Security considerations for distributed queuing (using CICS ISC) - Middleware News

Security considerations for distributed queuing (using CICS ISC) - Middleware News



This section discusses security considerations for the "CICS mover".

When defining and starting channels for the CICS mover, the transactions used require access to certain WebSphere MQ and CICS resources. The list below shows the transactions that are used for the CICS mover and the access requirements that might be needed. Security is not a mandatory requirement and these examples are only relevant where you are using resource security.

CKMC

This transaction requires RACF UPDATE access to the following resources:

* The CSQKCDF VSAM file in CICS
* The SYSTEM.CHANNEL.SEQNO local queue in WebSphere MQ
* The SYSTEM.CHANNEL.COMMAND local queue in WebSphere MQ

The CKMC transaction only needs RACF UPDATE access to the above resources under certain conditions:

* For the CSQKCDF file, only when the following functions are performed:
o CREATE a channel
o COPY a channel
o DELETE a channel
o ALTER a channel
* For the SYSTEM.CHANNEL.SEQNO local queue, only when the following functions are performed:
o RESYNC a channel
o RESET a channel
o RESOLVE a channel
* For the system.channel.command local queue when requesting stop for a channel.

All other functions only require RACF READ access.

CKSG

This transaction requires RACF READ access to the following resources:

* The CSQKCDF VSAM file in CICS

RACF UPDATE access to the following resources:

* The SYSTEM.CHANNEL.SEQNO local queue in WebSphere MQ
* The SYSTEM.CHANNEL.COMMAND local queue in WebSphere MQ
* The dead-letter queue (see Dead-letter queue security for information about how to achieve this)

and RACF ALTER access to the following resources:

* The transmission queue specified in the channel definition in WebSphere MQ

CKSV

This transaction requires RACF READ access to the following resources:

* The CSQKCDF VSAM file in WebSphere MQ

RACF UPDATE access to the following resources:

* The SYSTEM.CHANNEL.SEQNO local queue in WebSphere MQ
* The SYSTEM.CHANNEL.COMMAND local queue in WebSphere MQ
* The dead-letter queue (see Dead-letter queue security for information about how to achieve this)

and RACF ALTER access to the following resources:

* The transmission queue specified in the channel definition in WebSphere MQ

CKRQ


This transaction requires RACF READ access to the following resources:

* The CSQKCDF VSAM file in CICS

and RACF UPDATE access to the following resources:

* The SYSTEM.CHANNEL.SEQNO local queue in WebSphere MQ
* In WebSphere MQ, either
o The object name passed in the RemoteQName field of the MQXQH structure, or
o The transmission queue representing the remote queue manager, if the value in the RemoteQMgrName field of the MQXQH structure does not match the local queue manager name.
* In WebSphere MQ the SYSTEM.CHANNEL.COMMAND local queue
* The dead-letter queue (see Dead-letter queue security for information about how to achieve this)

CKRC

This transaction requires RACF READ access to the following resources:

* The CSQKCDF VSAM file in CICS

and RACF UPDATE access to the following resources:

* The SYSTEM.CHANNEL.SEQNO local queue in WebSphere MQ
* The SYSTEM.CHANNEL.COMMAND local queue
* In WebSphere MQ, either
o The object name passed in the RemoteQName field of the MQXQH structure, or
o The transmission queue representing the remote queue manager, if the value in the RemoteQmgrName field of the MQXQH structure does not match the local queue manager name

* The dead-letter queue (see Dead-letter queue security for information about how to achieve this)