Scenario: Configuring access control

In this scenario, we can set up your MQIPT to only accept connections from specific clients by using the Java Security Manager to add security checks on the MQIPT listener port.

Before you begin

Before you start to use this scenario, make sure that we have completed the prerequisite tasks listed in Scenarios: Getting started with MQIPT.

About this task

Figure 1. Access control network diagram

This diagram shows the connection from the IBM MQ client (called client1.company1.com on port 1415) through MQIPT to the IBM MQ server (called server1.company2.com on port 1414).

Procedure

To configure access control, complete the following steps:

Set up MQIPT:
1. Copy the sample Java Security Manager policy to the MQIPT home directory by entering the following command at a command prompt:
```
copy C:\mqipt\ssl\mqiptSample.policy C:\mqiptHome\mqipt.policy
```
2. Add a policy definition by using the following command:
```
C:\mqipt\java\jre\bin\policytool
```
3. Click File > Open then select C:\mqiptHome\mqipt.policy..
4. Click Edit Policy Entry then change CodeBase from:
```
file:/C:/Program Files/IBM/IBM MQ Internet Pass-Thru/lib/com.ibm.mq.ipt.jar
```
  to:
```
file:/C:/mqipt/lib/com.ibm.mq.ipt.jar
```
5. Change the file permissions for the “IBM MQ Internet Pass-Thru", errors and logs directories from:
```
C:\Program Files\IBM\IBM MQ Internet Pass-Thru
```
  to:
```
C:\mqiptHome
```
6. Change the other file permissions from:
```
C:\Program Files\IBM\IBM MQ Internet Pass-Thru
```
  to:
```
C:\mqipt
```
7. Click Add Permission Complete the fields as follows: Permission: SocketPermission
  Target: client1.company1.com:1024-
  Actions: accept, listen, resolve
8. Click File > Save to save the changes to the policy file.
9. Edit mqipt.conf. Add two properties to the [global] section:
```
SecurityManager=true
SecurityManagerPolicy=C:\mqiptHome\mqipt.policy
```
  Add a route definition:
```
[route]
ListenerPort=1415
Destination=server1.company2.com
DestinationPort=1414
```

Start MQIPT: Open a command prompt and enter the following:

C:\mqipt\bin\mqipt C:\mqiptHome

where C:\mqiptHome indicates the location of the MQIPT configuration file, mqipt.conf. The following message indicates successful completion:

5639-L92 (C) Copyright IBM Corp. 2000, 2017 All Rights Reserved
MQCPI001 IBM MQ Internet Pass-Thru Version 2.1.0.3 starting
MQCPI004 Reading configuration information from C:\mqiptHome\mqipt.conf
MQCPI055 Setting the java.security.policy to C:\mqiptHome\mqipt.policy
MQCPI053 Starting the Java Security Manager
MQCPI011 The path C:\mqiptHome\logs will be used to store the log files
MQCPI006 Route 1415 has started and will forward messages to :
MQCPI034 ....server1.company2.com(1414)
MQCPI035 ....using MQ protocols
MQCPI078 Route 1415 ready for connection requests

At a command prompt on the IBM MQ client, enter the following commands:
1. Set the MQSERVER environment variable:
```
SET MQSERVER=MQIPT.CONN.CHANNEL/tcp/10.9.1.2(1415)
```
2. Put a message:
```
amqsputc MQIPT.LOCAL.QUEUE MQIPT.QM1
Hello world
```
  Press Enter twice after typing the message string.
3. Get the message:
```
amqsgetc MQIPT.LOCAL.QUEUE MQIPT.QM1
```
  The message, "Hello world" is returned.