ASG
IBM
Zystems
Cressida
Icon
Netflexity
 
  MQSeries.net
Search  Search       Tech Exchange      Education      Certifications      Library      Info Center      SupportPacs      LinkedIn  Search  Search                                                                   FAQ  FAQ   Usergroups  Usergroups
 
Register  ::  Log in Log in to check your private messages
 
RSS Feed - WebSphere MQ Support RSS Feed - Message Broker Support

MQSeries.net Forum Index » IBM MQ Security » SET AUTHREC versus setmqaut

Post new topic  Reply to topic Goto page Previous  1, 2, 3  Next
 SET AUTHREC versus setmqaut « View previous topic :: View next topic » 
Author Message
Michael Dag
PostPosted: Wed Oct 30, 2013 9:02 am    Post subject: Reply with quote

Jedi Knight

Joined: 13 Jun 2002
Posts: 2607
Location: The Netherlands (Amsterdam)

PeterPotkay wrote:
The PMR concluded that dmpmqcfg is working as designed and that I should open an RFE.


PeterPotkay wrote:
Here is the link to vote for the RFE to update dmpmqcfg to capture authority records for profiles for names of queues that don't exist yet.
http://www.ibm.com/developerworks/rfe/execute?use_case=viewRfe&CR_ID=41015


We’ll have to run MS03 and dmpmqcfg in parallel for now. The dmpmqcfg command will capture the MQ 7.1/7.5 specific things like CHLAUTH records that MS03 does not. MS03 will insure we get all authority records.

That's not very pretty...
_________________
Michael



MQSystems Facebook page
Back to top
View user's profile Send private message Visit poster's website MSN Messenger
rammer
PostPosted: Wed Oct 30, 2013 9:09 am    Post subject: Reply with quote

Partisan

Joined: 02 May 2002
Posts: 359
Location: England

Hi what version of 7.5 are you using?

I raised a similar problem around 4 months ago and IBM were able to replicate the issue. They mentioned ot me that this will be fixedin a later Support Pac, possibly 7.5.3 (I thinlk) I'll have a dig around my PMR's tomorrow to see if it is similar
Back to top
View user's profile Send private message
exerk
PostPosted: Wed Oct 30, 2013 9:14 am    Post subject: Reply with quote

Jedi Council

Joined: 02 Nov 2006
Posts: 6339

Michael Dag wrote:
PeterPotkay wrote:
The PMR concluded that dmpmqcfg is working as designed and that I should open an RFE.


PeterPotkay wrote:
Here is the link to vote for the RFE to update dmpmqcfg to capture authority records for profiles for names of queues that don't exist yet.
http://www.ibm.com/developerworks/rfe/execute?use_case=viewRfe&CR_ID=41015


We’ll have to run MS03 and dmpmqcfg in parallel for now. The dmpmqcfg command will capture the MQ 7.1/7.5 specific things like CHLAUTH records that MS03 does not. MS03 will insure we get all authority records.

That's not very pretty...

And, of course, as MS03 isn't fully WMQ V7.5 'aware' you can't guarantee that it will also output everything either...

...I voted for the RFE by the way becuase as far as I'm concerned, if IBM are going to build in MS03 functionality natively, it should work exactly as MS03 does (up to WMQ V7.1?).
_________________
It's puzzling, I don't think I've ever seen anything quite like this before...and it's hard to soar like an eagle when you're surrounded by turkeys.
Back to top
View user's profile Send private message
PeterPotkay
PostPosted: Wed Oct 30, 2013 11:05 am    Post subject: Reply with quote

Poobah

Joined: 15 May 2001
Posts: 7722

rammer wrote:
Hi what version of 7.5 are you using?

I raised a similar problem around 4 months ago and IBM were able to replicate the issue. They mentioned ot me that this will be fixedin a later Support Pac, possibly 7.5.3 (I thinlk) I'll have a dig around my PMR's tomorrow to see if it is similar


MQ 7.5.0.2 on Red Hat Linux x86-64.
_________________
Peter Potkay
Keep Calm and MQ On
Back to top
View user's profile Send private message
Michael Dag
PostPosted: Thu Oct 31, 2013 2:13 am    Post subject: Reply with quote

Jedi Knight

Joined: 13 Jun 2002
Posts: 2607
Location: The Netherlands (Amsterdam)

Peter,
I am still a little bit baffled by the fact that was stated that: dmpmqcfg (which IMHO stands for dump mq config) works as designed
when it clearly does not dump the entire mq config.
Unless AUTHREC’s are not seen as config information, but as rules…
but then NONE of the rule information should be in dmpmqcfg but in ‘dmpmqrul’ …
_________________
Michael



MQSystems Facebook page
Back to top
View user's profile Send private message Visit poster's website MSN Messenger
jcv
PostPosted: Tue Dec 17, 2013 10:11 am    Post subject: Reply with quote

Chevalier

Joined: 07 May 2007
Posts: 411
Location: Zagreb

I noticed this on 7.5.0.1:
Code:

$ amqoamd -s -m QM1|grep rqmname
$ setmqaut -m QM1 -n QM2 -t rqmname -g staff +put
The setmqaut command completed successfully.
$ amqoamd -s -m QM1|grep rqmname
setmqaut -m QM1 -n QM2 -t rqmname -g staff +None
setmqaut -m QM1 -n QM2 -t rqmname -g mqm +crt
$ echo "dis authrec profile(QM2)" |runmqsc QM1
5724-H72 (C) Copyright IBM Corp. 1994, 2011.  ALL RIGHTS RESERVED.
Starting MQSC for queue manager QM1.


     1 : dis authrec profile(QM2)
AMQ8864: Display authority record details.
   PROFILE(QM2)                            ENTITY(staff)
   ENTTYPE(GROUP)                          OBJTYPE(RQMNAME)
   AUTHLIST(PUT)
One MQSC command read.
No commands have a syntax error.
All valid MQSC commands were processed.
$ setmqaut -m QM1 -n QM2 -t rqmname -g staff +all
The setmqaut command completed successfully.
$ amqoamd -s -m QM1|grep rqmname
setmqaut -m QM1 -n QM2 -t rqmname -g staff +chg +dlt +dsp
setmqaut -m QM1 -n QM2 -t rqmname -g mqm +crt
$ echo "dis authrec profile(QM2)" |runmqsc QM1
5724-H72 (C) Copyright IBM Corp. 1994, 2011.  ALL RIGHTS RESERVED.
Starting MQSC for queue manager QM1.


     1 : dis authrec profile(QM2)
AMQ8864: Display authority record details.
   PROFILE(QM2)                            ENTITY(staff)
   ENTTYPE(GROUP)                          OBJTYPE(RQMNAME)
   AUTHLIST(PUT,PASSALL,PASSID,SETALL,SETID)
One MQSC command read.
No commands have a syntax error.
All valid MQSC commands were processed.
$
$ setmqaut -m QM1 -n QM2 -t rqmname -g staff -all
The setmqaut command completed successfully.
$ amqoamd -s -m QM1|grep rqmname
$ echo "dis authrec profile(QM2)" |runmqsc QM1
5724-H72 (C) Copyright IBM Corp. 1994, 2011.  ALL RIGHTS RESERVED.
Starting MQSC for queue manager QM1.


     1 : dis authrec profile(QM2)
AMQ8864: Display authority record details.
   PROFILE(QM2)                            ENTITY(staff)
   ENTTYPE(GROUP)                          OBJTYPE(RQMNAME)
   AUTHLIST(NONE)
One MQSC command read.
No commands have a syntax error.
All valid MQSC commands were processed.


Probably doesn't happen on 7.5.0.2.
Back to top
View user's profile Send private message Visit poster's website
bruce2359
PostPosted: Tue Dec 17, 2013 11:47 am    Post subject: Reply with quote

Poobah

Joined: 05 Jan 2008
Posts: 9471
Location: US: west coast, almost. Otherwise, enroute.

I feel your pain. I already complained (whined, perhaps) on naming AUTHRECs records. Records? Really?
_________________
I like deadlines. I like to wave as they pass by.
ב''ה
Lex Orandi, Lex Credendi, Lex Vivendi. As we Worship, So we Believe, So we Live.
Back to top
View user's profile Send private message
jcv
PostPosted: Wed Dec 18, 2013 2:14 am    Post subject: Reply with quote

Chevalier

Joined: 07 May 2007
Posts: 411
Location: Zagreb

There is more:
Code:

$ echo "dis authrec profile(QM2)" |runmqsc QM1
5724-H72 (C) Copyright IBM Corp. 1994, 2011.  ALL RIGHTS RESERVED.
Starting MQSC for queue manager QM1.


     1 : dis authrec profile(QM2)
AMQ8864: Display authority record details.
   PROFILE(QM2)                            ENTITY(staff)
   ENTTYPE(GROUP)                          OBJTYPE(RQMNAME)
   AUTHLIST(PUT)
One MQSC command read.
No commands have a syntax error.
All valid MQSC commands were processed.
$ dmpmqcfg -m QM1|grep QM2
$
Back to top
View user's profile Send private message Visit poster's website
jcv
PostPosted: Wed Dec 18, 2013 7:51 am    Post subject: Reply with quote

Chevalier

Joined: 07 May 2007
Posts: 411
Location: Zagreb

Info center gives for dmpmqcfg 2 different lists of possible values for the object type on the same page, while dmpmqcfg -? gives the third (all, authinfo, channel, clntconn, comminfo, listener, namelist, process, queue, qmgr, service, topic). None of them contains rqmname.
Back to top
View user's profile Send private message Visit poster's website
PeterPotkay
PostPosted: Wed Dec 18, 2013 1:23 pm    Post subject: Reply with quote

Poobah

Joined: 15 May 2001
Posts: 7722

I wonder if you opened a PMR if they would tell you its working the way the documentation is written, so working as designed.
_________________
Peter Potkay
Keep Calm and MQ On
Back to top
View user's profile Send private message
jcv
PostPosted: Thu Dec 19, 2013 2:33 am    Post subject: Reply with quote

Chevalier

Joined: 07 May 2007
Posts: 411
Location: Zagreb

Exactly my thought. It's definitely working the way the documentation is written - beyond comprehension.
Actually, I didn't open PMR because I don't know what personal benefits are there for me, if it turns out to be useful for the product. Are there some reward standards written somewhere, or is it all between me and local IBM representatives? Besides that, I'm not sure when I log into their portal, and search the PMR database, are these only my company records, or can I reach all records, to see if the subject is already reported. I don't want them to tell me that I waste their precious time and effort. I know I could ask them the same thing (I could open a PMR to ask that) but, you know, I don't feel like it. And by the way, with respect to that RFE about an alternative OAM for unix, before I posted the question in my discussion RFE portal was down for maintenance for a couple of days, so I couldn't search it although I tried.
Back to top
View user's profile Send private message Visit poster's website
Michael Dag
PostPosted: Thu Dec 19, 2013 2:53 am    Post subject: Reply with quote

Jedi Knight

Joined: 13 Jun 2002
Posts: 2607
Location: The Netherlands (Amsterdam)

maybe I am missing some sarcasm in your comments...,
but to me it seems the dmpmqcfg command does not save ALL definitions (object or rules ) right now, so how do you deal with it?
_________________
Michael



MQSystems Facebook page
Back to top
View user's profile Send private message Visit poster's website MSN Messenger
mqjeff
PostPosted: Thu Dec 19, 2013 3:39 am    Post subject: Reply with quote

Grand Master

Joined: 25 Jun 2008
Posts: 17447

some brief definitions:
PMR - Problem Management Record
APAR - Authorized Program Analysis Report
iFix - Interim Fix

PMRs contain the contents of a conversation between IBM and a specific, individual customer about a specific issue or question that a customer has for a specific product on specific hardware and software. PMRs almost always contain customer confidential data, so you can only ever see PMRs that belong to those customer numbers you have been specifically given access to. (If you do not work for IBM).

PMRs that demonstrate defects lead to the creation of APARs. APARs are not customer specific, and describe the symptoms and any workarounds to a defect.

APARs then lead to the creation of iFixs, which are code fixes that are built and packaged at specific version and platform levels - so IIB v9.0.0.0 on win64 or etc.

iFixes are accumulated into FixPacks, which are released on a periodic basis.

http://www14.software.ibm.com/webapp/set2/sas/f/handbook/getsupport.html
Back to top
View user's profile Send private message
jcv
PostPosted: Thu Dec 19, 2013 3:56 am    Post subject: Reply with quote

Chevalier

Joined: 07 May 2007
Posts: 411
Location: Zagreb

Thanks for the correction, that's what I meant to say, but I wasn't that pedantic in choosing the proper terms. I should check the APAR and iFix database before I submit the PMR, and that's tiresome also, so I certainly won't do that this time, only to find out that it works as documented.
Back to top
View user's profile Send private message Visit poster's website
mqjeff
PostPosted: Thu Dec 19, 2013 4:07 am    Post subject: Reply with quote

Grand Master

Joined: 25 Jun 2008
Posts: 17447

I wasn't trying to be pedantic, I was trying to make sure it was clear to all and sundry passers-by.

Well, maybe that is being pedantic.

I would strongly hope that if a runmqsc DISPLAY command (or a PCF INQUIRE command) produced output for a field that was not produced in the output of dmpmqcfg, then the support team would accept the fact that it is a defect in dmpmqcfg, and that any documentation failures on the part of dmpmqcfg are in fact Documentation APARs as well.
Back to top
View user's profile Send private message
Display posts from previous:   
Post new topic  Reply to topic Goto page Previous  1, 2, 3  Next Page 2 of 3

MQSeries.net Forum Index » IBM MQ Security » SET AUTHREC versus setmqaut
Jump to:  



You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
Protected by Anti-Spam ACP
 
 


Theme by Dustin Baccetti
Powered by phpBB © 2001, 2002 phpBB Group

Copyright © MQSeries.net. All rights reserved.