I85PREP
⌘ K
IBM MQ V9.1 System Administrator study materials
IBM MQ V9.1 System Administrator study resources

IBM MQ V9.1 System Administrator: Security - IBM MQ V9.1 System Administrator

IBM MQ V9.1 System Administrator · Work through your exam, one topic at a time.

All guide sections

Security - IBM MQ V9.1 System Administrator

Security - what the exam tests

This domain tests authorization with the object authority manager, channel authentication (CHLAUTH), connection authentication (CONNAUTH), and TLS configuration. The exam favors scenarios where a client fails to connect or a user is unexpectedly allowed.

Core rules

  • OAM: authority is granted per object type. setmqaut -m QM1 -t queue -n 'APP.*' -p appgrp +put +get +browse +inq; -t qmgr controls +connect and +inq. dspmqaut displays effective authority; REFRESH SECURITY reloads. Groups are usually better than individual IDs.
  • CHLAUTH: records are matched by channel name and type. Common types are BLOCKADDR, BLOCKUSER, SSLPEERMAP, USERMAP, ADDRESSMAP, QMGRMAP. IBM supplies default records that block privileged users such as mqm over SVRCONN and block remote access to SYSTEM.ADMIN.SVRCONN; SET CHLAUTH(...) ACTION(ADD|REPLACE) and DISPLAY CHLAUTH(...) manage them.
  • CONNAUTH: a queue manager CONNAUTH attribute points to an AUTHINFO object; CHCKCLNT(REQUIRED) forces user ID/password checks on client connections, and ADOPTCTX(YES) adopts the authenticated ID for authority checks.
  • TLS: set the key repository with ALTER QMGR SSLKEYR('/var/mqm/ssl/key'), give each channel a SSLCIPH (for example a TLS 1.2 CipherSpec), and keep SSLCAUTH(REQUIRED) so the client certificate is validated. CERTLABEL selects the certificate.
  • SVRCONN hygiene: set a low-privilege MCAUSER; a blank MCAUSER can let the client's asserted ID through when CHLAUTH permits it.

Worked example

A Java client connects to APP.SVRCONN and gets 2035 on its first PUT. Reasoning: 2035 is authority, not TLS. Check DISPLAY CHLAUTH(APP.SVRCONN) for a blocking record; check the channel's MCAUSER; then dspmqaut -m QM1 -t queue -n APP.REQ -p appuser for +put. The client also needs +connect and +inq on the queue manager. Fix the narrowest missing authority or map the ID, then REFRESH SECURITY if profiles changed.

Traps

Granting +all or disabling CHLAUTH to "make it work" fails security questions and real audits. Confusing 2035 with a certificate error delays the fix. Forgetting +connect on the queue manager while granting queue access still produces 2035. CHCKCLNT(OPTIONAL) does not enforce passwords for every client. A TLS channel needs matching CipherSpecs at both ends, and changing SSLKEYR without restarting leaves the old repository in use.