MQ RACF Profiles

MQ RACF profiles are the individual permission slips inside the mqadmin class—one row per combination of queue manager, object type, object name pattern, and userid or group. When a CICS payment transaction MQPUTs to PAY.IN, SAF searches RACF for a profile that grants PUT on that queue for the CICS region userid. Missing profile means reason 2035 and a midnight call. Profiles are where administrators live day to day: creating generics for `PAY.*`, tightening test regions, revoking alter authority from application ids, and proving auditors that segregation of duties holds. IBM MQ SET AUTHREC and DISPLAY AUTHREC speak the same concepts on the queue manager repository. This tutorial explains profile structure, authority bits, generic versus discrete profiles, aligning AUTHREC with RACF, group versus user grants, common cutover mistakes, and troubleshooting workflows beginners can follow without guessing.

Profile Structure Conceptually

A profile answers: who (principal), on which queue manager, for which object type and name, may do what (authorities). Principals are RACF userids or groups. Objects include qmgr, queue, topic, channel, and others per IBM documentation. Authorities are granular—connect before open, get and put for messaging, alter for MQSC changes, ctrl for control commands on some objects.

SET AUTHREC Examples

1
2
3
4
5
6
7
8
SET AUTHREC PROFILE('PAY.IN') OBJTYPE(QUEUE) PRINCIPAL('cicsprod')
  AUTHADD(GET,PUT,INQ)
 
SET AUTHREC PROFILE('**') OBJTYPE(QUEUE) PRINCIPAL('mqmon')
  AUTHADD(INQ)
 
SET AUTHREC PROFILE('self') OBJTYPE(QMGR) PRINCIPAL('cicsprod')
  AUTHADD(CONNECT,INQ)

PROFILE names the object or pattern. PRINCIPAL is the RACF userid or group. AUTHADD grants; AUTHRM removes. Use GENERIC when the profile name is a wildcard pattern. After RACF changes, some sites require REFRESH SECURITY TYPE(MQADMIN) or queue manager refresh—follow local runbooks. Typos in PROFILE are silent until 2035 at runtime.

DISPLAY AUTHREC for Verification

1
2
DISPLAY AUTHREC PROFILE('PAY.IN') OBJTYPE(QUEUE) PRINCIPAL('cicsprod')
DISPLAY AUTHREC OBJTYPE(QUEUE) PRINCIPAL('cicsprod')

Before opening a ticket to application teams, administrators DISPLAY AUTHREC for the failing principal and object. Compare with RACF LISTUSER and group memberships. Remember surrogate submission: the userid on the job statement is what matters, not the developer’s personal id.

Generic Profiles

Generic profiles end with asterisk or use site-defined patterns so one definition covers many queues. `SET AUTHREC PROFILE('PAY.*') OBJTYPE(QUEUE) GENERIC` might grant put to a payment service id for all payment queues. Generics accelerate projects but cause audit pain when someone adds PAY.TEST with production authority. Review generics quarterly; prefer discrete profiles for high-risk queues like wire transfer and key management.

• Good generic: read-only INQ for monitors on `APP.*`.
• Risky generic: PUT on `*` for a shared batch userid.
• Discrete: ALTER only on SYSTEM.ADMIN.* for mqadmin team.

Groups Versus Users

Grant authority to RACF groups such as MQAPPPAY and place application userids in the group. Rotation and auditing become easier than editing dozens of discrete profiles. Avoid nesting groups in ways your security team forbids. Document which group owns which integration pattern in a central register.

Cutover Checklist

1. Define principals per region and batch job—not per developer laptop.
2. Grant CONNECT on qmgr before queue-level get or put.
3. Match PROFILE spelling to object name including case where relevant.
4. Run DISPLAY AUTHREC in test with production-like ids.
5. Execute integration test MQPUT/MQGET; capture reason codes if fail.
6. Schedule RACF refresh and verify SMF records show expected grants.

Troubleshooting 2035

Profiles and Compliance

Segregation of duties: developers should not hold alter on production queues; operators should not hold put on wire queues unless dual control approves. Profiles are evidence in audits—export DISPLAY AUTHREC after changes. Pair with CHLAUTH records for channel-facing identities.

Explainer: Keys on a Keyring

Each profile is a key labeled with a door name. Generics are master keys that open many doors—convenient until someone copies the master. Discrete keys are slower to manage but safer for vault doors.

Explain Like I'm Five

A profile is your name on the list next to a toy box. If your name is not there, you cannot put toys in or take toys out of that box.

Practice Exercises

Exercise 1

Write SET AUTHREC commands for a consumer with GET only and a producer with PUT only on ORDERS.IN.

Exercise 2

Argue for and against a generic `APP.*` PUT profile for ten microservices.

Exercise 3

Document a 2035 troubleshooting flowchart from application log to DISPLAY AUTHREC.

Frequently Asked Questions

Test Your Knowledge