securing the receiver channel with mcauser attribute

Question

have a normal dqm setup in ibm mq, wherein i have a Sender channel acting as SRCQM and receiver acting as RMTQM, and following are the contents at both the QMGR end:-

SRCQM (sender ) :- 1.) remote Queue and a transmission queue for sending a message to the business queue present in the remote queue manager. 2.) Sender channel which has a same name as that of the receiver channel present on the remote queue manager.

RMTQM (REMOTE QMGR) :- 1.) Business queue 2.) Receiver channel set as below define channel(to.rmtqm) chltype(rcvr) mcauser('NOACCESS') --- for restricting the access of the sender channel So that can make use of CHLAUTH to grand access to the sender channel.

My question in this case is to know whether mcauser attribute applies only for MQI channel like svrconn,clusrcvr etc. Or it applies to both the categories of channels as well. if Yes then why didn't the connection to the receiver channel get blocked,as if when tried for clusrcvr channel and the svrconn it blocks the user if i set the mcauser attribute to 'NOACCESS',until I don't set any chlauth for the same. But when i try to setup the attribute of receiver channel to 'NOACCESS' the sender is able to connect to receiver.

Can someone please help?

Answer 1

Yes, the MCAUser option is valid for both receiver and svrconn channels, the difference in behaviour is caused by the channels working differently.

The Message channel agent running the sender channel always runs with mqm authority, thats why it can connect. But it will put messages on the receiver side using the MCAUser as alternate user. So you should be seeing errors on the receiver side when it trys to put messages to the business queue.

The srvconn channel is tipically run by the user running your client application, and this user is changed to the MCAUser before the QM checks connect authority, thats how the connection is blocked in your case.