Ad
More Related Content
What's hot (20)
Similar to Controlling access to your IBM MQ System (20)
Ad
More from Robert Parker (19)
Ad
Recently uploaded (20)
Controlling access to your IBM MQ System
- 1. TechCon 2022 TechCon 2022 432 Controlling access to your IBM MQ System Rob Parker Security Architect, Software Engineer, IBM MQ [email protected]
- 2. TechCon 2022 2 Virtual Experience Please note: IBM’s statements regarding its plans, directions, and intent are subject to change or withdrawal without notice at IBM’s sole discretion. Information regarding potential future products is intended to outline our general product direction and it should not be relied on in making a purchasing decision. The information mentioned regarding potential future products is not a commitment, promise, or legal obligation to deliver any material, code or functionality. Information about potential future products may not be incorporated into any contract. The development, release, and timing of any future features or functionality described for our products remains at our sole discretion. Performance is based on measurements and projections using standard IBM benchmarks in a controlled environment. The actual throughput or performance that any user will experience will vary depending upon many factors, including considerations such as the amount of multiprogramming in the user’s job stream, the I/O configuration, the storage configuration, and the workload processed. Therefore, no assurance can be given that an individual user will achieve results similar to those stated here.
- 3. 3 TechCon 2022 Virtual Experience Agenda —Identity and authorization —Authentication —Common —Application —Granular controls —Modifying identities —Message verification —Conclusion and Q&A
- 4. TechCon 2022 Digital Experience 4 Identity and authorization
- 5. 5 TechCon 2022 Virtual Experience Identities in MQ • Identity provides a mechanism for authorization • We can provide authority to an identity so allow/restrict them from performing actions • When an application or queue manager connects it can provide different types of identities.
- 6. 6 TechCon 2022 Virtual Experience Application identities in MQ OS User Supplied User Certificate IP/ Hostname • User the application runs as • User supplied via MQCSP structure • Includes password • IBM MQ v8+ • IP/Hostname of connecting application • TLS Certificate remote application provides
- 7. 7 TechCon 2022 Virtual Experience Queue Manager identities in MQ Queue Manager Name Certificate IP/ Hostname • Remote queue manager’s name • IP/Hostname of connecting queue manager • TLS Certificate remote queue manager provides
- 8. 8 TechCon 2022 Virtual Experience Different identities in MQ • To authorize, MQ uses user based identification • Identities outside of this need to convert to user • MQ provides options for this.
- 9. 9 TechCon 2022 Virtual Experience MQ Authorization • Controlled by creating authority records • Specific user or group. • Generic MQ object • Authority is for MQ objects and what actions they can perform • (PUT, GET, OPEN, etc) • If a user or group does not have authority to do what they are trying to do, they get blocked. • Authority is built up from all authority record sources. • Users who are members of the mqm group have full administrator access.
- 10. TechCon 2022 Digital Experience 10 Authentication
- 11. 11 TechCon 2022 Virtual Experience Authentication • Blindly trusting the identity a connection provides is bad. • Are they really an administrator? • Should they be able to put messages there? • Authentication provides a mechanism to check the identity is who they claim to be. • MQ provides numerous options
- 12. 12 TechCon 2022 Virtual Experience Authentication • While there are numerous options… • MQ has different options whether it is a application or queue manager
- 13. TechCon 2022 Digital Experience 13 Common Authentication options
- 14. 14 TechCon 2022 Virtual Experience TLS • MQ channels can be configured to require connecting clients to supply a trusted certificate • Trust of a client’s certificate follows TLS standards Cert CA
- 15. 15 TechCon 2022 Virtual Experience Security exits • Security exits are bespoke, customer created exits that are ran during the security checking. • MQ comes with an API that can interact with MQ to provide extra control over a connection. • They allow customers to expand MQ's security to suit their needs. • When ran the security exit will have access to the channel definition and information about the incoming connection. • It will also have a piece of data passed to it that is set on the channel – SCYDATA • Channel exits can be created in pairs that exchange ‘messages’
- 16. 16 TechCon 2022 Virtual Experience Channel authentication rules • Channel authentication rules are filters that can be applied for incoming connections • Allowlisting – Allow connections based on a filter • Mapping rules – Allow connections based on a filter and modify it’s identity • Blocklisting – Block a connection based on a filter • There are four types of filters: • TLS Distinguished name (Issuer and Subject) • Client User ID name • Remote Queue Manager name • IP/Hostname London New York Block: London Allow: New York
- 17. TechCon 2022 Digital Experience 17 Application only authentication option
- 18. 18 TechCon 2022 Virtual Experience Connection Authentication • Connection authentication feature • Allows authentication using user credentials supplied by client applications • Credentials can be validated against a number of user repositories • OS • LDAP • PAM modules • Security exits LDAP Userid Password
- 19. TechCon 2022 Digital Experience 19 Granular Controls
- 20. 20 TechCon 2022 Virtual Experience Granular controls • You may wish to have different levels of checks for different connections • You may trust the internal but need further reassurance for external
- 21. 21 TechCon 2022 Virtual Experience Granular controls • Of course you may choose to trust no-one
- 22. 22 TechCon 2022 Virtual Experience Granular controls • Each Security option can be configured for all, some or no channels • Security Exits • Applied on a per-channel basis. • TLS • Mutual TLS enforced on per channel basis – SSLCAUTH(OPTIONAL|REQUIRED) • Can limit allowed certificates via SSLPEER or SSLPEERMAP • Channel Authentication Rules • Configured to apply to a specific or set of channels
- 23. 23 TechCon 2022 Virtual Experience Granular Controls • Connection authentication is the same • CHCKCLNT field allows you to specify whether to enforce userid/pw or not • This can also be changed via channel authentication rules CHCKCLNT(optional) CHCKCLNT(required)
- 24. TechCon 2022 Digital Experience 24 Modifying identities
- 25. 25 TechCon 2022 Virtual Experience Different identities in MQ • To authorize, MQ uses user based identification • Identities outside of this need to convert to user • MQ provides options for this. Earlier!
- 26. 26 TechCon 2022 Virtual Experience Modifying identities Channel Authentication Rules TLS Security Exits Connection Authentication • Mapping rules • USERMAP • ADDRESSMAP • QMGRMAP • SSLPEERMAP Not directly, use Channel authentication rules or security exits • Directly modify the MCAUSER • ADOPTCTX
- 27. 27 TechCon 2022 Virtual Experience Modifying identities • Using the granular controls you can authenticate with one mechanism but then switch to authorize via a different identity Modify identity to app2 Modify identity to app1 Cert Userid Passwor d
- 28. 28 TechCon 2022 Virtual Experience Which identity will be used? Method Notes Client machine user ID flowed to server This will be over-ridden by anything else. Rarely do you want to trust an unauthenticated client side user ID. MCAUSER set on SVRCONN channel definition A handy trick to ensure that the client flowed ID is never used is to define the MCAUSER as ‘rubbish’ and then anything that is not set appropriately by one of the next methods cannot connect. MCAUSER set by ADOPTCTX(YES) The queue manager wide setting to adopt the password authenticated user ID as the MCAUSER will over-ride either of the above. MCAUSER set by CHLAUTH rule To allow more granular control of MCAUSER setting, rather than relying on the above queue manager wide setting, you can of course use CHLAUTH rules MCAUSER set by Security Exit Although CHLAUTH gets the final say on whether a connection is blocked (security exit not called in that case), the security exit does get called with the MCAUSER CHLAUTH has decided upon, and can change it. Highest Lowest
- 29. 29 TechCon 2022 Virtual Experience Which identity will be used? – Queue Manager Method Notes UserId that started the channel process Commonly MQM MCAUSER set on SVRCONN channel definition A handy trick to ensure that the client flowed ID is never used is to define the MCAUSER as ‘rubbish’ and then anything that is not set appropriately by one of the next methods cannot connect. MCAUSER set by CHLAUTH rule To allow more granular control of MCAUSER setting, rather than relying on the above queue manager wide setting, you can of course use CHLAUTH rules MCAUSER set by Security Exit Although CHLAUTH gets the final say on whether a connection is blocked (security exit not called in that case), the security exit does get called with the MCAUSER CHLAUTH has decided upon, and can change it. Highest Lowest • The queue manager differs slightly… • It is important to change the default identity
- 30. 30 TechCon 2022 Virtual Experience Upstream messages • Not changing the userid on a QM-to-QM connection is risky • To prevent this use a mechanism from before to modify userid of channel • Additionally: PUTAUT • PUTAUT(CTX) • Uses userid from the Message • Combine with channel auth rules PCF admin message for Command queue
- 31. TechCon 2022 Digital Experience 31 Message validation
- 32. 32 TechCon 2022 Virtual Experience Authenticating messages • Applications may wish to validate that the message came from an expected person • Advanced Message Security can provide this Mesesage
- 33. 33 TechCon 2022 Virtual Experience Advanced Message security - Integrity • AMS can be configured to sign messages • Attaches a cryptographic signature to the message • Receiving application verifies signature and rejects unexpected Mesesage
- 34. TechCon 2022 Digital Experience 34 Conclusion
- 35. 35 TechCon 2022 Virtual Experience Conclusion • IBM MQ provides lots of options to authenticate and choose the identity for authorization. • A good starting point would be to ask the following: How will the connection be authenticated? How will I get to an identity for authorization? What authorities will I give the identity?
- 36. TechCon 2022 36 Virtual Experience Queue manager Sending app Queue manager Receiving app Message Protection AMS encryption Message Verification AMS integrity MQIPT Centralised Error logs JSON AMQERR logs Centralised Event messages Command/Change events Not Authorized events etc Centralised Application activity trace Monitoring/Auditing Application authentication Connection Authentication Mutual TLS Chanel Authentication Records Security Exits Queue manager authentication Mutual TLS Chanel Authentication Records Security Exits Queue manager authorisation identity Channel authentication records PUT Authority Channel MCAUSER Security exit Authentication/Authorisation DMZ MQIPT Uses Channel concentrator Single point of access HTTP tunnelling TLS tunnel Hide internal IPs Application authorisation identity Connection Authentication Chanel Authentication Records Channel MCAUSER Security Exits
- 37. TechCon 2022 37 Virtual Experience Let us know! Are there Auth security systems you wish IBM MQ integrated with? Let us know! • Raise an AhA Idea! • Contact me directly
- 39. TechCon 2022 72 live virtual sessions in 6 tracks • Application Integration • AIOps & IT Automation • Cloud Native Dev & App Mod • Messaging & Connectivity • API Management • Observability & DevOps Top 3 Reasons To Attend: • In depth, interactive technical sessions • Access to the top IBM Architects and Engineers • Insights from a Tech Industry legend, Steve Wozniak, each day Audience: • Architects • Developers • Practitioners • LOB leaders Targets: • 2500 registrations • 1200 attendees open here
Editor's Notes
- #37: Useful links MQIPT: https://www.ibm.com/docs/en/ibm-mq/9.2?topic=overview-mq-internet-pass-thru AMS: https://www.ibm.com/docs/en/ibm-mq/9.2?topic=securing-advanced-message-security Application activity trace: https://www.ibm.com/docs/en/ibm-mq/9.2?topic=trace-application-activity-message-reference PUT Authority: https://www.ibm.com/docs/en/ibm-mq/9.2?topic=order-put-authority-putaut Channel Authentication Records: https://www.ibm.com/docs/en/ibm-mq/9.2?topic=mechanisms-channel-authentication-records Connection Authentication: https://www.ibm.com/docs/en/ibm-mq/9.2?topic=mechanisms-connection-authentication Security Exits: https://www.ibm.com/docs/en/ibm-mq/9.2?topic=programs-security-exit-overview JSON error logs: https://www.ibm.com/docs/en/ibm-mq/9.2?topic=information-diagnostic-message-logging Event Monitoring: https://www.ibm.com/docs/en/ibm-mq/9.0?topic=network-event-monitoring