Security settings for MQ exit resources on z/OS

If security is enabled for your queue manager or queue sharing group, you must set up security for the HCL OneTest™ API MQ exit resources and give user IDs access to the HCL OneTest™ API intercept queue.
Note: As of release 9.2, HCL OneTest™ API uses queues that are named COM.GREENHAT.INTERCEPT_LCK, COM.GREENHAT.INTERCEPT.<QMGR>_LCK, RIT.DIVERT.RULES_LCK, and RIT.DIVERT.RULES.<QMGR>_LCK. HCL OneTest™ API 9.2 attempts to create these queues automatically when they are first accessed. If you do not allow HCL OneTest™ API to create queues, then you must predefine these queues. The jobs within the RIT.PROC dataset contain sample statements for creating the required security profiles to allow HCL OneTest™ API to create the queues. The RITDEFN job contains commands for creating the queues manually, if you prefer to predefine them.
As of release 9.5, Rational Integration Tester also requires these namelists, and queues be defined:
  • Namelists
    • COM.GREENHAT.EXIT.INTERCEPT
    • COM.GREENHAT.EXIT.DIVERT1
    • COM.GREENHAT.EXIT.DIVERT2
  • Queue
    • COM.GREENHAT.ALLOW.GENERIC.QNAMES

These resources are not created automatically by the exit and must be created by the WebSphere® MQ administrator before starting the exit. The RITDEFN job contains commands for creating these objects. RIT users need READ access to COM.GREENHAT.ALLOW.GENERIC.QNAMES in order to record transports, or to use wild cards in the names of queues to be recorded.

Security settings for a single queue manager

Use the following definitions for the security settings of the various classes when the queue manager is not part of a queue sharing group. Substitute MQPG with the name of the queue manager.
Class Resource RIT Job Userid CHINIT RIT User Application Userid
MQADMIN MQPG.NAMELIST.COM.GREENHAT.INTERCEPT ALTER   ALTER  
MQPG.NAMELIST.COM.GREENHAT.INTERCEPT_LCK     ALTER  
MQPG.NAMELIST.COM.GREENHAT.EXIT.INTERCEPT ALTER      
MQPG.NAMELIST.COM.GREENHAT.EXIT.DIVERT1 ALTER      
MQPG.NAMELIST.COM.GREENHAT.EXIT.DIVERT2 ALTER      
MQPG.NAMELIST.RIT.DIVERT.RULES ALTER   ALTER  
MQPG.NAMELIST.RIT.DIVERT.RULES_LCK ALTER   ALTER  
MQPG.NAMELIST.RIT.**     ALTER  
MQPG.QUEUE.COM.GREENHAT.INTERCEPT_LCK ALTER   ALTER  
MQPG.QUEUE.RIT.DIVERT.RULES_LCK ALTER   ALTER  
MQPG.CONTEXT.application.queuename     CONTROL CONTROL
MQPG.CONTEXT.**   ALTER    
MQNLIST MQPG.COM.GREENHAT.INTERCEPT ALTER   ALTER  
MQPG.COM.GREENHAT.INTERCEPT_LCK ALTER   ALTER  
MQPG.COM.GREENHAT.EXIT.INTERCEPT ALTER      
MQPG.COM.GREENHAT.EXIT.DIVERT1 ALTER      
MQPG.COM.GREENHAT.EXIT.DIVERT2 ALTER      
MQPG.RIT.DIVERT.RULES ALTER   ALTER  
MQPG.RIT.DIVERT.RULES_LCK ALTER   ALTER  
MQPG.RIT.DIVERTRULE.** ALTER      
MQCMDS MQPG.ALTER.NAMELIST     ALTER  
MQPG.DEFINE.NAMELIST ALTER   ALTER  
MQPG.DELETE.NAMELIST     ALTER  
MQPG.DISPLAY.NAMELIST READ   READ  
MQPG.DISPLAY.QMGR READ   READ  
MQPG.DISPLAY.QUEUE     READ  
MQPG.DISPLAY.SECURITY READ      
MQPG.DEFINE.QUEUE     ALTER  
MQPG.DEFINE.QLOCAL     ALTER  
MQPG.DELETE.QUEUE (required for mirror queue recording)     ALTER  
MQPG.CSQ.** UPDATE      
MQQUEUE MQPG.COM.GREENHAT.COMMAND.QUEUE ALTER ALTER ALTER  
MQPG.CSQ.** UPDATE      
MQPG.SYSTEM.COMMAND.INPUT UPDATE UPDATE UPDATE  
MQPG.SYSTEM.COMMAND.REPLY.MODEL UPDATE UPDATE    
MQPG.SYSTEM.DEFAULT.MODEL.QUEUE   ALTER UPDATE  
MQPG.AMQ.** ALTER ALTER ALTER  
MQPG.COM.GREENHAT.INTERCEPT_LCK ALTER   UPDATE  
MQPG.RIT.DIVERT.RULES_LC ALTER   UPDATE  
MQPG.COM.GREENHAT.ALLOW.GENERIC.QNAMES is required for transport recording, or when specifying wildcards within the name of the queue to record.     READ  
MQPG.APPQUEUE, where APPQUEUE is either a generic or discrete string that identifies the queue to be recorded or stubbed. READ  

READ (recording)

UPDATE (stubbing)

 
MQCONN MQPG.BATCH READ READ    

Security settings for a Queue Sharing Group

Use the following definitions for the security settings of the various classes when the queue manager is part of a queue sharing group. Substitute MQPG with either the name of the queue sharing group or the name of the queue manager depending on whether your site defines MQ security at the queue manager level or at the group level.
Note: Each queue manager must have permission to access each of the HCL OneTest™ API namelists and queues. For example, if the queue sharing group is made up of queue managers named QMGA, QMGB, and QMGC, HCL OneTest™ API will use the following namelists and queues:
Object Name Object Type QSGDISP
COM.GREENHAT.INTERCEPT.QMGA Namelist GROUP
COM.GREENHAT.INTERCEPT.QMGB Namelist GROUP
COM.GREENHAT.INTERCEPT.QMGC Namelist GROUP
RIT.DIVERT.RULES.QMGA Namelist GROUP
RIT.DIVERT.RULES.QMGB Namelist GROUP
RIT.DIVERT.RULES.QMGC Namelist GROUP
COM.GREENHAT.COMMAND.QUEUE.QMGA Queue SHARED
COM.GREENHAT.COMMAND.QUEUE.QMGB Queue SHARED
COM.GREENHAT.COMMAND.QUEUE.QMGC Queue SHARED
COM.GREENHAT.INTERCEPT_LCK Queue SHARED
COM.GREENHAT.INTERCEPT.QMGA_LCK Queue SHARED
COM.GREENHAT.INTERCEPT.QMGB_LCK Queue SHARED
COM.GREENHAT.INTERCEPT.QMGC_LCK Queue SHARED
RIT.DIVERT.RULES.QMGA_LCK Queue SHARED
RIT.DIVERT.RULES.QMGB_LCK Queue SHARED
RIT.DIVERT.RULES.QMGC_LCK Queue SHARED
Define the MQADMIN, MQNLIST, MQCMDS, and MQQUEUE profiles and accesses as listed in the following table to make them accessible from all the three queue managers:
Class Resource RIT Exit Job/Started Task Userid CHINIT RIT User Application Userid
MQADMIN MQPG.NAMELIST.COM.GREENHAT.INTERCEPT.QQQQ where QQQQ is the name of a queue manager. When using RIT with shared queues, an intercept namelist is required for each queue manager. ALTER access to the intercept namelist for the QMGR associated with the job   ALTER access to the intercept namelists for all queue managers  
MQPG.NAMELIST.COM.GREENHAT.INTERCEPT_LCK     ALTER  
MQPG.NAMELIST.COM.GREENHAT.EXIT.INTERCEPT ALTER      
MQPG.NAMELIST.COM.GREENHAT.EXIT.DIVERT1 ALTER      
MQPG.NAMELIST.COM.GREENHAT.EXIT.DIVERT2 ALTER      
MQPG.NAMELIST.RIT.DIVERT.RULES.QQQQ where QQQQ is the name of a queue manager. When using RIT with shared queues, a divert namelist is required for each queue manager. ALTER access to the divert namelist for the QMGR associated with the job   ALTER access to the divert namelists for all queue managers  
MQPG.NAMELIST.RIT.DIVERT.RULES_LCK ALTER   ALTER  
MQPG.NAMELIST.RIT.**     ALTER  
MQPG.QUEUE.COM.GREENHAT.INTERCEPT_LCK     ALTER  
MQPG.QUEUE.COM.GREENHAT.INTERCEPT.QQQQ_LCK, where QQQQ is the name of a queue manager. When using RIT with shared queues, an intercept locking queue may be required for each queue manager.     ALTER  
MQPG.QUEUE.RIT.DIVERT.RULES.QQQQ_LCK, where QQQQ is the name of a queue manager. When using RIT with shared queues, a divert locking queue is required for each queue manager.     ALTER  
MQPG.CONTEXT.application.queuename     CONTROL CONTROL
MQPG.CONTEXT.**   ALTER    
MQNLIST MQNLIST MQPG.COM.GREENHAT.INTERCEPT.QQQQ where QQQQ is the name of a queue manager. When using RIT with shared queues, an intercept namelist is required for each queue manager. ALTER access to the intercept namelist for the QMGR associated with the job   ALTER access to the intercept namelists for all queue managers  
MQPG.COM.GREENHAT.EXIT.INTERCEPT ALTER      
MQPG.COM.GREENHAT.EXIT.DIVERT1 ALTER      
MQPG.COM.GREENHAT.EXIT.DIVERT2 ALTER      
MQPG.COM.GREENHAT.INTERCEPT_LCK ALTER   ALTER  
MQPG.RIT.DIVERT.RULES.QQQQ where QQQQ is the name of a queue manager. When using RIT with shared queues, a divert namelist is required for each queue manager. ALTER access to the divert namelist for the QMGR associated with the job   ALTER access to the divert namelists for all queue managers  
MQPG.RIT.DIVERT.RULES_LCK ALTER   ALTER  
MQPG.RIT.DIVERTRULE.** ALTER      
MQCMDS MQPG.ALTER.NAMELIST     ALTER  
MQPG.DEFINE.NAMELIST ALTER   ALTER  
MQPG.DELETE.NAMELIST     ALTER  
MQPG.DISPLAY.GROUP     READ  
MQPG.DISPLAY.NAMELIST READ   READ  
MQPG.DISPLAY.QMGR READ   READ  
MQPG.DISPLAY.QUEUE     READ  
MQPG.DISPLAY.SECURITY READ      
MQPG.CSQ.** UPDATE      
MQPG.DEFINE.QUEUE     ALTER  
MQPG.DEFINE.QLOCAL     ALTER  
MQPG.DELETE.QUEUE (required for mirror queue recording)     ALTER  

MQQUEUE

MQPG.COM.GREENHAT.COMMAND.QUEUE.QQQQ where QQQQ is the name of a queue manager. When using RIT with shared queues, a command queue is required for each queue manager. ALTER access to the command queue for the QMGR associated with the job ALTER ALTER access to the command queues for all queue managers  
MQPG.CSQ.** UPDATE      
MQPG.SYSTEM.COMMAND.INPUT UPDATE UPDATE UPDATE  
MQPG.SYSTEM.COMMAND.REPLY.MODEL UPDATE UPDATE    
MQPG.SYSTEM.DEFAULT.MODEL.QUEUE   ALTER UPDATE  
MQPG.AMQ.** ALTER ALTER ALTER  
MQPG.COM.GREENHAT.INTERCEPT_LCK     UPDATE  
MQPG.COM.GREENHAT.INTERCEPT.QQQQ_LCK, where QQQQ is the name of a queue manager. When using RIT with shared queues, an intercept locking queue may be required for each queue manager.     UPDATE  
MQPG.RIT.DIVERT.RULES.QQQQ_LCK, where QQQQ is the name of a queue manager. When using RIT with shared queues, a divert locking queue is required for each queue manager.     UPDATE  
MQPG.COM.GREENHAT.ALLOW.GENERIC.QNAMES is required for transport recording, or when specifying wildcards within the name of the queue to record.     READ  
MQPG.APPQUEUE, where APPQUEUE is either a generic or discrete string that identifies the queue to be recorded or stubbed. READ  

READ (recording)

UPDATE (stubbing)

 
MQCONN MQPG.BATCH READ READ    
Feedback