Security settings for MQ exit resources on z/OS

If security is enabled for your queue manager or queue sharing group, you must set up security for the HCL OneTest™ API MQ exit resources, and give user IDs access to the HCL OneTest API intercept queue.
Note: As of release 9.2, HCL OneTest API uses queues that are named COM.GREENHAT.INTERCEPT_LCK, COM.GREENHAT.INTERCEPT.<QMGR>_LCK, RIT.DIVERT.RULES_LCK, and RIT.DIVERT.RULES.<QMGR>_LCK. HCL OneTest API 9.2 attempts to create these queues automatically when they are first accessed. If you do not allow HCL OneTest API to create queues, then you must predefine these queues. The jobs within the RIT.PROC dataset contain sample statements for creating the required security profiles to allow HCL OneTest API to create the queues. The RITDEFN job contains commands for creating the queues manually, if you prefer to predefine them. Note that the WebSphere® MQ exit on z/OS itself has not changed since release 9.1.1. Only the jobs within RIT.PROC were updated in HCL OneTest API release 9.2.1.1.

Security settings for a single queue manager

Use the following definitions for the security settings of the various classes when the queue manager is not part of a queue sharing group. Substitute MQPG with the name of the queue manager.
Class Resource RIT Job Userid CHINIT RIT User Application Userid
MQADMIN MQPG.NAMELIST.COM.GREENHAT.INTERCEPT ALTER   ALTER  
MQPG.NAMELIST.COM.GREENHAT.INTERCEPT_LCK     ALTER  
MQPG.NAMELIST.RIT.DIVERT.RULES ALTER   ALTER  
MQPG.NAMELIST.RIT.DIVERT.RULES_LCK ALTER   ALTER  
MQPG.NAMELIST.RIT.**     ALTER  
MQPG.QUEUE.COM.GREENHAT.INTERCEPT_LCK ALTER   ALTER  
MQPG.QUEUE.RIT.DIVERT.RULES_LCK ALTER   ALTER  
MQPG.CONTEXT.application.queuename     CONTROL CONTROL
MQPG.CONTEXT.**   ALTER    
MQNLIST MQPG.COM.GREENHAT.INTERCEPT ALTER   ALTER  
MQPG.COM.GREENHAT.INTERCEPT_LCK ALTER   ALTER  
MQPG.RIT.DIVERT.RULES ALTER   ALTER  
MQPG.RIT.DIVERT.RULES_LCK ALTER   ALTER  
MQPG.RIT.DIVERTRULE.** ALTER      
MQCMDS MQPG.ALTER.NAMELIST     ALTER  
MQPG.DEFINE.NAMELIST ALTER   ALTER  
MQPG.DELETE.NAMELIST     ALTER  
MQPG.DISPLAY.NAMELIST     READ  
MQPG.DISPLAY.QMGR     READ  
MQPG.DISPLAY.QUEUE     READ  
MQPG.DEFINE.QLOCAL     ALTER  
MQPG.DELETE.QUEUE (required for mirror queue recording)     ALTER  
MQPG.CSQ.** UPDATE      
MQQUEUE MQPG.COM.GREENHAT.COMMAND.QUEUE ALTER ALTER ALTER  
MQPG.CSQ.** UPDATE      
MQPG.SYSTEM.COMMAND.INPUT UPDATE UPDATE UPDATE  
MQPG.SYSTEM.COMMAND.REPLY.MODEL UPDATE UPDATE    
MQPG.SYSTEM.DEFAULT.MODEL.QUEUE   ALTER UPDATE  
MQPG.AMQ.** ALTER ALTER ALTER  
MQPG.COM.GREENHAT.INTERCEPT_LCK ALTER   UPDATE  
MQPG.RIT.DIVERT.RULES_LC ALTER   UPDATE  
MQPG.APPQUEUE READ   UPDATE  
MQCONN MQPG.BATCH READ READ    

Security settings for a Queue Sharing Group

Use the following definitions for the security settings of the various classes when the queue manager is part of a queue sharing group. Substitute MQPG with either the name of the queue sharing group or the name of the queue manager depending on whether your site defines MQ security at the queue manager level or at the group level.
Note: Each queue manager must have permission to access each of the HCL OneTest API name lists and queues. For example, if the queue sharing group is made up of queue managers named QMGA, QMGB, and QMGC, HCL OneTest API will use the following name lists and queues:
Object Name Object Type QSGDISP
COM.GREENHAT.INTERCEPT.QMGA Name list GROUP
COM.GREENHAT.INTERCEPT.QMGB Name list GROUP
COM.GREENHAT.INTERCEPT.QMGC Name list GROUP
RIT.DIVERT.RULES.QMGA Name list GROUP
RIT.DIVERT.RULES.QMGB Name list GROUP
RIT.DIVERT.RULES.QMGC Name list GROUP
COM.GREENHAT.COMMAND.QUEUE.QMGA Queue SHARED
COM.GREENHAT.COMMAND.QUEUE.QMGB Queue SHARED
COM.GREENHAT.COMMAND.QUEUE.QMGC Queue SHARED
COM.GREENHAT.INTERCEPT_LCK Queue SHARED
COM.GREENHAT.INTERCEPT.QMGA_LCK Queue SHARED
COM.GREENHAT.INTERCEPT.QMGB_LCK Queue SHARED
COM.GREENHAT.INTERCEPT.QMGC_LCK Queue SHARED
RIT.DIVERT.RULES.QMGA_LCK Queue SHARED
RIT.DIVERT.RULES.QMGB_LCK Queue SHARED
RIT.DIVERT.RULES.QMGC_LCK Queue SHARED
Define the MQADMIN, MQNLIST, MQCMDS, and MQQUEUE profiles and accesses as listed in the following table to make them accessible from all the three queue managers:
Class Resource RIT Exit Job/Started Task Userid CHINIT RIT User Application Userid
MQADMIN MQPG.NAMELIST.COM.GREENHAT.INTERCEPT.QQQQ where QQQQ is the name of a queue manager. When using RIT with shared queues, an intercept name list is required for each queue manager. ALTER access to the intercept name list for the QMGR associated with the job   ALTER access to the intercept name lists for all queue managers  
MQPG.NAMELIST.COM.GREENHAT.INTERCEPT_LCK     ALTER  

MQPG.NAMELIST.RIT.DIVERT.RULES.QQQQ where QQQQ is the name of a queue manager. When using RIT with shared queues, a divert name list is required for each queue manager.

ALTER access to the divert name list for the QMGR associated with the job   ALTER access to the divert name lists for all queue managers  

MQPG.NAMELIST.RIT.DIVERT.RULES_LCK

ALTER   ALTER  
MQPG.NAMELIST.RIT.**     ALTER  
MQPG.QUEUE.COM.GREENHAT.INTERCEPT_LCK     ALTER  
MQPG.QUEUE.COM.GREENHAT.INTERCEPT.QQQQ_LCK, where QQQQ is the name of a queue manager. When using RIT with shared queues, an intercept locking queue may be required for each queue manager.     ALTER  
MQPG.QUEUE.RIT.DIVERT.RULES.QQQQ_LCK, where QQQQ is the name of a queue manager. When using RIT with shared queues, a divert locking queue is required for each queue manager.     ALTER  
MQPG.CONTEXT.application.queuename     CONTROL CONTROL
MQPG.CONTEXT.**   ALTER    
MQNLIST

MQNLIST MQPG.COM.GREENHAT.INTERCEPT.QQQQ where QQQQ is the name of a queue manager. When using RIT with shared queues, an intercept name list is required for each queue manager.

ALTER access to the intercept name list for the QMGR associated with the job   ALTER access to the intercept name lists for all queue managers  

MQPG.COM.GREENHAT.INTERCEPT_LCK

ALTER   ALTER  
MQPG.RIT.DIVERT.RULES.QQQQ where QQQQ is the name of a queue manager. When using RIT with shared queues, a divert name list is required for each queue manager. ALTER access to the divert name list for the QMGR associated with the job   ALTER access to the divert name lists for all queue managers  

MQPG.RIT.DIVERT.RULES_LCK

ALTER   ALTER  
MQPG.RIT.DIVERTRULE.** ALTER      
MQCMDS

MQPG.ALTER.NAMELIST

    ALTER  
MQPG.DEFINE.NAMELIST ALTER   ALTER  
MQPG.DELETE.NAMELIST     ALTER  
MQPG.DISPLAY.NAMELIST     READ  
MQPG.DISPLAY.QMGR     READ  
MQPG.DISPLAY.QUEUE     READ  
MQPG.CSQ.** UPDATE      
MQPG.DEFINE.QLOCAL     ALTER  
MQPG.DELETE.QUEUE (required for mirror queue recording)     ALTER  

MQQUEUE

MQPG.COM.GREENHAT.COMMAND.QUEUE.QQQQ where QQQQ is the name of a queue manager. When using RIT with shared queues, a command queue is required for each queue manager. ALTER access to the command queue for the QMGR associated with the job ALTER ALTER access to the command queues for all queue managers  
MQPG.CSQ.** UPDATE      
MQPG.SYSTEM.COMMAND.INPUT UPDATE UPDATE UPDATE  
MQPG.SYSTEM.COMMAND.REPLY.MODEL UPDATE UPDATE    
MQPG.SYSTEM.DEFAULT.MODEL.QUEUE   ALTER UPDATE  
MQPG.AMQ.** ALTER ALTER ALTER  
MQPG.COM.GREENHAT.INTERCEPT_LCK     UPDATE  
MQPG.COM.GREENHAT.INTERCEPT.QQQQ_LCK, where QQQQ is the name of a queue manager. When using RIT with shared queues, an intercept locking queue may be required for each queue manager.     UPDATE  
MQPG.RIT.DIVERT.RULES.QQQQ_LCK, where QQQQ is the name of a queue manager. When using RIT with shared queues, a divert locking queue is required for each queue manager.     UPDATE  
MQPG.APPQUEUE READ   UPDATE  
MQCONN MQPG.BATCH READ READ    
Feedback