ASG
IBM
Zystems
Cressida
Icon
Netflexity
 
  MQSeries.net
Search  Search       Tech Exchange      Education      Certifications      Library      Info Center      SupportPacs      LinkedIn  Search  Search                                                                   FAQ  FAQ   Usergroups  Usergroups
 
Register  ::  Log in Log in to check your private messages
 
RSS Feed - WebSphere MQ Support RSS Feed - Message Broker Support

MQSeries.net Forum IndexIBM MQ API SupportPassing data to security exit

Post new topicReply to topic
Passing data to security exit View previous topic :: View next topic
Author Message
fgoergen
PostPosted: Thu Oct 25, 2001 8:47 am Post subject: Reply with quote

Newbie

Joined: 24 Oct 2001
Posts: 3
Location: IBM/SSD

I need to pass apllication data from a mqseries call like mqput() to a security exit (for additional authentication) I do not see MQSeries provides any means for this. Is there any (any optional data, buffer pointers etc.)
Back to top
View user's profile Send private message Send e-mail
bduncan
PostPosted: Thu Oct 25, 2001 10:17 am Post subject: Reply with quote

Padawan

Joined: 11 Apr 2001
Posts: 1554
Location: Silicon Valley

As far as I know, the exit only has access to the data contained in the message that was sent using MQPUT. In other words, you'll need to add any information the exit needs within the message itself (probably in the header). The exit has access to these structures. You might want to take a look at the channel encryption exit in the code repository, as this is both a security exit and a channel exit. You can look at how the security exit causes the sending and receiving channel to handshake in order to authenticate. I'm not sure if it makes use of any data in the messages themselves, but it's probably worth a look as there isn't much sample code on exits, at least as far as I've seen...


_________________
Brandon Duncan
IBM Certified MQSeries Specialist
MQSeries.net forum moderator
Back to top
View user's profile Send private message Visit poster's website AIM Address
kolban
PostPosted: Thu Oct 25, 2001 8:01 pm Post subject: Reply with quote

Grand Master

Joined: 22 May 2001
Posts: 1072
Location: Fort Worth, TX, USA

I won't swear to this but I think it is guaranteed that the security exit will run in the same address space as your own application and hence can obtain your userid/groupid etc from process context. Since it runs in the same address space, it should be able to access a piece of process data that could be identified in shared memory or some other inter-thread communications block... not the best answer.

Can you elaborate on what exactly it is you are trying to achieve?
Back to top
View user's profile Send private message
fgoergen
PostPosted: Fri Oct 26, 2001 1:23 am Post subject: Reply with quote

Newbie

Joined: 24 Oct 2001
Posts: 3
Location: IBM/SSD

Quote:

On 2001-10-25 11:17, bduncan wrote:
As far as I know, the exit only has access to the data contained in the message that was sent using MQPUT. (...)You might want to take a look at the channel encryption exit in the code repository, as this is both a security exit and a channel exit.(...)

Thanks for your answer. I looked at this sample already, but I found out that I have access to the message data itself *only at the send exit*, but I do not see any chance to get it in the security exit. The second problem is, the send exit gets called *after* security channel negotiation is complete.No chance!?
Back to top
View user's profile Send private message Send e-mail
fgoergen
PostPosted: Fri Oct 26, 2001 7:19 am Post subject: Reply with quote

Newbie

Joined: 24 Oct 2001
Posts: 3
Location: IBM/SSD

Quote:

On 2001-10-25 21:01, kolban wrote:
I won't swear to this but I think it is guaranteed that the security exit will run in the same address space as your own application and hence can obtain your userid/groupid etc from process context. Since it runs in the same address space, it should be able to access a piece of process data that could be identified in shared memory or some other inter-thread communications block... not the best answer.

Can you elaborate on what exactly it is you are trying to achieve?

What I want to do: The kind of security (do'nt say you would not call this a security problem) I have to provide is based on information *in the message*, meaning solely information about the user/process/application is not enough. This is why I need to pass data from the clients put call to the MQseries server process on the remote machine. The way you suggest is indeed the only possibility I see, too, it is the one I will go, althought (as your remark says) it does not look elegant. Thanks for your answer!

[ This Message was edited by: fgoergen on 2001-10-26 08:20 ]
Back to top
View user's profile Send private message Send e-mail
Display posts from previous:
Post new topicReply to topic Page 1 of 1

MQSeries.net Forum IndexIBM MQ API SupportPassing data to security exit
Jump to:



You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
Protected by Anti-Spam ACP


Theme by Dustin Baccetti
Powered by phpBB 2001, 2002 phpBB Group

Copyright MQSeries.net. All rights reserved.