WMQ Channel Authentication Records Xin Po Zhang (xinpozh@cn.ibm.com) WebSphere MQ L2 Support May 2014

Agenda Channel Authentication Records( CHLAUTH) Overview Operations on CHLAUTH Using CHLAUTH Examples: USERMAP and QMGRMAP Notes about CHLAUTH WebSphere® Support Technical Exchange

CHLAUTH Overview WebSphere® Support Technical Exchange

MQ Security: Authentication and Authorization Authentication: Verification of a claimed identity Authentication at connection level Authentication at message level (AMS) Authorization: Set of rules (authorities) granted to a particular user or group of users which allow access to named objects Object Authority Manager Related commands: setmqaut, dspmqaut, dmpmqaut Queue: SYSTEM.AUTH.DATA.QUEUE WebSphere® Support Technical Exchange

Channel Authentication Records Channel Authentication Records: Filter inbound connection requests based on one or more of three criteria. Asserted identity that is presented by the channel IP address of the remote partner that is requesting the connection Distinguished name of the certificate that is presented by a SSL/TLS channel WebSphere® Support Technical Exchange

Functions of CHLAUTH Block connections from specific IP addresses. Block connections from specific user IDs. Set an MCAUSER value to be used for any channel connecting from a specific queue manager. Set an MCAUSER value to be used for any channel connecting from a specific IP address. Set an MCAUSER value to be used for any channel asserting a specific user ID. Set an MCAUSER value to be used for any channel having a specific SSL or TLS DN. WebSphere® Support Technical Exchange

Operations on CHLAUTH WebSphere® Support Technical Exchange

MQSC Command: SET CHLAUTH SET CHLAUTH ( ----generic-channel-name-- ) Blocking Block TYPE(BLOCKUSER)--USERLIST--(----user-name-+--) > WARN(YES/NO) TYPE(BLOCKADDR)--ADDRLIST--(----generic-ip-address-+--) > WARN(YES/NO) Note: The generic channel name must be '*' when TYPE is BLOCKADDR WebSphere® Support Technical Exchange

MQSC Command: SET CHLAUTH Mapping Block TYPE(SSLPEERMAP)--SSLPEER--(generic-ssl-peer-name--) TYPE(ADDRESSMAP) TYPE(USERMAP)--CLNTUSER--(client-user-name--) TYPE(QMGRMAP)--QMNAME--(partner-qmgr-name-) -> USERSRC(MAP/NOACCESS/CHANNEL) -> MCAUSER--(--user --) -> ADDRESS--(--generic-ip-address--) WebSphere® Support Technical Exchange

MQSC Command: SET CHLAUTH ACTION: ACTION(ADD)-------. .-DESCR(' ') ACTION(REPLACE) ACTION(REMOVE)        ACTION(REMOVEALL) Technote: http://www-01.ibm.com/support/docview.wss?uid=swg21577138 WebSphere MQ 7.1: How to remove a channel authentication record WebSphere® Support Technical Exchange

GUI: Using MQ Explorer to Create CHLAUTH WebSphere® Support Technical Exchange

GUI: Using MQ Explorer to Create CHLAUTH Note: At end of creating channel authentication record, it also creates the corresponding SET CHLAUTH command. WebSphere® Support Technical Exchange

Using CHLAUTH WebSphere® Support Technical Exchange

Interaction between Different Rules Where a number of channel authentication records match a channel name, IP address, queue manager name, or SSL or TLS DN, the most specific match is used. For each element, the order is as below. Channel name A CHLAUTH using an SSL or TLS DN takes priority over a record using a user ID, queue manager name, or IP address. A CHLAUTH using a user ID or queue manager name takes priority over a record using an IP address. WebSphere® Support Technical Exchange

Default CHLAUTH Rules Set CHLAUTH(‘*’) type(BLOCKUSER) userlist (‘*MQADMIN’) Block all users that are in the MQ admin group, from connecting to the queue manager Set CHLAUTH(‘SYSTEM.*’) type(ADDRESSMAP) address(‘*’) usersrc(NOACCESS) Block connections to the queue manager, using any of the SYSTEM channels that are predefined Set CHLAUTH(SYSTEM.ADMIN.SVRCONN) type(ADDRESSMAP) address(‘*’) usersrc(CHANNEL) Allow connections to the queue manager, using SYSTEM.ADMIN.SVRCONN (MQ Explorer connections) WebSphere® Support Technical Exchange

Common Issue: 2035 or AMQ4036 Fail to connect a MQ 7.1/7.5 queue manager with a MQ Administrator ID. The error is 2035 or AMQ4036 2035: MQRC_NOT_AUTHORIZED Technote: WMQ 7.1 / 7.5 queue manager RC 2035 MQRC_NOT_AUTHORIZED or AMQ4036 when using client connection as an MQ Administrator http://www-01.ibm.com/support/docview.wss?uid=swg21577137 WebSphere® Support Technical Exchange

Examples: USERMAP and QMGRMAP WebSphere® Support Technical Exchange

Example 1: Using USERMAP Scenario: Using the sample amqsputc from Linux to put messages to the queue at Windows 7. MQ version: MQ Client 7.1.0.4 for Linux, MQ 7.1.0.3 for Windows Linux User (Client): xizhang Windows Users: xinpozh (mqm user), mqtest(standard user) Queue Manger: QM7102 Queue: Q1 Channel: SERVER1 WebSphere® Support Technical Exchange

Example 1: Using USERMAP Step 1: Run the sample amqsputc. Client side: Server side: WebSphere® Support Technical Exchange

Example 1: Using USERMAP Step 2: Use CHLAUTH to fix the issue and define the following rule for the channel SERVER1. SET CHLAUTH('SERVER1') TYPE(USERMAP) CLNTUSER('xizhang') USERSRC(MAP) MCAUSER('xinpozh') ACTION(ADD) Client side: WebSphere® Support Technical Exchange

Example 1: Using USERMAP Server side WebSphere® Support Technical Exchange

Example 1: Using USERMAP Step 3: Edit the rule to fix the issue SET CHLAUTH('SERVER1') TYPE(USERMAP) CLNTUSER('xizhang') USERSRC(MAP) MCAUSER('mqtest') ACTION(REPLACE) Client side: WebSphere® Support Technical Exchange

Example 2: Using QMGRMAP in the Cluster Scenario: In an IBM WebSphere MQ point-to-point network, each remote queue manager is associated with a different receiver channel. However, when implementing a cluster, all of the remote queue managers use the same cluster receiver channel. Task: Use QMGRMAP rule to map the remote queue managers to different user IDs. WebSphere® Support Technical Exchange

Example 2: Using QMGRMAP in the Cluster Cluster: CLFR1, CLFR2, CLPR1, CLPR2 Channel: TO.CLFR1 WebSphere® Support Technical Exchange

Example 2: Using QMGRMAP in the Cluster Step 1: Which user is used to run the channel when no CHLAUTH rule defined? WebSphere® Support Technical Exchange

Example 2: Using QMGRMAP in the Cluster Step 2: Define below QMGRMAP rule: SET CHLAUTH('TO.CLFR1') TYPE(QMGRMAP) QMNAME('CLPR1') USERSRC(MAP) MCAUSER('mqtest') ACTION(ADD) DIS CHS(TO.CLFR1) MCAUSER WebSphere® Support Technical Exchange

Notes about CHLAUTH WebSphere® Support Technical Exchange

Some Important Notes Related to CHLAUTH It’s risky to leave the MCAUSER as blank. For migrated queue managers, CHLAUTH is disabled as default. ALTER QMGR CHLAUTH(ENABLED) Be careful with generic specifications. The CHLAUTH rules are saved in the system queue SYSTEM.CHLAUTH.DATA.QUEUE as persistent messages. WebSphere® Support Technical Exchange

Additional Resources on MQ Security WebSphere® Support Technical Exchange

Additional Resources on MQ Security Redbook: Secure Messaging Scenarios with WebSphere MQ: http://www.redbooks.ibm.com/abstracts/sg248069.html CHLAUTH WSTE by Bill Newcomb http://www-01.ibm.com/support/docview.wss?uid=swg27036381 Using CHLAUTH to lock down Administrative access with MQ Explorer http://www-01.ibm.com/support/docview.wss?uid=swg27039600 Channel authentication records http://www-01.ibm.com/support/knowledgecenter/SSFKSJ_7.1.0/com.ibm.mq.doc/zs14190_.htm WebSphere® Support Technical Exchange

Additional WebSphere Product Resources Learn about upcoming WebSphere Support Technical Exchange webcasts, and access previously recorded presentations at: http://www.ibm.com/software/websphere/support/supp_tech.html Discover the latest trends in WebSphere Technology and implementation, participate in technically-focused briefings, webcasts and podcasts at: http://www.ibm.com/developerworks/websphere/community/ Join the Global WebSphere Community: http://www.websphereusergroup.org Access key product show-me demos and tutorials by visiting IBM Education Assistant: http://www.ibm.com/software/info/education/assistant View a webcast replay with step-by-step instructions for using the Service Request (SR) tool for submitting problems electronically: http://www.ibm.com/software/websphere/support/d2w.html Sign up to receive weekly technical My Notifications emails: http://www.ibm.com/software/support/einfo.html This chart includes links to a number of sites that provide valuable online resources for WebSphere products. Visit the WebSphere Support Technical Exchange site to learn more about upcoming WebSphere Support Technical Exchange webcasts, like the one you attended today, and access previously recorded presentations. developerWorks offers in-depth technical information. Visit websphereusergroup.org for user group information and more product information. The IBM Education Assistant consists of self-help modules to get new users up the learning curve quickly. The SR tool is for Passport Advantage clients to open, update and view PMRs online. And the My Notifications link on all product support pages lets you sign up for weekly e-mail updates for products of interest to you. WebSphere® Support Technical Exchange

Connect with us! Get notified on upcoming webcasts Send an e-mail swsupt@cn.ibm.com or wsehelp@us.ibm.com with subject line “wste subscribe” to get a list of mailing lists and to subscribe Tell us what you want to learn Send us suggestions for future topics or improvements about our webcasts to swsupt@cn.ibm.com or wsehelp@us.ibm.com Be connected! Connect with us on Facebook Connect with us on Twitter WebSphere® Support Technical Exchange

Questions and Answers WebSphere® Support Technical Exchange