Gordon, Rob
2014-09-09 22:44:18 UTC
Running WMQ 7.0.1 on z/OS 1.13 with CA-Top Secret. I'm having problems getting QSG security to work. We have no security profile switches set and I interpret this as enabling both QMGR and QSG-level security since none of the "NO" profiles are found.
We have a QSG called QGB0 which contains a QMGR named TAB0. A TSS rule was created to grant UPDATE access to QGB0.some.queue.name but when the programmer tests it, she incurs an MQRC 2035 (not authorized) error and the TSS violation report shows the queue name as TAB0.some.queue.name, and there is no rule that grants access to TAB0.some.queue.name. She's running a batch job that connects directly to the QMGR to do this.
I've opened a service request with IBM and they're puzzled also. Can anyone offer something I need to do to get QSG security working? When I display the security switches with CSQOREXX everything looks good to me; it looks like QSG security is in place (3rd line down).
SUBSYSTEM: ON, 'QGB0.NO.SUBSYS.SECURITY' not found
QMGR: ON, 'QGB0.NO.QMGR.CHECKS' not found
QSG: ON, 'QGB0.NO.QSG.CHECKS' not found
CONNECTION: ON, 'QGB0.NO.CONNECT.CHECKS' not found
COMMAND: ON, 'QGB0.NO.CMD.CHECKS' not found
CONTEXT: ON, 'QGB0.NO.CONTEXT.CHECKS' not found
ALTERNATE USER: ON, 'QGB0.NO.ALTERNATE.USER.CHECKS' not found
PROCESS: ON, 'QGB0.NO.PROCESS.CHECKS' not found
NAMELIST: ON, 'QGB0.NO.NLIST.CHECKS' not found
QUEUE: ON, 'QGB0.NO.QUEUE.CHECKS' not found
TOPIC: ON, 'QGB0.NO.TOPIC.CHECKS' not found
COMMAND RESOURCES: ON, 'QGB0.NO.CMD.RESC.CHECKS' not found
It must be something stupid but I'll be darned if I can see it.
Rob
Use of email is inherently insecure. Confidential information,
including account information, and personally identifiable
information, should not be transmitted via email, or email
attachment. The information in this email may contain confidential
and/or privileged information and is intended only for the use of
the individual/entity named above. Any disclosure, copying,
distribution or use of this information is strictly prohibited. If
you have received this communication in error, please notify the
sender immediately and destroy any record of this email.
RBS Citizens, N.A. is an affiliate of RBS Citizens Financial Group,
Inc.
To unsubscribe, write to LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org and,
in the message body (not the subject), write: SIGNOFF MQSERIES
Instructions for managing your mailing list subscription are provided in
the Listserv General Users Guide available at http://www.lsoft.com
Archive: http://listserv.meduniwien.ac.at/archives/mqser-l.html
We have a QSG called QGB0 which contains a QMGR named TAB0. A TSS rule was created to grant UPDATE access to QGB0.some.queue.name but when the programmer tests it, she incurs an MQRC 2035 (not authorized) error and the TSS violation report shows the queue name as TAB0.some.queue.name, and there is no rule that grants access to TAB0.some.queue.name. She's running a batch job that connects directly to the QMGR to do this.
I've opened a service request with IBM and they're puzzled also. Can anyone offer something I need to do to get QSG security working? When I display the security switches with CSQOREXX everything looks good to me; it looks like QSG security is in place (3rd line down).
SUBSYSTEM: ON, 'QGB0.NO.SUBSYS.SECURITY' not found
QMGR: ON, 'QGB0.NO.QMGR.CHECKS' not found
QSG: ON, 'QGB0.NO.QSG.CHECKS' not found
CONNECTION: ON, 'QGB0.NO.CONNECT.CHECKS' not found
COMMAND: ON, 'QGB0.NO.CMD.CHECKS' not found
CONTEXT: ON, 'QGB0.NO.CONTEXT.CHECKS' not found
ALTERNATE USER: ON, 'QGB0.NO.ALTERNATE.USER.CHECKS' not found
PROCESS: ON, 'QGB0.NO.PROCESS.CHECKS' not found
NAMELIST: ON, 'QGB0.NO.NLIST.CHECKS' not found
QUEUE: ON, 'QGB0.NO.QUEUE.CHECKS' not found
TOPIC: ON, 'QGB0.NO.TOPIC.CHECKS' not found
COMMAND RESOURCES: ON, 'QGB0.NO.CMD.RESC.CHECKS' not found
It must be something stupid but I'll be darned if I can see it.
Rob
Use of email is inherently insecure. Confidential information,
including account information, and personally identifiable
information, should not be transmitted via email, or email
attachment. The information in this email may contain confidential
and/or privileged information and is intended only for the use of
the individual/entity named above. Any disclosure, copying,
distribution or use of this information is strictly prohibited. If
you have received this communication in error, please notify the
sender immediately and destroy any record of this email.
RBS Citizens, N.A. is an affiliate of RBS Citizens Financial Group,
Inc.
To unsubscribe, write to LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org and,
in the message body (not the subject), write: SIGNOFF MQSERIES
Instructions for managing your mailing list subscription are provided in
the Listserv General Users Guide available at http://www.lsoft.com
Archive: http://listserv.meduniwien.ac.at/archives/mqser-l.html