_Address')
Block/Allow the inbound connection is coming from Ip addresses which matches with pattern Ip_Address.

4. Espcial scenario with BLOCK.
(a) Using IP address: SET CHLAUTH('*') TYPE(BLOCKADDR) ADDRLIST('IPAddr1','IPAddr1','IPAddr1')
Use this if this rule is to be used by the listener to match the inbound connections before the channel name is known.
(b) Using Final assigned user ID : TYPE(BLOCKUSER) USERLIST('usr1','usr2','usr3')
Use this option if you want this rule to match the user ID ultimately assigned to the inbound connection either by other rules or security exit.
It can be user id flowing with channel, can be asseinged by other app.

A special user id *MQADMIN can be used for the previleged users.

Am I correct saying above or missed anything to point it out? Any thoughts.......