MQSeries.net :: View topic - Uknown Group

matt.mccomas · Posted: Thu Jan 03, 2013 5:00 pm Post subject:

WebSphere MQ 7.0.1.7
Host OS: Server 2003

I'm trying to grant a Windows domain group some limited access to a queue manager on my windows MQ server. I have attempted this in MQ Explorer by adding the group in the manage authority records configuration. I have also tried the same commands using the setmqaut:

setmqaut -m QM1 -t qmgr -g <groupname> -all
setmqaut -m QM1 -t qmgr -g <groupname> +dsp +connect +inq

I've noticed the following:
1. I can add any local group without issue.
2. I can switch to the -p option and add any local or domain user with no issue.
3. I can not add any domain group using the -g option. I experimented with various group naming conventions thinking that perhaps my group name was too long, or contained objectionable characters, but it appears to me a domain group will not function in this capacity.

I'm curious if anyone else has ever encountered this behavior. It seems to me that the MQ configuration can query the windows domain for a user, and even a group for a list of users, but it cannot seem to utilize a group for it's own authority records.

The MQ server is configured with a special windows service account configured as described in information center.

I have spent most of the day researching this issue, reading documentation, and have done various google searches on this issue. I haven't come up with a definitive answer yet, so I was hoping someone here might have some feedback, or could perhaps tell me that I've missed something simple.

The overarching goal is to achieve some tighter security at the queue manager and queue level rather than simply using the local MQM group which has full access. I've read alot on OAM and some of the very granular security controls available, as well as the ability to utilize SSL, but for now, we'd like to start with the basics.

If I can't use a domain group, the only option I've been able to come up with is using additional local groups, and nesting domain groups within them, but this is not an attractive option due to administrative overhead.

Thanks in advance for any advice or additional information you may be able to give me. :D