| Author |
Message
|
| fjb_saper |
 Posted: Mon Feb 23, 2015 2:16 pm Post subject: Limits of mqccred(ChlExit) mq8 |
 |
|
Grand High Poobah
Joined: 18 Nov 2003
Posts: 20756
Location: LI,NY
|
scenario:
Create a backstop rule for all users.
Create channel rule authorization type usermap and map user and address.
mqccred fails. In order for it to work you have to open the address to all users... more specifically
in the exit you get normally 3 calls: INIT, INIT_SEC and SEC_PARMS.
The SEC_PARMS call is where the magic happens.
However the SEC_PARMS call gets bypassed when the only rule to allow is a usermap rule. Apparently there is a first call made with an empty user??
When not using an exit but using user and passwd on the call (JMS)
(jcf.connect(user, passwd) everything works fine...
jcf.connect() with the mqccred info in the exit field works only if open at the address level (for all users).
I guess the workaround would be to set a user in the mcauserid with no access and have the chlauth rule with user and address map it with id presented to the channel...
Anybody else had the same experience? 
_________________
MQ & Broker admin |
|
| Back to top |
|
 |
| fjb_saper |
| Posted: Mon Feb 23, 2015 4:48 pm Post subject: |
|
|
Grand High Poobah
Joined: 18 Nov 2003
Posts: 20756
Location: LI,NY
|
On top of it the channel now runs with the mq service id... am I missing something here or doing it wrong?
_________________
MQ & Broker admin |
|
| Back to top |
|
|
| mqjeff |
| Posted: Tue Feb 24, 2015 5:59 am Post subject: |
|
|
Grand Master
Joined: 25 Jun 2008
Posts: 17447
|
I know that different types of CHLAUTH rules get called at different points in the channel connection sequence.
I suspect that this is where you are having some issues with your exit, but that is just a wild guess. |
|
| Back to top |
|
|
| fjb_saper |
| Posted: Tue Feb 24, 2015 8:49 am Post subject: |
|
|
Grand High Poobah
Joined: 18 Nov 2003
Posts: 20756
Location: LI,NY
|
Thanks but the mqccred exit is delivered by IBM... so technically it is not my exit... and yes I did change the connauth to specify adoptctx(yes) and refresh security type(connauth) but did not bounce the qmgr...
Well adoptctx had finally the desired effect after bouncing the qmgr. Still not happy though because an mcauser of nobody prevents the channel from connecting... apparently adoptctx works only if there is no mcauser on the svrconn channel...
_________________
MQ & Broker admin |
|
| Back to top |
|
|
| hughson |
| Posted: Tue Mar 17, 2015 6:09 am Post subject: |
|
|
Padawan
Joined: 09 May 2013
Posts: 1959
Location: Bay of Plenty, New Zealand
|
Using anything to set the MCAUSER will over-ride ADOPTCTX(YES), e.g. CHL Def, or a CHLAUTH rule etc. This is why ADOPTCTX(YES) is system wide, because there are other ways to set it on a per channel basis already.
Just thought you'd like the confirmation. I do have a presentation that lists the order of things. I'll see if I can find a link (on hols at the mo so don't have laptop with me).
EDIT: Link is behind conference login. I'll get that one on slideshare next week for you to see.
Cheers
Morag
_________________
Morag Hughson @MoragHughson
IBM MQ Technical Education Specialist
Get your IBM MQ training here!
MQGem Software |
|
| Back to top |
|
|
| fjb_saper |
| Posted: Tue Mar 17, 2015 6:26 am Post subject: |
|
|
Grand High Poobah
Joined: 18 Nov 2003
Posts: 20756
Location: LI,NY
|
Thanks for the confirmation Morag... I'll make sure i'll also have a chlauth rule for that channel...
_________________
MQ & Broker admin |
|
| Back to top |
|
|
|
|
