Hello Amir:
The following tutorial is very comprehensive, and includes workarounds for Test queue managers regarding channel authentication records.
It provides the steps to allow a non-Administrator user (fulano) to use a server-connection channel and to put/get messages from a queue.
.
Even though the focus is for Linux, the actual MQ steps are the same for Windows.
https://www.ibm.com/support/pages/node/1135522
Configuring an IBM MQ queue manager to use a dedicated Listener, Channel and Queue in Linux
The chapters are:
Chapter 1: User "root" adds the proper user and group in both hosts
User "fulano" is not an MQ administrator, and will be allowed to put/get messages.
User "bob" is not an MQ administrator, and will NOT be allowed to put/get messages.
Chapter 2: MQ administrator (user "mqm") creates a queue manager with the basic/normal objects in host-1
Chapter 3: MQ administrator adds the dedicated objects.
Chapter 4: User "fulano" from host-2 puts and gets messages using the dedicated objects.
Chapter 5: User "fulano" from host-2 uses runmqsc to look at CURDEPTH on MY.Q
Chapter 6: User "bob" from host-2 fails to put/get messages using the dedicated objects
.
The dedicated objects are:
- Listener (such as MY.LISTENER in port 1420)
- Server-Connection Channel (such as MY.CHANNEL)
- Queue in Linux (such as MY.Q)
- Channel Authentication Record (CHLAUTH) for this server-connection channel that allows only the user "fulano" who is a member of the group "mqusers".
- Authority records for group "mqusers" to display, put, get, browse, etc. from the dedicated queue.
I hope that this is helpful.
Thank you for using IBM products!
Angel Rivera, IBM MQ Support
------------------------------
Angel Rivera
IBM MQ Support
Research Triangle Park NC
------------------------------