使用 Object Authority Manager 来增强 WebSphere MQ JMS 安全性

public Connection ConnectionFactory.createConnection(String username, String password);

// hard-code a single allowed userId and password
const char USER_ID[] = "testuser";
const char PASSWORD[] = "secret";
/****************************************************************************/
/* Simple implementation of MQZ_AUTHENTICATE_USER. This retrieves a userId
/* and password from the supplied MQCSP structure, and compares them with
/* values defined above. If they match then it returns MQCC_OK and MQRC_NONE,
/* while if they differ it returns MQCC_FAILED with MQRC_NOT_AUTHORIZED.
/****************************************************************************/
static void MQENTRY EXAMPLE_AUTHENTICATE_USER(MQCHAR48 QMgrName, PMQCSP pSecurityParms,
            PMQZAC pApplicationContext, PMQZIC pIdentityContext,
            PMQPTR pCorrelationPtr, PMQBYTE pComponentData,
            PMQLONG pContinuation, PMQLONG pCompCode, PMQLONG pReason) {
    // if authType set to MQCSP_AUTH_USER_ID_AND_PWD then we need to check the userId and password
    if (pSecurityParms -> AuthenticationType == MQCSP_AUTH_USER_ID_AND_PWD) {
        // pointer to the UserId, and user Id length
        MQPTR    pUserId        = pSecurityParms->CSPUserIdPtr;
        MQLONG   userIdLength   = pSecurityParms->CSPUserIdLength;
        // pointer to the Password, and password length
        MQPTR    pPassword      = pSecurityParms->CSPPasswordPtr;
        MQLONG   passwordLength = pSecurityParms->CSPPasswordLength;
        // do not continue with next service component
        *pContinuation = MQZCI_STOP;
        // check for null pointers to the userId and password
        if (pUserId && pPassword) {
            // check the username and password
            if (strncmp((char*)pUserId, USER_ID, userIdLength) ||
                strncmp((char*)pPassword, PASSWORD, passwordLength)) {
                // strncmp returned a non-zero value, so they don't match
                *pCompCode = MQCC_FAILED;
                *pReason = MQRC_NOT_AUTHORIZED;
            }
            else {
                // identical, return MQCC_OK
                *pCompCode     = MQCC_OK;
                *pReason       = MQRC_NONE;
            }
        }
        else {
            // either pUserId or pPassword is null and can't be checked, so return MQCC_FAILED
            *pCompCode = MQCC_FAILED;
            *pReason = MQRC_NOT_AUTHORIZED;
	    }
    }
    else {
        // authType is set to MQCSP_AUTH_NONE so no checking to do, return MQCC_OK and MQRC_NONE
        *pCompCode     = MQCC_OK;
        *pReason       = MQRC_NONE;
    }
}

static void MQENTRY EXAMPLE_FREE_USER(MQCHAR48 QMgrName, PMQZFP pFreeParms, 
            PMQBYTE pComponentData, PMQLONG pContinuation, PMQLONG pCompCode, PMQLONG pReason) {
    // finally, simply return MQCC_OK
    *pCompCode     = MQCC_OK;
    *pReason       = MQRC_NONE;
}

void MQENTRY MQStart(MQHCONFIG hc, MQLONG Options, MQCHAR48 QMgrName, MQLONG ComponentDataLength,
            PMQBYTE pComponentData, PMQLONG pVersion, PMQLONG pCompCode, PMQLONG pReason) {
    // return values
    *pCompCode  = MQCC_OK;
    *pReason    = MQRC_NONE;
    *pVersion   = MQZAS_VERSION_5;
    // Initialise the entry points that we have defined; EXAMPLE_AUTHENTICATE_USER first
    MQZEP(hc,MQZID_AUTHENTICATE_USER,(PMQFUNC)EXAMPLE_AUTHENTICATE_USER,pCompCode,pReason);
    // if that succeeded (i.e. pCompCode isn't MQCC_FAILED), initialize EXAMPLE_FREE_USER
    if (*pCompCode == MQCC_OK) {
	    MQZEP(hc,MQZID_FREE_USER,(PMQFUNC)EXAMPLE_FREE_USER,pCompCode,pReason);
    }
    // if one of these failed, set the reason to MQRC_INITIALIZATION_FAILED
    if (*pCompCode != MQCC_OK) {
        *pReason   = MQRC_INITIALIZATION_FAILED;
    }
}

C:\Program Files\Microsoft Visual Studio .NET 2003\Vc7\bin\vcvars32.bat

cl /MD /W3 /Zp4 /D "WIN32" /D "_WINDOWS" /c /I "C:\IBM\WebSphere MQ\Tools\c\include" 
example.c link /subsystem:windows /dll "C:\Program Files\IBM\WebSphere MQ\Tools\lib\mqm.lib"
"C:\Program Files\IBM\WebSphere MQ\Tools\lib\mqmzf.lib" example.obj /export:MQStart

gcc -e MQStart -shared -I/opt/mqm/lib -L/usr/lib -lc -lnsl -ldl -lmqmzf_r
  -o /var/mqm/exits/example example.c

xlc_r -q64 -e MQStart -bM:SRE  -I/usr/mqm/inc -L/usr/mqm/lib64 -lmqmzf_r
  -o /var/mqm/exits/example example.c

ServiceComponent:
    Name=example.auth.service
    Module=/var/mqm/exits/example
    Service=AuthorizationService
    ComponentDataSize=0

import javax.jms.*;
public class BindingsExample {
ConnectionFactory cf = null;
Connection conn = null;
    public static void main(String[] args) {
        try {
            //configure JNDI context
            Context ctx = new InitialDirConext(...);
            // get a pre-defined connection factory from JNDI
            cf = (ConnectionFactory)ctx.lookup("ExampleCF");
            // connect
            conn = cf.createConnection("myUser","myPassword");
        }
        catch (Exception e) {
            //process JMSException/NamingException etc.
        }
    }
}

javax.jms.JMSSecurityException: MQJMS2013: 
invalid security authentication supplied for MQQueueManager

conn = cf.createConnection("testuser","secret");

package example;
public class SecurityExit implements com.ibm.mq.MQSecurityExit {
    public byte[] securityExit(MQChannelExit channelExitParms,
                               MQChannelDefinition channelDefParms,
                               byte[] agentBuffer) {
        switch (channelExitParms.exitReason) {
        case MQC.MQXR_INIT:
            // initialize etc.
            break;
        case MQC.MQXR_INIT_SEC:
            // transmit MCAUserId if desired etc.
            break;
        case MQC.MQXR_SEC_PARMS:
            // create a new MQCSP object
            MQConnectionSecurityParameters csp = new MQConnectionSecurityParameters();
            // set authenticationType to AUTH_USER_ID_AND_PWD
            csp.setAuthenticationType(MQC.MQCSP_AUTH_USER_ID_AND_PWD);
            // set CSP UserId and password from the JMS-supplied values
            csp.setCSPUserId(channelDefParms.remoteUserId.trim());
            csp.setCSPPassword(channelDefParms.remotePassword.trim());
            // finally add MQCSP object to the channelExitParms
            channelExitParms.setMQCSP(csp);
            break;
         case MQC.MQXR_TERM:
            // etc.
        }
        return agentBuffer;
    }
}

alter channel(channel name) chltype(svrconn) mcauser(UserId)

ALTER CF(CFname) SECEXIT("example.SecurityExit")

ConnectionFactory cf = new MQConnectionFactory();
cf.setSecurityExit("example.SecurityExit");