| Author |
Message
|
| sridhsri |
 Posted: Tue Apr 21, 2009 7:54 am Post subject: Listing MQ AUTS |
 |
|
Master
Joined: 19 Jun 2008
Posts: 297
|
I want to know if there is a way to list all the permissions of all users and of all objects in a queue manager.
The problem with dspmqaut is that it expects -p (user) or -g (group). I wanted this to work for all users and groups.
dmpmqaut and amqoamd also don't seem to give me the list of all users.
I even tried saveqmgr with the -z option. That also didn't seem to work. The OS has a huge number of users. I don't want to take the trouble of running the command against every one of them. |
|
| Back to top |
|
 |
| Sam Uppu |
| Posted: Tue Apr 21, 2009 7:58 am Post subject: Re: Listing MQ AUTS |
|
|
Yatiri
Joined: 11 Nov 2008
Posts: 610
|
| sridhsri wrote: |
I want to know if there is a way to list all the permissions of all users and of all objects in a queue manager.
The problem with dspmqaut is that it expects -p (user) or -g (group). I wanted this to work for all users and groups.
dmpmqaut and amqoamd also don't seem to give me the list of all users.
I even tried saveqmgr with the -z option. That also didn't seem to work. The OS has a huge number of users. I don't want to take the trouble of running the command against every one of them. |
Not sure why do you want to do that. dmpmqaut should show all the groups & users which have permissions to MQ objects.
Why do you want to check all the users on the entire server?
Thanks. |
|
| Back to top |
|
|
| sridhsri |
| Posted: Tue Apr 21, 2009 8:00 am Post subject: |
|
|
Master
Joined: 19 Jun 2008
Posts: 297
|
| dmpmqaut did not show me permissions of all users and groups. I only want to see the list of all users and groups that have some sort of access to the queue manager objects. |
|
| Back to top |
|
|
| bruce2359 |
| Posted: Tue Apr 21, 2009 8:02 am Post subject: |
|
|
Poobah
Joined: 05 Jan 2008
Posts: 9470
Location: US: west coast, almost. Otherwise, enroute.
|
| Quote: |
| if there is a way to list |
Do you literally mean you intend to print all that stuff on paper? Not very green or practical.
Is there an auditor lurking behind you somewhere? This is the kind of thing an auditor would request.
_________________
I like deadlines. I like to wave as they pass by.
ב''ה
Lex Orandi, Lex Credendi, Lex Vivendi. As we Worship, So we Believe, So we Live. |
|
| Back to top |
|
|
| harish_td |
| Posted: Tue Apr 21, 2009 8:42 am Post subject: |
|
|
Master
Joined: 13 Feb 2006
Posts: 236
|
Can you share what happened when you did this?
amqoamd -m <QUEUE_MGR_NAME> -s > OAM_DUMP_QUEUE_MANAGER.txt |
|
| Back to top |
|
|
| sridhsri |
| Posted: Tue Apr 21, 2009 8:48 am Post subject: |
|
|
Master
Joined: 19 Jun 2008
Posts: 297
|
| Quote: |
| dmpmqaut and amqoamd also don't seem to give me the list of all users. |
Let me be more clear then. amqoamd DIDN'T give me what I wanted. |
|
| Back to top |
|
|
| Michael Dag |
| Posted: Tue Apr 21, 2009 9:24 am Post subject: |
|
|
Jedi Knight
Joined: 13 Jun 2002
Posts: 2607
Location: The Netherlands (Amsterdam)
|
|
| Back to top |
|
|
| sridhsri |
| Posted: Tue Apr 21, 2009 9:26 am Post subject: |
|
|
Master
Joined: 19 Jun 2008
Posts: 297
|
| I checked with my colleague. The commands do not show users in the mqm group and therefore it didn't work. |
|
| Back to top |
|
|
| WMBDEV1 |
| Posted: Tue Apr 21, 2009 9:30 am Post subject: |
|
|
Sentinel
Joined: 05 Mar 2009
Posts: 888
Location: UK
|
| sridhsri wrote: |
| I checked with my colleague. The commands do not show users in the mqm group and therefore it didn't work. |
Cant you check the user repository to see who is in the group? |
|
| Back to top |
|
|
| fjb_saper |
| Posted: Tue Apr 21, 2009 12:57 pm Post subject: |
|
|
Grand High Poobah
Joined: 18 Nov 2003
Posts: 20756
Location: LI,NY
|
| WMBDEV1 wrote: |
| sridhsri wrote: |
| I checked with my colleague. The commands do not show users in the mqm group and therefore it didn't work. |
Cant you check the user repository to see who is in the group? |
It so did work. Users in the mqm group have no individual need for authorization. Did the dump show you authorizations for the mqm group?
You need then to go to OS level to enquire about the group membership. 
_________________
MQ & Broker admin |
|
| Back to top |
|
|
| bruce2359 |
| Posted: Tue Apr 21, 2009 2:55 pm Post subject: |
|
|
Poobah
Joined: 05 Jan 2008
Posts: 9470
Location: US: west coast, almost. Otherwise, enroute.
|
By definition, members of the MQM group have all priviledges.
_________________
I like deadlines. I like to wave as they pass by.
ב''ה
Lex Orandi, Lex Credendi, Lex Vivendi. As we Worship, So we Believe, So we Live. |
|
| Back to top |
|
|
| sridhsri |
| Posted: Tue Apr 21, 2009 4:13 pm Post subject: |
|
|
Master
Joined: 19 Jun 2008
Posts: 297
|
| I know users in the mqm group do have all the permissions. But I was expecting the command the show that to me. I didn't want to have to open /etc/groups to see who is part of the mqm group. |
|
| Back to top |
|
|
| gbaddeley |
| Posted: Tue Apr 21, 2009 7:06 pm Post subject: |
|
|
Jedi Knight
Joined: 25 Mar 2003
Posts: 2538
Location: Melbourne, Australia
|
| sridhsri wrote: |
| I know users in the mqm group do have all the permissions. But I was expecting the command the show that to me. I didn't want to have to open /etc/groups to see who is part of the mqm group. |
MQ profiles in OAM don't give authority based on user names, they are all based on group names. The only way to cross reference the group names listed by amqoamd to user names is to look at users that have secondary group members (in /etc/group) and primary group membership (look for the group's gid in /etc/passwd). Sorry if that makes life hard for you.
_________________
Glenn |
|
| Back to top |
|
|
|
|
