WebSphere MQ Java 类中的 MQSecurityExit 是什么？
我试图找到一些关于什么是 MQSecurityExit 以及我们如何在 Java 中实际实现它的文档。我对此知之甚少 - 就像我相信它是用于向 MQ 提供者验证 MQ 客户端一样。但不知道这如何适合 WebSphere MQ 的整体安全架构。
I am trying to find some documentation on what is MQSecurityExit and how do we actually implement it in Java. I just have a very little idea on this - like I believe it's for authenticating MQ client to MQ provider. But don't know how this fits in overall security architecture of WebSphere MQ.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
出口是供应商代码中调用用户或第 3 方代码来执行自定义功能的点。 WebSphere MQ 在服务器和客户端都提供安全出口点。安全出口的常见用途是，在对连接进行身份验证后，出口将通道中的 MCAUSER 字段设置为在身份验证中解析的用户 ID。授权是根据该值执行的。
独立的服务器端出口可以根据连接请求中传递的数据对连接进行身份验证。服务器端出口最常用的项目是 SSL 证书详细信息、从客户端传递的用户凭据以及 IP 连接信息。
客户端/服务器出口对可以执行任意复杂的身份验证。例如，客户端出口可以提示用户输入 ID 和密码，对其进行加密，然后转发到服务器端出口进行验证。 Windows 版本的 WMQ 提供了一个 SSPI 出口对，它使用 Kerberos 令牌进行身份验证。
服务器端出口必须用 C 语言编写。在 WebSphere MQ v6.0 和之前版本中，您也需要用 C 语言编写通道出口。从 v7 开始，可以使用 Java 编写通道出口，如文档 此处。请注意，客户端通道出口在与服务器端出口配对时最有用。例如，如果没有服务器端出口来处理身份验证凭据，那么客户端通道出口提供身份验证凭据不会有太大好处。
有关退出的更多信息，请参阅 内部通讯手册。
一个众所周知的服务器端退出示例是 BlockIP2。
An exit is a point in the vendor code that calls out to user or 3rd party code to perform custom functions. WebSphere MQ provides security exit points at both the server and at the client. A common use for a security exit is that after authenticating the connection, the exit sets the MCAUSER field in the channel to the user ID that was resolved in the authentication. Authorization is performed against this value.
A stand-alone server-side exit can authenticate connections based on data passed in the connection request. The most common items used by a server-side exit are SSL certificate details, user credentials passed from the client and IP connection information.
A client/server exit pair can do any arbitrarily complex authentication. For example, the client-side exit can prompt the user for ID and password, encrypt these and then forward to the server-side exit for validation. There is an SSPI exit pair supplied with the Windows version of WMQ that authenticates using Kerberos tokens.
Server-side exits must be written in C. In v6.0 and prior versions of WebSphere MQ you were required to write channel exits in C as well. As of v7 it is possible to write channel exits in Java as described in the documentation here. Note that client channel exits are most useful when paired with a server-side exit. For example, it would not do much good for a client channel exit to supply authentication credentials if there is no server-side exit to do something with them.
Additional information on exits is available in the Intercommunications manual.
A well known example of a server-side exit is BlockIP2.