| Author |
Message
|
| abiondo |
 Posted: Thu Oct 22, 2009 7:08 am Post subject: Access to send PCF messages |
 |
|
Novice
Joined: 30 Aug 2007
Posts: 21
Location: Philadelphia, PA
|
What type of access do you need to put PCF messages? We have users that want to enumerate queues on MQ. Is there a lower level access I can provide to allow them to get this information without compromising security?
thanks,
Anthony
_________________
Anthony J Biondo Jr
Manager, Web Services
AmeriHealth Mercy |
|
| Back to top |
|
 |
| Vitor |
| Posted: Thu Oct 22, 2009 7:15 am Post subject: |
|
|
Grand High Poobah
Joined: 11 Nov 2005
Posts: 26093
Location: Texas, USA
|
If you can use one kind of PCF, you can use them all.
A better question is why would end users need to enumerate queues? What's the requirement here?
I'm wondering if there's another way to achieve this without PCF....
_________________
Honesty is the best policy.
Insanity is the best defence. |
|
| Back to top |
|
|
| abiondo |
| Posted: Thu Oct 22, 2009 9:04 am Post subject: |
|
|
Novice
Joined: 30 Aug 2007
Posts: 21
Location: Philadelphia, PA
|
Sorry, I can give more detail. We have a couple developers that created an application they use to troubleshoot some of our applications. One of the parts of the app has a drop down box that is populated with the names of queues from the PCF message.
This way they do not have to key in the queue names. The only thing is that I know PCF messages require an elevated privelage and I am wondering if there is anyway to give them the names of the queues without allowing the elevated privelage.
thanks much,
Anthony
_________________
Anthony J Biondo Jr
Manager, Web Services
AmeriHealth Mercy |
|
| Back to top |
|
|
| Vitor |
| Posted: Thu Oct 22, 2009 9:15 am Post subject: |
|
|
Grand High Poobah
Joined: 11 Nov 2005
Posts: 26093
Location: Texas, USA
|
| abiondo wrote: |
| Sorry, I can give more detail. We have a couple developers that created an application they use to troubleshoot some of our applications. One of the parts of the app has a drop down box that is populated with the names of queues from the PCF message. |
What you're describing is an administrative tool. This requires administrative privledge. Presumably once this app has found the trouble, it needs to do something to fix it and that will require high level access as well.
Unless this thing just looks in queues for problem messages, in which case they've reinvented the wheel. There are a number of tools and support pacs that can do that sort of thing.
| abiondo wrote: |
| This way they do not have to key in the queue names. |
If that's really all they need the access for, unload the queue names and provide them with a config file for the app to use.
_________________
Honesty is the best policy.
Insanity is the best defence. |
|
| Back to top |
|
|
| fjb_saper |
| Posted: Thu Oct 22, 2009 5:06 pm Post subject: |
|
|
Grand High Poobah
Joined: 18 Nov 2003
Posts: 20756
Location: LI,NY
|
Basically you need to have priviledge to post to the command server's input queue and priviledge to use a model queue (open get inq?) to create your replyto queue.
Any other priviledge is optional.
If you retrieve the qnames, I believe the only queue names that will show are the ones they have display priviledges for.... (or disp + inq)
_________________
MQ & Broker admin |
|
| Back to top |
|
|
| bruce2359 |
| Posted: Fri Oct 23, 2009 5:14 am Post subject: |
|
|
Poobah
Joined: 05 Jan 2008
Posts: 9471
Location: US: west coast, almost. Otherwise, enroute.
|
| Quote: |
| Basically you need to have priviledge to post to the command server's input queue and priviledge to use a model queue (open get inq?) to create your replyto queue. |
One additional item: Do NOT grant mqm-like administrative priviledges to the userids that runs this app. Rather, grant display priviledge only to the queues that the app needs to interrogate - take away all other priviledges to those queues, and other objects on the qmgrs where the app has access.
_________________
I like deadlines. I like to wave as they pass by.
ב''ה
Lex Orandi, Lex Credendi, Lex Vivendi. As we Worship, So we Believe, So we Live. |
|
| Back to top |
|
|
| mqjeff |
| Posted: Fri Oct 23, 2009 5:21 am Post subject: |
|
|
Grand Master
Joined: 25 Jun 2008
Posts: 17447
|
| The privileges to send a PCF message is separate from the privileges to execute the command contained therein. |
|
| Back to top |
|
|
| abiondo |
| Posted: Fri Oct 23, 2009 6:46 am Post subject: |
|
|
Novice
Joined: 30 Aug 2007
Posts: 21
Location: Philadelphia, PA
|
Thank you all for taking the time to help me troubleshoot this issue. Ok I think I got it. Let me just recap to make sure I am on the right page.
For using PCF messages a used does not need MQM. I know this, but until you posted this I did not have a direction other than that.
Grant the users that need to leverage PCF messages access to:
- PUT/GET to the SYSTEM.ADMIN.COMMAND.QUEUE
- PUT/GET to the SYSTEM.DEFAULT.MODEL.QUEUE
Grant display -disp on queues that the users should be able to view.
Please let me know if this psudo code is what I should be doing.
thanks much,
Anthony
_________________
Anthony J Biondo Jr
Manager, Web Services
AmeriHealth Mercy |
|
| Back to top |
|
|
| bruce2359 |
| Posted: Fri Oct 23, 2009 7:43 am Post subject: |
|
|
Poobah
Joined: 05 Jan 2008
Posts: 9471
Location: US: west coast, almost. Otherwise, enroute.
|
| Quote: |
| Grant display -disp on queues that the users should be able to view. |
As a general good behavior (behaviour?), I setmqaut -all (take away all auth) for the userid/group, then grant only those priviledges that I want the userid/group to have.
_________________
I like deadlines. I like to wave as they pass by.
ב''ה
Lex Orandi, Lex Credendi, Lex Vivendi. As we Worship, So we Believe, So we Live. |
|
| Back to top |
|
|
|
|
