Security settings for MQ exit resources on z/OS
If security is enabled for your queue manager or queue sharing group, you must set up security for the HCL OneTest™ API MQ exit resources and give user IDs access to the HCL OneTest™ API intercept queue.
Note: As of version 9.2,0, HCL OneTest™ API uses
queues that are named COM.GREENHAT.INTERCEPT_LCK, COM.GREENHAT.INTERCEPT.<QMGR>_LCK,
RIT.DIVERT.RULES_LCK, and RIT.DIVERT.RULES.<QMGR>_LCK. HCL OneTest™ API V9.2.0
attempts to create these queues automatically when they are first accessed. If you do not allow
HCL OneTest™ API
to create queues, then you must predefine these queues. The jobs within the RIT.PROC dataset contain
sample statements for creating the required security profiles to allow HCL OneTest™ API to create
the queues. The RITDEFN job contains commands for creating the queues manually, if you prefer to
predefine them.
As of version 9.5.0, HCL OneTest™ API also
requires these namelists, and queues be defined:
- Namelists
- COM.GREENHAT.EXIT.INTERCEPT
- COM.GREENHAT.EXIT.DIVERT1
- COM.GREENHAT.EXIT.DIVERT2
- Queue
- COM.GREENHAT.ALLOW.GENERIC.QNAMES
These resources are not created automatically by the exit and must be created by the WebSphere® MQ administrator before starting the exit. The RITDEFN job contains commands for creating these objects. HCL OneTest™ API users need READ access to COM.GREENHAT.ALLOW.GENERIC.QNAMES in order to record transports, or to use wild cards in the names of queues to be recorded.
Security settings for a single queue manager
Use the following definitions for the security settings of the various classes
when the queue manager is not part of a queue sharing group. Substitute MQPG with the name of the
queue manager.
| Class | Resource | RIT Job Userid | CHINIT | RIT User | Application Userid |
|---|---|---|---|---|---|
| MQADMIN | MQPG.NAMELIST.COM.GREENHAT.INTERCEPT | ALTER | ALTER | ||
| MQPG.NAMELIST.COM.GREENHAT.INTERCEPT_LCK | ALTER | ||||
| MQPG.NAMELIST.COM.GREENHAT.EXIT.INTERCEPT | ALTER | ||||
| MQPG.NAMELIST.COM.GREENHAT.EXIT.DIVERT1 | ALTER | ||||
| MQPG.NAMELIST.COM.GREENHAT.EXIT.DIVERT2 | ALTER | ||||
| MQPG.NAMELIST.RIT.DIVERT.RULES | ALTER | ALTER | |||
| MQPG.NAMELIST.RIT.DIVERT.RULES_LCK | ALTER | ALTER | |||
| MQPG.NAMELIST.RIT.** | ALTER | ||||
| MQPG.QUEUE.COM.GREENHAT.INTERCEPT_LCK | ALTER | ALTER | |||
| MQPG.QUEUE.RIT.DIVERT.RULES_LCK | ALTER | ALTER | |||
| MQPG.CONTEXT.application.queuename | CONTROL | CONTROL | |||
| MQPG.CONTEXT.** | ALTER | ||||
| MQNLIST | MQPG.COM.GREENHAT.INTERCEPT | ALTER | ALTER | ||
| MQPG.COM.GREENHAT.INTERCEPT_LCK | ALTER | ALTER | |||
| MQPG.COM.GREENHAT.EXIT.INTERCEPT | ALTER | ||||
| MQPG.COM.GREENHAT.EXIT.DIVERT1 | ALTER | ||||
| MQPG.COM.GREENHAT.EXIT.DIVERT2 | ALTER | ||||
| MQPG.RIT.DIVERT.RULES | ALTER | ALTER | |||
| MQPG.RIT.DIVERT.RULES_LCK | ALTER | ALTER | |||
| MQPG.RIT.DIVERTRULE.** | ALTER | ||||
| MQCMDS | MQPG.ALTER.NAMELIST | ALTER | |||
| MQPG.DEFINE.NAMELIST | ALTER | ALTER | |||
| MQPG.DELETE.NAMELIST | ALTER | ||||
| MQPG.DISPLAY.NAMELIST | READ | READ | |||
| MQPG.DISPLAY.QMGR | READ | READ | |||
| MQPG.DISPLAY.QUEUE | READ | ||||
| MQPG.DISPLAY.SECURITY | READ | ||||
| MQPG.DEFINE.QUEUE | ALTER | ||||
| MQPG.DEFINE.QLOCAL | ALTER | ||||
| MQPG.DELETE.QUEUE (required for mirror queue recording) | ALTER | ||||
| MQPG.CSQ.** | UPDATE | ||||
| MQQUEUE | MQPG.COM.GREENHAT.COMMAND.QUEUE | ALTER | ALTER | ALTER | |
| MQPG.CSQ.** | UPDATE | ||||
| MQPG.SYSTEM.COMMAND.INPUT | UPDATE | UPDATE | UPDATE | ||
| MQPG.SYSTEM.COMMAND.REPLY.MODEL | UPDATE | UPDATE | |||
| MQPG.SYSTEM.DEFAULT.MODEL.QUEUE | ALTER | UPDATE | |||
| MQPG.AMQ.** | ALTER | ALTER | ALTER | ||
| MQPG.COM.GREENHAT.INTERCEPT_LCK | ALTER | UPDATE | |||
| MQPG.RIT.DIVERT.RULES_LC | ALTER | UPDATE | |||
| MQPG.COM.GREENHAT.ALLOW.GENERIC.QNAMES is required for transport recording, or when specifying wildcards within the name of the queue to record. | READ | ||||
| MQPG.APPQUEUE, where APPQUEUE is either a generic or discrete string that identifies the queue to be recorded or stubbed. | READ |
READ (recording) UPDATE (stubbing) |
|||
| MQCONN | MQPG.BATCH | READ | READ |
Security settings for a Queue Sharing Group
Use the following definitions for the security settings of the various classes when the queue
manager is part of a queue sharing group. Substitute MQPG with either the name of the queue sharing
group or the name of the queue manager depending on whether your site defines MQ security at the
queue manager level or at the group level.
Note: Each queue manager must have permission to access
each of the HCL OneTest™ API namelists
and queues. For example, if the queue sharing group is made up of queue managers named QMGA, QMGB,
and QMGC, HCL OneTest™ API will use
the following namelists and queues:
| Object Name | Object Type | QSGDISP |
|---|---|---|
| COM.GREENHAT.INTERCEPT.QMGA | Namelist | GROUP |
| COM.GREENHAT.INTERCEPT.QMGB | Namelist | GROUP |
| COM.GREENHAT.INTERCEPT.QMGC | Namelist | GROUP |
| RIT.DIVERT.RULES.QMGA | Namelist | GROUP |
| RIT.DIVERT.RULES.QMGB | Namelist | GROUP |
| RIT.DIVERT.RULES.QMGC | Namelist | GROUP |
| COM.GREENHAT.COMMAND.QUEUE.QMGA | Queue | SHARED |
| COM.GREENHAT.COMMAND.QUEUE.QMGB | Queue | SHARED |
| COM.GREENHAT.COMMAND.QUEUE.QMGC | Queue | SHARED |
| COM.GREENHAT.INTERCEPT_LCK | Queue | SHARED |
| COM.GREENHAT.INTERCEPT.QMGA_LCK | Queue | SHARED |
| COM.GREENHAT.INTERCEPT.QMGB_LCK | Queue | SHARED |
| COM.GREENHAT.INTERCEPT.QMGC_LCK | Queue | SHARED |
| RIT.DIVERT.RULES.QMGA_LCK | Queue | SHARED |
| RIT.DIVERT.RULES.QMGB_LCK | Queue | SHARED |
| RIT.DIVERT.RULES.QMGC_LCK | Queue | SHARED |
Define the MQADMIN, MQNLIST, MQCMDS, and MQQUEUE profiles and accesses as listed in the following
table to make them accessible from all the three queue managers:
| Class | Resource | RIT Exit Job/Started Task Userid | CHINIT | RIT User | Application Userid |
|---|---|---|---|---|---|
| MQADMIN | MQPG.NAMELIST.COM.GREENHAT.INTERCEPT.QQQQ where QQQQ is the name of a queue manager. When using RIT with shared queues, an intercept namelist is required for each queue manager. | ALTER access to the intercept namelist for the QMGR associated with the job | ALTER access to the intercept namelists for all queue managers | ||
| MQPG.NAMELIST.COM.GREENHAT.INTERCEPT_LCK | ALTER | ||||
| MQPG.NAMELIST.COM.GREENHAT.EXIT.INTERCEPT | ALTER | ||||
| MQPG.NAMELIST.COM.GREENHAT.EXIT.DIVERT1 | ALTER | ||||
| MQPG.NAMELIST.COM.GREENHAT.EXIT.DIVERT2 | ALTER | ||||
| MQPG.NAMELIST.RIT.DIVERT.RULES.QQQQ where QQQQ is the name of a queue manager. When using RIT with shared queues, a divert namelist is required for each queue manager. | ALTER access to the divert namelist for the QMGR associated with the job | ALTER access to the divert namelists for all queue managers | |||
| MQPG.NAMELIST.RIT.DIVERT.RULES_LCK | ALTER | ALTER | |||
| MQPG.NAMELIST.RIT.** | ALTER | ||||
| MQPG.QUEUE.COM.GREENHAT.INTERCEPT_LCK | ALTER | ||||
| MQPG.QUEUE.COM.GREENHAT.INTERCEPT.QQQQ_LCK, where QQQQ is the name of a queue manager. When using RIT with shared queues, an intercept locking queue may be required for each queue manager. | ALTER | ||||
| MQPG.QUEUE.RIT.DIVERT.RULES.QQQQ_LCK, where QQQQ is the name of a queue manager. When using RIT with shared queues, a divert locking queue is required for each queue manager. | ALTER | ||||
| MQPG.CONTEXT.application.queuename | CONTROL | CONTROL | |||
| MQPG.CONTEXT.** | ALTER | ||||
| MQNLIST | MQNLIST MQPG.COM.GREENHAT.INTERCEPT.QQQQ where QQQQ is the name of a queue manager. When using RIT with shared queues, an intercept namelist is required for each queue manager. | ALTER access to the intercept namelist for the QMGR associated with the job | ALTER access to the intercept namelists for all queue managers | ||
| MQPG.COM.GREENHAT.EXIT.INTERCEPT | ALTER | ||||
| MQPG.COM.GREENHAT.EXIT.DIVERT1 | ALTER | ||||
| MQPG.COM.GREENHAT.EXIT.DIVERT2 | ALTER | ||||
| MQPG.COM.GREENHAT.INTERCEPT_LCK | ALTER | ALTER | |||
| MQPG.RIT.DIVERT.RULES.QQQQ where QQQQ is the name of a queue manager. When using RIT with shared queues, a divert namelist is required for each queue manager. | ALTER access to the divert namelist for the QMGR associated with the job | ALTER access to the divert namelists for all queue managers | |||
| MQPG.RIT.DIVERT.RULES_LCK | ALTER | ALTER | |||
| MQPG.RIT.DIVERTRULE.** | ALTER | ||||
| MQCMDS | MQPG.ALTER.NAMELIST | ALTER | |||
| MQPG.DEFINE.NAMELIST | ALTER | ALTER | |||
| MQPG.DELETE.NAMELIST | ALTER | ||||
| MQPG.DISPLAY.GROUP | READ | ||||
| MQPG.DISPLAY.NAMELIST | READ | READ | |||
| MQPG.DISPLAY.QMGR | READ | READ | |||
| MQPG.DISPLAY.QUEUE | READ | ||||
| MQPG.DISPLAY.SECURITY | READ | ||||
| MQPG.CSQ.** | UPDATE | ||||
| MQPG.DEFINE.QUEUE | ALTER | ||||
| MQPG.DEFINE.QLOCAL | ALTER | ||||
| MQPG.DELETE.QUEUE (required for mirror queue recording) | ALTER | ||||
|
MQQUEUE |
MQPG.COM.GREENHAT.COMMAND.QUEUE.QQQQ where QQQQ is the name of a queue manager. When using RIT with shared queues, a command queue is required for each queue manager. | ALTER access to the command queue for the QMGR associated with the job | ALTER | ALTER access to the command queues for all queue managers | |
| MQPG.CSQ.** | UPDATE | ||||
| MQPG.SYSTEM.COMMAND.INPUT | UPDATE | UPDATE | UPDATE | ||
| MQPG.SYSTEM.COMMAND.REPLY.MODEL | UPDATE | UPDATE | |||
| MQPG.SYSTEM.DEFAULT.MODEL.QUEUE | ALTER | UPDATE | |||
| MQPG.AMQ.** | ALTER | ALTER | ALTER | ||
| MQPG.COM.GREENHAT.INTERCEPT_LCK | UPDATE | ||||
| MQPG.COM.GREENHAT.INTERCEPT.QQQQ_LCK, where QQQQ is the name of a queue manager. When using RIT with shared queues, an intercept locking queue may be required for each queue manager. | UPDATE | ||||
| MQPG.RIT.DIVERT.RULES.QQQQ_LCK, where QQQQ is the name of a queue manager. When using RIT with shared queues, a divert locking queue is required for each queue manager. | UPDATE | ||||
| MQPG.COM.GREENHAT.ALLOW.GENERIC.QNAMES is required for transport recording, or when specifying wildcards within the name of the queue to record. | READ | ||||
| MQPG.APPQUEUE, where APPQUEUE is either a generic or discrete string that identifies the queue to be recorded or stubbed. | READ | READ (recording) UPDATE (stubbing) |
|||
| MQCONN | MQPG.BATCH | READ | READ |