| |
|
RSS Feed - WebSphere MQ Support
|
RSS Feed - Message Broker Support
|
  |
|
| What rights does MQ need on Win 2000? |
« View previous topic :: View next topic » |
| Author |
Message
|
| scott9 |
 Posted: Thu Nov 20, 2003 2:59 pm Post subject: What rights does MQ need on Win 2000? |
 |
|
Acolyte
Joined: 11 Jul 2002
Posts: 62
Location: Sacramento,CA
|
Documentation states "...the [MQ] local account must be able to query information about the user..."
My question: Must MQ query information about ALL users in the domain or just the user that is attempting to access MQ resources. For instance, can we limit the names of the groups that the MQ account can query? |
|
| Back to top |
|
 |
| JasonE |
| Posted: Fri Nov 21, 2003 1:54 am Post subject: |
|
|
Grand Master
Joined: 03 Nov 2003
Posts: 1220
Location: Hursley
|
Depends on what security you mean, but the main deal is that the userid MQ runs under must be able to query the group memberships of the userids which are accessing MQ. To do this on an NT4 domain or a migrated NT4->AD domain is fine, but on a pure W2K+ active directory domain, the ability of querying group membership of a domain user by another domain user is a restricted user right - Thats why you have to run MQ under a domain userid, and give that userid delegate authority.
Giving that userid the delegate authority applies to all userids, I dont believe you can restrict it to a special few. |
|
| Back to top |
|
|
| scott9 |
| Posted: Fri Nov 21, 2003 9:54 am Post subject: |
|
|
Acolyte
Joined: 11 Jul 2002
Posts: 62
Location: Sacramento,CA
|
| Our security people stated that they can limit the users and groups that the MQ service account can query within Active Directory. They don't want to give the account carte blanche query access. We're going to test the scaled-down permission and I'll post the results here. Thanks! -chim |
|
| Back to top |
|
|
| scott9 |
| Posted: Wed Dec 10, 2003 4:27 pm Post subject: It's OK to limit query access |
|
|
Acolyte
Joined: 11 Jul 2002
Posts: 62
Location: Sacramento,CA
|
As promised, we tested our theory. We limited the groups that our MQ domain account could query and there were no problems noted. Our user was able to access MQ resources. This makes our security people very happy. I did learn some other related stuff that I'll post here just for fun:
* IBM recommends that you do not remove, disable, or alter the local account that is created by the MQ installation routine (MUSER_MQADMIN). This local account is required, even if you have created and assigned a domain account.
* In order to validate user permissions, MQ will attempt to query group membership using the local account first. If this works, it doesn't even attempt to use the domain account. It will try the domain account only if it fails to query group permission using the local account. It happens this way, regardless of whether you have configured a domain account. |
|
| Back to top |
|
|
| JasonE |
| Posted: Thu Dec 11, 2003 2:16 am Post subject: |
|
|
Grand Master
Joined: 03 Nov 2003
Posts: 1220
Location: Hursley
|
Just to add an FYI to the second part of the above, if you have a GA2 installation CD and are doing silent installs (GA2 - look in the readme and it will talk about a silent install option 'onlydomain').
If you use this onlydomain option, MQ will not create the local ID nor try to use one. Instead we will immediately use the id supplied during the install. Otherwise, it works as described above, ie we create musr_mqadmin and try to use it to query group membership. Only if that fails will we use the domain id even if it was supplied. Note the prepare wizard produces a log (amqmjpse.???) which can help if problems occur in this area.
Jason |
|
| Back to top |
|
|
|
|
|
| |
|
Page 1 of 1 |
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
|
|
|
