MCAUSER & Top Secret question

[Pere Guerrero Olmedo]

Hi,

Maybe this question has been posted before, because there's a lot of literature in the list regarding mcauser, but I didn't find it yet... :(

On my z/OS MQ we have TopSecret instead of Racf and I'm trying to limit the potential access to several queues to external qmgr's.

With SSL I don't have problems I assign the certificate to a user with access to the queues I select but when I'm not using SSL I'm having problems.

I've tried to assign the MCAUSER of the receiver channel to an user with no permissions but when I send a message from an external (non-z/os) qmgr it always arrives to the destination queue.

I've tried with all options of the receiver (DEF,CTX,ONLYMCA and ALTMCA), with no success.
RACF(r) access level Level of checking
NONE Check two user IDs.
READ Check one user ID.
UPDATE Check one user ID.
CONTROL No check.
ALTER No check.

But I would like to know what is the equivalence in CA TopSecret one.

Where do I have to define this access level? In the Acid that starts the Chinit?

It seems always Chinit Acid is used so it always have full permission to access the queues. With the security team, we've tried to add a permit to the chinit Acid for MQADMIN with the option NONE, but it still doesn't work.
List Open Queues - Q0P2 Row 1 of 4



Queue name Disposition Access
Application ASID Application information User ID State
External URID UR type MQ URID
<> PERE ALL Q0P2
PERE QMGR Q0P2 O - - -
Q0P2CHIN CHINIT 00D0 PROVAPEREB MQM NONE
10.121.158.119
D8F0D7F2C3C8C9D5 QMGR
******** End of list ********

I'm pretty sure that in Racf scenarios I can force that the MCAUSER or the Receiver channel can be forced to be used, but it seems I'm not defining something well with TSecret.

Any suggestion?

Thanks in advance
Regards
Pere







________________________________

AVISO DE CONFIDENCIALIDAD.
Este correo y la informaci?n contenida o adjunta al mismo es privada y confidencial y va dirigida exclusivamente a su destinatario. everis informa a quien pueda haber recibido este correo por error que contiene informaci?n confidencial cuyo uso, copia, reproducci?n o distribuci?n est? expresamente prohibida. Si no es Vd. el destinatario del mismo y recibe este correo por error, le rogamos lo ponga en conocimiento del emisor y proceda a su eliminaci?n sin copiarlo, imprimirlo o utilizarlo de ning?n modo.

CONFIDENTIALITY WARNING.
This message and the information contained in or attached to it are private and confidential and intended exclusively for the addressee. everis informs to whom it may receive it in error that it contains privileged information and its use, copy, reproduction or distribution is prohibited. If you are not an intended recipient of this E-mail, please notify the sender, delete it and do not read, act upon, print, disclose, copy, retain or redistribute any portion of this E-mail.

To unsubscribe, write to LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org and,
in the message body (not the subject), write: SIGNOFF MQSERIES
Instructions for managing your mailing list subscription are provided in
the Listserv General Users Guide available at http://www.lsoft.com
Archive: http://listserv.meduniwien.ac.at/archives/mqser-l.html

[Bruce Lerner]

SSL imposes no restrictions on queue(s), only on channel ends. If you have
access to the channel ends, you can MQPUT any message across the channel.

MCAUSER settings on channel ends can restrict access to queue(s).

To unsubscribe, write to LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org and,
in the message body (not the subject), write: SIGNOFF MQSERIES

[Pere Guerrero Olmedo]

Sorry Bruce I didn't explain well,
With SSL I can choose which user is used in the connection, so I assign the certificate to an user different from the Chinit one. That's the reason I don't hve problem with SSL connection to select which user is going to be used.

My problem is when it is not used an SSL connection, then I try to restrict using MCAUSER but it seems not work, so it seems Chinit user is being used.

Thanks
Pere


-----Mensaje original-----
De: MQSeries List [mailto:***@LISTSERV.MEDUNIWIEN.AC.AT] En nombre de Bruce Lerner
Enviado el: martes, 03 de septiembre de 2013 16:13
Para: ***@LISTSERV.MEDUNIWIEN.AC.AT
Asunto: Re: MCAUSER & Top Secret question

SSL imposes no restrictions on queue(s), only on channel ends. If you have access to the channel ends, you can MQPUT any message across the channel.

MCAUSER settings on channel ends can restrict access to queue(s).

To unsubscribe, write to ***@LISTSERV.MEDUNIWIEN.AC.AT and, in the message body (not the subject), write: SIGNOFF MQSERIES Instructions for managing your mailing list subscription are provided in the Listserv General Users Guide available at http://www.lsoft.com
Archive: http://listserv.meduniwien.ac.at/archives/mqser-l.html

________________________________

AVISO DE CONFIDENCIALIDAD.
Este correo y la información contenida o adjunta al mismo es privada y confidencial y va dirigida exclusivamente a su destinatario. everis informa a quien pueda haber recibido este correo por error que contiene información confidencial cuyo uso, copia, reproducción o distribución está expresamente prohibida. Si no es Vd. el destinatario del mismo y recibe este correo por error, le rogamos lo ponga en conocimiento del emisor y proceda a su eliminación sin copiarlo, imprimirlo o utilizarlo de ningún modo.

CONFIDENTIALITY WARNING.
This message and the information contained in or attached to it are private and confidential and intended exclusively for the addressee. everis informs to whom it may receive it in error that it contains privileged information and its use, copy, reproduction or distribution is prohibited. If you are not an intended recipient of this E-mail, please notify the sender, delete it and do not read, act upon, print, disclose, copy, retain or redistribute any portion of this E

[Pere Guerrero Olmedo]

In general the strange think is although I have the receiver channel with the PUTAUT(ONLYMCA) option, it seems the userid is used is the chinit one instead of the MCAUSER.

What I cannot see if there is a Topsecret bug an MQ bug or a bug from myself....

Regards
Pere


-----Mensaje original-----
De: MQSeries List [mailto:***@LISTSERV.MEDUNIWIEN.AC.AT] En nombre de Bruce Lerner
Enviado el: martes, 03 de septiembre de 2013 16:13
Para: ***@LISTSERV.MEDUNIWIEN.AC.AT
Asunto: Re: MCAUSER & Top Secret question

SSL imposes no restrictions on queue(s), only on channel ends. If you have access to the channel ends, you can MQPUT any message across the channel.

MCAUSER settings on channel ends can restrict access to queue(s).

To unsubscribe, write to ***@LISTSERV.MEDUNIWIEN.AC.AT and, in the message body (not the subject), write: SIGNOFF MQSERIES Instructions for managing your mailing list subscription are provided in the Listserv General Users Guide available at http://www.lsoft.com
Archive: http://listserv.meduniwien.ac.at/archives/mqser-l.html

________________________________

AVISO DE CONFIDENCIALIDAD.
Este correo y la información contenida o adjunta al mismo es privada y confidencial y va dirigida exclusivamente a su destinatario. everis informa a quien pueda haber recibido este correo por error que contiene información confidencial cuyo uso, copia, reproducción o distribución está expresamente prohibida. Si no es Vd. el destinatario del mismo y recibe este correo por error, le rogamos lo ponga en conocimiento del emisor y proceda a su eliminación sin copiarlo, imprimirlo o utilizarlo de ningún modo.

CONFIDENTIALITY WARNING.
This message and the information contained in or attached to it are private and confidential and intended exclusively for the addressee. everis informs to whom it may receive it in error that it contains privileged information and its use, copy, reproduction or distribution is prohibited. If you are not an intended recipient of this E-mail, please notify the sender, delete it and do not read, act upon, print, disclose, copy, retain or redistribute any portion of

[Bruce Lerner]

"With SSL I can choose which user is used in the connection, ..."

No. SSL does not determine which MCAUSER is used at either end of the
channel. SSL only ensures that channel ends have appropriate SSL
certificates. Only MCAUSER affects the MCA's ability or inability to MQOPEN
a queue.

To unsubscribe, write to LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org and,
in the message body (not the subject), write: SIGNOFF MQSERIES

[Pere Guerrero Olmedo]

Again I didn't express what I want correctly, sorry...

What I see is, it seems Chinit userid is always used instead of MCAUSER, so with SSL I can use the user assigned to the certificate instead of the Chinit one, consequently, in this scenario I can control the access to the queue.

My problem is that something is omitted elsewhere (I suspect in any TopSecret definition) and MCAUSER is being ignored.

I'm checking technotes related to RESLEVEL problems, my frustration but , they always are related to Racf and not TopSecret.

Thanks
Regards
Pere

-----Mensaje original-----
De: MQSeries List [mailto:MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org] En nombre de Bruce Lerner
Enviado el: miércoles, 04 de septiembre de 2013 16:32
Para: MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org
Asunto: Re: MCAUSER & Top Secret question

"With SSL I can choose which user is used in the connection, ..."

No. SSL does not determine which MCAUSER is used at either end of the channel. SSL only ensures that channel ends have appropriate SSL certificates. Only MCAUSER affects the MCA's ability or inability to MQOPEN a queue.

To unsubscribe, write to LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org and, in the message body (not the subject), write: SIGNOFF MQSERIES Instructions for managing your mailing list subscription are provided in the Listserv General Users Guide available at http://www.lsoft.com
Archive: http://listserv.meduniwien.ac.at/archives/mqser-l.html

________________________________

AVISO DE CONFIDENCIALIDAD.
Este correo y la información contenida o adjunta al mismo es privada y confidencial y va dirigida exclusivamente a su destinatario. everis informa a quien pueda haber recibido este correo por error que contiene información confidencial cuyo uso, copia, reproducción o distribución está expresamente prohibida. Si no es Vd. el destinatario del mismo y recibe este correo por error, le rogamos lo ponga en conocimiento del emisor y proceda a su eliminación sin copiarlo, imprimirlo o utilizarlo de ningún modo.

CONFIDENTIALITY WARNING.
This message and the information contained in or attached to it are private and confidential and intended exclusively for the addressee. everis informs to whom it may receive it in error that it contains privileged information and its use, copy, reproduction or distribution is prohibited. If you are not an intended recipient of this E-mail, please notify the sender, delete it and do not read, act upon, print, disclose, copy, retain or redistribute any portion of this E-mail.

To unsubscribe, write to LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org and,
in the message body (not the subject), write: SIGNOFF MQSERIES

[Ward Able, Grant]

Hi Pere,

Are you sure that there is a value specified for MCAUSER? The manual states that if it is blank then the default ID is used & in the case of z/OS, the default ID is the ID assigned to the CHINIT.

If it is not blank, do you have an exit that is involved?


Regards - Grant.
Telephone Internal: 201496 (London)
Telephone External: [phone]


-----Original Message-----
From: MQSeries List [mailto:***@LISTSERV.MEDUNIWIEN.AC.AT] On Behalf Of Pere Guerrero Olmedo
Sent: 04 September 2013 15:57
To: ***@LISTSERV.MEDUNIWIEN.AC.AT
Subject: Re: MCAUSER & Top Secret question

Again I didn't express what I want correctly, sorry...

What I see is, it seems Chinit userid is always used instead of MCAUSER, so with SSL I can use the user assigned to the certificate instead of the Chinit one, consequently, in this scenario I can control the access to the queue.

My problem is that something is omitted elsewhere (I suspect in any TopSecret definition) and MCAUSER is being ignored.

I'm checking technotes related to RESLEVEL problems, my frustration but , they always are related to Racf and not TopSecret.

Thanks
Regards
Pere

-----Mensaje original-----
De: MQSeries List [mailto:***@LISTSERV.MEDUNIWIEN.AC.AT] En nombre de Bruce Lerner Enviado el: miércoles, 04 de septiembre de 2013 16:32
Para: ***@LISTSERV.MEDUNIWIEN.AC.AT
Asunto: Re: MCAUSER & Top Secret question

"With SSL I can choose which user is used in the connection, ..."

No. SSL does not determine which MCAUSER is used at either end of the channel. SSL only ensures that channel ends have appropriate SSL certificates. Only MCAUSER affects the MCA's ability or inability to MQOPEN a queue.

To unsubscribe, write to ***@LISTSERV.MEDUNIWIEN.AC.AT and, in the message body (not the subject), write: SIGNOFF MQSERIES Instructions for managing your mailing list subscription are provided in the Listserv General Users Guide available at http://www.lsoft.com
Archive: http://listserv.meduniwien.ac.at/archives/mqser-l.html

________________________________

AVISO DE CONFIDENCIALIDAD.
Este correo y la información contenida o adjunta al mismo es privada y confidencial y va dirigida exclusivamente a su destinatario. everis informa a quien pueda haber recibido este correo por error que contiene información confidencial cuyo uso, copia, reproducción o distribución está expresamente prohibida. Si no es Vd. el destinatario del mismo y recibe este correo por error, le rogamos lo ponga en conocimiento del emisor y proceda a su eliminación sin copiarlo, imprimirlo o utilizarlo de ningún modo.

CONFIDENTIALITY WARNING.
This message and the information contained in or attached to it are private and confidential and intended exclusively for the addressee. everis informs to whom it may receive it in error that it contains privileged information and its use, copy, reproduction or distribution is prohibited. If you are not an intended recipient of this E-mail, please notify the sender, delete it and do not read, act upon, print, disclose, copy, retain or redistribute any portion of this E-mail.

To unsubscribe, write to ***@LISTSERV.MEDUNIWIEN.AC.AT and, in the message body (not the subject), write: SIGNOFF MQSERIES Instructions for managing your mailing list subscription are provided in the Listserv General Users Guide available at http://www.lsoft.com
Archive: http://listserv.meduniwien.ac.at/archives/mqser-l.html
<BR>_____________________________________________________________
<FONT size=2><BR>
DTCC DISCLAIMER: This email and any files transmitted with it are
confidential and intended solely for the use of the individual or
entity to whom they are addressed. If you have received this email
in error, please notify us immediately and delete the email and any
attachments from your system. The recipient should check this email
and any attachments for the presence of viruses. The company
accepts no liability for any damage caused by any virus transmitted
by this email.</FONT>

To unsubscribe, write to LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org and,
in the message body (not the subject), write: SIGNOFF MQSERIES

[Pere Guerrero Olmedo]

Hi Grant,

Yes, personally I wrote the name, and in all DIS CHANNEL commands it is shown (from panels and command line)

Finally I've opened both tickets to IBM and CA in order to check where the hell is the bug.

I'll inform the list about solution.

Thanks
Pere


-----Mensaje original-----
De: MQSeries List [mailto:MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org] En nombre de Ward Able, Grant
Enviado el: jueves, 05 de septiembre de 2013 11:09
Para: MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org
Asunto: Re: MCAUSER & Top Secret question

Hi Pere,

Are you sure that there is a value specified for MCAUSER? The manual states that if it is blank then the default ID is used & in the case of z/OS, the default ID is the ID assigned to the CHINIT.

If it is not blank, do you have an exit that is involved?


Regards - Grant.
Telephone Internal: 201496 (London)
Telephone External: [phone]


-----Original Message-----
From: MQSeries List [mailto:MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org] On Behalf Of Pere Guerrero Olmedo
Sent: 04 September 2013 15:57
To: MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org
Subject: Re: MCAUSER & Top Secret question

Again I didn't express what I want correctly, sorry...

What I see is, it seems Chinit userid is always used instead of MCAUSER, so with SSL I can use the user assigned to the certificate instead of the Chinit one, consequently, in this scenario I can control the access to the queue.

My problem is that something is omitted elsewhere (I suspect in any TopSecret definition) and MCAUSER is being ignored.

I'm checking technotes related to RESLEVEL problems, my frustration but , they always are related to Racf and not TopSecret.

Thanks
Regards
Pere

-----Mensaje original-----
De: MQSeries List [mailto:MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org] En nombre de Bruce Lerner Enviado el: miércoles, 04 de septiembre de 2013 16:32
Para: MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org
Asunto: Re: MCAUSER & Top Secret question

"With SSL I can choose which user is used in the connection, ..."

No. SSL does not determine which MCAUSER is used at either end of the channel. SSL only ensures that channel ends have appropriate SSL certificates. Only MCAUSER affects the MCA's ability or inability to MQOPEN a queue.

To unsubscribe, write to LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org and, in the message body (not the subject), write: SIGNOFF MQSERIES Instructions for managing your mailing list subscription are provided in the Listserv General Users Guide available at http://www.lsoft.com
Archive: http://listserv.meduniwien.ac.at/archives/mqser-l.html

________________________________

AVISO DE CONFIDENCIALIDAD.
Este correo y la información contenida o adjunta al mismo es privada y confidencial y va dirigida exclusivamente a su destinatario. everis informa a quien pueda haber recibido este correo por error que contiene información confidencial cuyo uso, copia, reproducción o distribución está expresamente prohibida. Si no es Vd. el destinatario del mismo y recibe este correo por error, le rogamos lo ponga en conocimiento del emisor y proceda a su eliminación sin copiarlo, imprimirlo o utilizarlo de ningún modo.

CONFIDENTIALITY WARNING.
This message and the information contained in or attached to it are private and confidential and intended exclusively for the addressee. everis informs to whom it may receive it in error that it contains privileged information and its use, copy, reproduction or distribution is prohibited. If you are not an intended recipient of this E-mail, please notify the sender, delete it and do not read, act upon, print, disclose, copy, retain or redistribute any portion of this E-mail.

To unsubscribe, write to LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org and, in the message body (not the subject), write: SIGNOFF MQSERIES Instructions for managing your mailing list subscription are provided in the Listserv General Users Guide available at http://www.lsoft.com
Archive: http://listserv.meduniwien.ac.at/archives/mqser-l.html
<BR>_____________________________________________________________
<FONT size=2><BR>
DTCC DISCLAIMER: This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error, please notify us immediately and delete the email and any attachments from your system. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email.</FONT>

To unsubscribe, write to LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org and, in the message body (not the subject), write: SIGNOFF MQSERIES Instructions for managing your mailing list subscription are provided in the Listserv General Users Guide available at http://www.lsoft.com
Archive: http://listserv.meduniwien.ac.at/archives/mqser-l.html

________________________________

AVISO DE CONFIDENCIALIDAD.
Este correo y la información contenida o adjunta al mismo es privada y confidencial y va dirigida exclusivamente a su destinatario. everis informa a quien pueda haber recibido este correo por error que contiene información confidencial cuyo uso, copia, reproducción o distribución está expresamente prohibida. Si no es Vd. el destinatario del mismo y recibe este correo por error, le rogamos lo ponga en conocimiento del emisor y proceda a su eliminación sin copiarlo, imprimirlo o utilizarlo de ningún modo.

CONFIDENTIALITY WARNING.
This message and the information contained in or attached to it are private and confidential and intended exclusively for the addressee. everis informs to whom it may receive it in error that it contains privileged information and its use, copy, reproduction or distribution is prohibited. If you are not an intended recipient of this E-mail, please notify the sender, delete it and do not read, act upon, print, disclose, copy, retain or redistribute any portion of this E-mail.

To unsubscribe, write to LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org and,
in the message body (not the subject), write: SIGNOFF MQSERIES

[Bruce Lerner]

And, you are certain that the application used the same exact channel? Do
all of your channels specify a non-blank MCAUSER?

To unsubscribe, write to LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org and,
in the message body (not the subject), write: SIGNOFF MQSERIES

[Pere Guerrero Olmedo]

Yes I do, because the test is being done by me...

The fact is we want to implement these kind of controls in all channels but till know we do not succeed with our tests.

Thanks


-----Mensaje original-----
De: MQSeries List [mailto:***@LISTSERV.MEDUNIWIEN.AC.AT] En nombre de Bruce Lerner
Enviado el: jueves, 05 de septiembre de 2013 17:29
Para: ***@LISTSERV.MEDUNIWIEN.AC.AT
Asunto: Re: MCAUSER & Top Secret question

And, you are certain that the application used the same exact channel? Do all of your channels specify a non-blank MCAUSER?

To unsubscribe, write to ***@LISTSERV.MEDUNIWIEN.AC.AT and, in the message body (not the subject), write: SIGNOFF MQSERIES Instructions for managing your mailing list subscription are provided in the Listserv General Users Guide available at http://www.lsoft.com
Archive: http://listserv.meduniwien.ac.at/archives/mqser-l.html

________________________________

AVISO DE CONFIDENCIALIDAD.
Este correo y la información contenida o adjunta al mismo es privada y confidencial y va dirigida exclusivamente a su destinatario. everis informa a quien pueda haber recibido este correo por error que contiene información confidencial cuyo uso, copia, reproducción o distribución está expresamente prohibida. Si no es Vd. el destinatario del mismo y recibe este correo por error, le rogamos lo ponga en conocimiento del emisor y proceda a su eliminación sin copiarlo, imprimirlo o utilizarlo de ningún modo.

CONFIDENTIALITY WARNING.
This message and the information contained in or attached to it are private and confidential and intended exclusively for the addressee. everis informs to whom it may receive it in error that it contains privileged information and its use, copy, reproduction or distribution is prohibited. If you are not an intended recipient of this E-mail, please notify the sender, delete it and do not read, act upon, print, disclose, copy, retain or redistribute any portion of this E-mai

[Bruce Lerner]

Please describe the test you are doing? What application? From what
platform? What userid are you using on that platform? Is the userid in the
mqm group? What username is in the resulting MQMD?

To unsubscribe, write to LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org and,
in the message body (not the subject), write: SIGNOFF MQSERIES

[gshubert-MaERPT+]

I know with ACF2 we had to allow Alternate UserID to keep from having the
CHINIT userid used for other processes. Maybe the same with TopSecret?

Thank you,

Glen Shubert
Associate Director - Operations
T|SYS| - MQSeries Technical Support
email: ***@tsys.com



From: Pere Guerrero Olmedo <***@EVERIS.COM>
To: ***@LISTSERV.MEDUNIWIEN.AC.AT
Date: 09/04/2013 10:57 AM
Subject: Re: MCAUSER & Top Secret question
Sent by: MQSeries List <***@LISTSERV.MEDUNIWIEN.AC.AT>



Again I didn't express what I want correctly, sorry...

What I see is, it seems Chinit userid is always used instead of MCAUSER,
so with SSL I can use the user assigned to the certificate instead of the
Chinit one, consequently, in this scenario I can control the access to
the queue.

My problem is that something is omitted elsewhere (I suspect in any
TopSecret definition) and MCAUSER is being ignored.

I'm checking technotes related to RESLEVEL problems, my frustration but ,
they always are related to Racf and not TopSecret.

Thanks
Regards
Pere

-----Mensaje original-----
De: MQSeries List [mailto:***@LISTSERV.MEDUNIWIEN.AC.AT] En nombre de
Bruce Lerner
Enviado el: miércoles, 04 de septiembre de 2013 16:32
Para: ***@LISTSERV.MEDUNIWIEN.AC.AT
Asunto: Re: MCAUSER & Top Secret question

"With SSL I can choose which user is used in the connection, ..."

No. SSL does not determine which MCAUSER is used at either end of the
channel. SSL only ensures that channel ends have appropriate SSL
certificates. Only MCAUSER affects the MCA's ability or inability to
MQOPEN a queue.

To unsubscribe, write to ***@LISTSERV.MEDUNIWIEN.AC.AT and, in the
message body (not the subject), write: SIGNOFF MQSERIES Instructions for
managing your mailing list subscription are provided in the Listserv
General Users Guide available at http://www.lsoft.com
Archive: http://listserv.meduniwien.ac.at/archives/mqser-l.html

________________________________

AVISO DE CONFIDENCIALIDAD.
Este correo y la información contenida o adjunta al mismo es privada y
confidencial y va dirigida exclusivamente a su destinatario. everis
informa a quien pueda haber recibido este correo por error que contiene
información confidencial cuyo uso, copia, reproducción o distribución está
expresamente prohibida. Si no es Vd. el destinatario del mismo y recibe
este correo por error, le rogamos lo ponga en conocimiento del emisor y
proceda a su eliminación sin copiarlo, imprimirlo o utilizarlo de ningún
modo.

CONFIDENTIALITY WARNING.
This message and the information contained in or attached to it are
private and confidential and intended exclusively for the addressee.
everis informs to whom it may receive it in error that it contains
privileged information and its use, copy, reproduction or distribution is
prohibited. If you are not an intended recipient of this E-mail, please
notify the sender, delete it and do not read, act upon, print, disclose,
copy, retain or redistribute any portion of this E-mail.

To unsubscribe, write to ***@LISTSERV.MEDUNIWIEN.AC.AT and,
in the message body (not the subject), write: SIGNOFF MQSERIES
Instructions for managing your mailing list subscription are provided in
the Listserv General Users Guide available at http://www.lsoft.com
Archive: http://listserv.meduniwien.ac.at/archives/mqser-l.html



-----------------------------------------
The information contained in this communication (including any
attachments hereto) is confidential and is intended solely for the
personal and confidential use of the individual or entity to whom
it is addressed. If the reader of this message is not the intended
recipient or an agent responsible for delivering it to the intended
recipient, you are hereby notified that you have received this
communication in error and that any review, dissemination, copying,
or unauthorized use of this information, or the taking of any
action in reliance on the contents of this information is strictly
prohibited. If you have received this communication in error,
please notify us immediately by e-mail, and delete the original
message. Thank you

To unsubscribe, write to LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org and,
in the message body (not the subject), write: SIGNOFF MQSERIES
Instructions for managing your mailing list subscription are provided in
the Listserv General Users Guide available at http://www.lsoft.com
Archive: http://listserv.meduniwien.ac.at/archives/mqser-l.html

[Pere Guerrero Olmedo]

Hi Bruce,
The test consist in send a message from an MQ of Windows using MQExplorer. I've done with several users, some of them not defined at z/OS, other defined at TopSecret but without any permit of MQ.

From CSQ4BCG0 program I can see user in MQMD is always the same of the user logged on windows, never the MCAUSER nor Chinit user of Mainframe, what seems to be logical.

Regards
Pere


-----Mensaje original-----
De: MQSeries List [mailto:***@LISTSERV.MEDUNIWIEN.AC.AT] En nombre de Bruce Lerner
Enviado el: jueves, 05 de septiembre de 2013 19:23
Para: ***@LISTSERV.MEDUNIWIEN.AC.AT
Asunto: Re: MCAUSER & Top Secret question

Please describe the test you are doing? What application? From what platform? What userid are you using on that platform? Is the userid in the mqm group? What username is in the resulting MQMD?

To unsubscribe, write to ***@LISTSERV.MEDUNIWIEN.AC.AT and, in the message body (not the subject), write: SIGNOFF MQSERIES Instructions for managing your mailing list subscription are provided in the Listserv General Users Guide available at http://www.lsoft.com
Archive: http://listserv.meduniwien.ac.at/archives/mqser-l.html

________________________________

AVISO DE CONFIDENCIALIDAD.
Este correo y la información contenida o adjunta al mismo es privada y confidencial y va dirigida exclusivamente a su destinatario. everis informa a quien pueda haber recibido este correo por error que contiene información confidencial cuyo uso, copia, reproducción o distribución está expresamente prohibida. Si no es Vd. el destinatario del mismo y recibe este correo por error, le rogamos lo ponga en conocimiento del emisor y proceda a su eliminación sin copiarlo, imprimirlo o utilizarlo de ningún modo.

CONFIDENTIALITY WARNING.
This message and the information contained in or attached to it are private and confidential and intended exclusively for the addressee. everis informs to whom it may receive it in error that it contains privileged information and its use, copy, reproduction or distribution is prohibited. If you are not an intended recipient of this E-mail, please notify the sender, delete it and do not read, act upon, print, disclose, copy, retain or redistribute any portion of this E-m

[Pere Guerrero Olmedo]

Thanks Glen
I will check with my TS colleagues.

Regards
Pere

De: MQSeries List [mailto:MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org] En nombre de gshubert-MaERPT+***@public.gmane.org
Enviado el: jueves, 05 de septiembre de 2013 22:20
Para: MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org
Asunto: Re: MCAUSER & Top Secret question

I know with ACF2 we had to allow Alternate UserID to keep from having the CHINIT userid used for other processes. Maybe the same with TopSecret?

Thank you,

Glen Shubert
Associate Director - Operations
T|SYS| - MQSeries Technical Support
email: gshubert-***@public.gmane.org<mailto:gshubert-***@public.gmane.org>



From: Pere Guerrero Olmedo <Pere.Guerrero.Olmedo-***@public.gmane.org<mailto:Pere.Guerrero.Olmedo-***@public.gmane.org>>
To: MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org<mailto:MQSERIES-0lvw86wZMd8hNtF/***@public.gmane.orgNIWIEN.AC.AT>
Date: 09/04/2013 10:57 AM
Subject: Re: MCAUSER & Top Secret question
Sent by: MQSeries List <MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org<mailto:MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org>>
________________________________



Again I didn't express what I want correctly, sorry...

What I see is, it seems Chinit userid is always used instead of MCAUSER, so with SSL I can use the user assigned to the certificate instead of the Chinit one, consequently, in this scenario I can control the access to the queue.

My problem is that something is omitted elsewhere (I suspect in any TopSecret definition) and MCAUSER is being ignored.

I'm checking technotes related to RESLEVEL problems, my frustration but , they always are related to Racf and not TopSecret.

Thanks
Regards
Pere

-----Mensaje original-----
De: MQSeries List [mailto:MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org] En nombre de Bruce Lerner
Enviado el: miércoles, 04 de septiembre de 2013 16:32
Para: MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org
Asunto: Re: MCAUSER & Top Secret question

"With SSL I can choose which user is used in the connection, ..."

No. SSL does not determine which MCAUSER is used at either end of the channel. SSL only ensures that channel ends have appropriate SSL certificates. Only MCAUSER affects the MCA's ability or inability to MQOPEN a queue.

To unsubscribe, write to LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org<mailto:***@LISTSERV.MEDUNIWIEN.AC.AT> and, in the message body (not the subject), write: SIGNOFF MQSERIES Instructions for managing your mailing list subscription are provided in the Listserv General Users Guide available at http://www.lsoft.com<http://www.lsoft.com/>
Archive: http://listserv.meduniwien.ac.at/archives/mqser-l.html

________________________________

AVISO DE CONFIDENCIALIDAD.
Este correo y la información contenida o adjunta al mismo es privada y confidencial y va dirigida exclusivamente a su destinatario. everis informa a quien pueda haber recibido este correo por error que contiene información confidencial cuyo uso, copia, reproducción o distribución está expresamente prohibida. Si no es Vd. el destinatario del mismo y recibe este correo por error, le rogamos lo ponga en conocimiento del emisor y proceda a su eliminación sin copiarlo, imprimirlo o utilizarlo de ningún modo.

CONFIDENTIALITY WARNING.
This message and the information contained in or attached to it are private and confidential and intended exclusively for the addressee. everis informs to whom it may receive it in error that it contains privileged information and its use, copy, reproduction or distribution is prohibited. If you are not an intended recipient of this E-mail, please notify the sender, delete it and do not read, act upon, print, disclose, copy, retain or redistribute any portion of this E-mail.

To unsubscribe, write to LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org<mailto:***@LISTSERV.MEDUNIWIEN.AC.AT> and,
in the message body (not the subject), write: SIGNOFF MQSERIES
Instructions for managing your mailing list subscription are provided in
the Listserv General Users Guide available at http://www.lsoft.com<http://www.lsoft.com/>
Archive: http://listserv.meduniwien.ac.at/archives/mqser-l.html

----------------------------------------- The information contained in this communication (including any attachments hereto) is confidential and is intended solely for the personal and confidential use of the individual or entity to whom it is addressed. If the reader of this message is not the intended recipient or an agent responsible for delivering it to the intended recipient, you are hereby notified that you have received this communication in error and that any review, dissemination, copying, or unauthorized use of this information, or the taking of any action in reliance on the contents of this information is strictly prohibited. If you have received this communication in error, please notify us immediately by e-mail, and delete the original message. Thank you
________________________________
List Archive<http://listserv.meduniwien.ac.at/archives/mqser-l.html> - Manage Your List Settings<http://listserv.meduniwien.ac.at/cgi-bin/wa?SUBED1=mqser-l&A=1> - Unsubscribe<mailto:LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org?subject=Unsubscribe&BODY=signoff%20mqseries>

Instructions for managing your mailing list subscription are provided in the Listserv General Users Guide available at http://www.lsoft.com<http://www.lsoft.com/resources/manuals.asp>

________________________________

AVISO DE CONFIDENCIALIDAD.
Este correo y la información contenida o adjunta al mismo es privada y confidencial y va dirigida exclusivamente a su destinatario. everis informa a quien pueda haber recibido este correo por error que contiene información confidencial cuyo uso, copia, reproducción o distribución está expresamente prohibida. Si no es Vd. el destinatario del mismo y recibe este correo por error, le rogamos lo ponga en conocimiento del emisor y proceda a su eliminación sin copiarlo, imprimirlo o utilizarlo de ningún modo.

CONFIDENTIALITY WARNING.
This message and the information contained in or attached to it are private and confidential and intended exclusively for the addressee. everis informs to whom it may receive it in error that it contains privileged information and its use, copy, reproduction or distribution is prohibited. If you are not an intended recipient of this E-mail, please notify the sender, delete it and do not read, act upon, print, disclose, copy, retain or redistribute any portion of this E-mail.

To unsubscribe, write to LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org and,
in the message body (not the subject), write: SIGNOFF MQSERIES
Instructions for managing your mailing list subscription are provided in
the Listserv General Users Guide available at http://www.lsoft.com
Archive: http://listserv.meduniwien.ac.at/archives/mqser-l.html