title: WebSphere MQ Channel Access Security Questions
body: <p>Consider the following queue defintinons:</p>
  <blockquote>
  <p>SET AUTHREC OBJTYPE(QMGR) GROUP('mq-user') AUTHADD(INQ,DSP,CONNECT)</p>
  <p>SET AUTHREC PROFILE(SYSTEM.MQEXPLORER.REPLY.MODEL) OBJTYPE(QUEUE) GROUP('mq-user') AUTHADD(INQ,DSP,GET)</p>
  <p>SET AUTHREC PROFILE(SYSTEM.ADMIN.COMMAND.QUEUE) OBJTYPE(QUEUE) GROUP('mq-user') AUTHADD(INQ,DSP,PUT)</p>
  <p>DEFINE CHANNEL ($cname) CHLTYPE (SVRCONN) TRPTYPE (TCP) MCAUSER('tcs-mq-user') REPLACE</p>
  <p>SET CHLAUTH($cname) TYPE(ADDRESSMAP) ADDRESS(*) MCAUSER('tcs-mq-user')</p>
  </blockquote>
  <ol>
  <li>What is the meaning of MCAUSER in both DEFINE CHANNEL and SETCHLAUTH?</li>
  <li>Should tcs-mq-user belong to mq-user group?</li>
  <li>Does this mean only tcs-mq-user has access to the queue manager in bindings mode? Now what if I want to give access to another user in the binding mode, should I create another pair of DEFINE CHANNEL and SET CHLAUTH commands for this user?</li>
  <li>Is it possible to give the channel access to the mcs-user group?</li>
  </ol>