Passing user IDs to IBM MQ

ID that is associated with the BBI-SS PAS that is passed to IBM MQ

For each queue manager that uses this option, the PAS ID must have the IBM MQ authorizations that are described in the following sections.

Each individual user’s access to IBM MQ objects and commands can be controlled through BMC AMI Ops Monitor for MQ. For more information, see BMC AMI Ops Monitor for MQ.

ID that is associated with the TSO session that is connected to the BBI-SS PAS that is passed to IBM MQ

This ID allows your existing security definitions in IBM MQ to determine access to IBM MQ objects and commands. The TSO user ID is treated as an alternate user ID.

For each queue manager that uses this option, perform the following steps:

1. If the IBM MQ alternate user switch profile is not defined, add resource profiles to the MQADMIN class and authorize the BBI-SS PAS ID for UPDATE access to the profiles.

   The format for these resources is:

   ssidALTERNATE.USER.alternateUserid

   An example of a resource definition is

   CSQ1.ALTERNATE.USER.*
2. If the command security switch profile is not defined, add command profiles for the DISPLAY verb and authorize the BBI-SS PAS ID for READ access to those profiles.

For more information, see Defining-command-profiles.

Using the USER keyword for distributed (AGENT) definitions causes the user ID that is associated with the TSO session to be passed to the distributed system for security checks. The user ID must be defined on the distributed system for security checking to process correctly.

For the AGENT queue manager, regardless of the option specified for the security user ID (PAS|USER) statement in the queue manager profile (QMPROF), the BBI-SS PAS user ID must be defined on the AGENT machine (using all lowercase letters).

If PAS user ID is not defined on Agent machine, you would see the following messages on BMC AMI Ops Monitor for MQ, when you are trying to retrieve data back from the AGENT: