| Author |
Message
|
| ECS2008 |
 Posted: Wed Apr 23, 2008 12:57 am Post subject: To PUT or NOT to PUT that is the question. (Permissions?) |
 |
|
Newbie
Joined: 23 Apr 2008
Posts: 9
|
Hi,
I wonder if anyone can advise on when you can put a message on a local queue when the user putting the message has no permissions set up to do so.
I.E. Their Unix group is not MQM but another NEW group. The local queue has no permissions set up for the NEW Group. Yet either via MQE or AMQSPUT they can put the message on the queue.
Any ideas (let me know what other info you need)
Thanks
ECS |
|
| Back to top |
|
 |
| Gaya3 |
| Posted: Wed Apr 23, 2008 12:59 am Post subject: |
|
|
Jedi
Joined: 12 Sep 2006
Posts: 2493
Location: Boston, US
|
set authority for the user to put messages to that particular queue
Regards
Gayathri
_________________
Regards
Gayathri
-----------------------------------------------
Do Something Before you Die |
|
| Back to top |
|
|
| ECS2008 |
| Posted: Wed Apr 23, 2008 1:16 am Post subject: To PUT or NOT to PUT that is the question. (Permissions?) |
|
|
Newbie
Joined: 23 Apr 2008
Posts: 9
|
thanks again Gaya3! 
The issue is that it currently has no permission to put but can STILL Put the message. I am sure there is something else I am missing here?
| Gaya3 wrote: |
set authority for the user to put messages to that particular queue
Regards
Gayathri |
|
|
| Back to top |
|
|
| Vitor |
| Posted: Wed Apr 23, 2008 1:22 am Post subject: Re: To PUT or NOT to PUT that is the question. (Permissions? |
|
|
Grand High Poobah
Joined: 11 Nov 2005
Posts: 26093
Location: Texas, USA
|
| ECS2008 wrote: |
| The issue is that it currently has no permission to put but can STILL Put the message. I am sure there is something else I am missing here? |
Is it inheriting mqm authorities from a client channel?
_________________
Honesty is the best policy.
Insanity is the best defence. |
|
| Back to top |
|
|
| ECS2008 |
| Posted: Wed Apr 23, 2008 1:55 am Post subject: Re: To PUT or NOT to PUT that is the question. (Permissions? |
|
|
Newbie
Joined: 23 Apr 2008
Posts: 9
|
Hi,
that's an interesting thought. Does it MQ do that by nature?
In the meantime I can check this out.
Thanks
| Vitor wrote: |
| ECS2008 wrote: |
| The issue is that it currently has no permission to put but can STILL Put the message. I am sure there is something else I am missing here? |
Is it inheriting mqm authorities from a client channel? |
|
|
| Back to top |
|
|
| Vitor |
| Posted: Wed Apr 23, 2008 2:00 am Post subject: Re: To PUT or NOT to PUT that is the question. (Permissions? |
|
|
Grand High Poobah
Joined: 11 Nov 2005
Posts: 26093
Location: Texas, USA
|
| ECS2008 wrote: |
| Does it MQ do that by nature? |
No, but on a dev system it's not impossible the MQ admin has saved himself some work by configuring it like that.
_________________
Honesty is the best policy.
Insanity is the best defence. |
|
| Back to top |
|
|
| fjb_saper |
| Posted: Wed Apr 23, 2008 3:21 am Post subject: |
|
|
Grand High Poobah
Joined: 18 Nov 2003
Posts: 20756
Location: LI,NY
|
Also check all the groups the user is in. If in Unix you allocate permissions at the user level you in fact allocate the permission to the user's primary group at allocation time...
So if all users are in a dfltuser group you may have set permissions for that group without realizing it...
Enjoy 
_________________
MQ & Broker admin |
|
| Back to top |
|
|
| ECS2008 |
| Posted: Wed Apr 23, 2008 6:49 am Post subject: |
|
|
Newbie
Joined: 23 Apr 2008
Posts: 9
|
| fjb_saper wrote: |
Also check all the groups the user is in. If in Unix you allocate permissions at the user level you in fact allocate the permission to the user's primary group at allocation time...
So if all users are in a dfltuser group you may have set permissions for that group without realizing it...
Enjoy |
Thanks everyone for their input.
Some how the 'users' group on MQ had been set up to allow everything.
My question then is what is the 'users' group on MQ?
Is that a default setting?
Thanks |
|
| Back to top |
|
|
| Vitor |
| Posted: Wed Apr 23, 2008 6:55 am Post subject: |
|
|
Grand High Poobah
Joined: 11 Nov 2005
Posts: 26093
Location: Texas, USA
|
| ECS2008 wrote: |
Some how the 'users' group on MQ had been set up to allow everything.
My question then is what is the 'users' group on MQ?
Is that a default setting?
|
The Security and System Admin documentation will answer all your questions on default and generic profiles, along with options for controlling access.
Happy Reading!  
_________________
Honesty is the best policy.
Insanity is the best defence. |
|
| Back to top |
|
|
| ECS2008 |
| Posted: Wed Apr 23, 2008 7:07 am Post subject: |
|
|
Newbie
Joined: 23 Apr 2008
Posts: 9
|
| Vitor wrote: |
| ECS2008 wrote: |
Some how the 'users' group on MQ had been set up to allow everything.
My question then is what is the 'users' group on MQ?
Is that a default setting?
|
The Security and System Admin documentation will answer all your questions on default and generic profiles, along with options for controlling access.
Happy Reading! |
Thanks. |
|
| Back to top |
|
|
| bruce2359 |
| Posted: Wed Apr 23, 2008 8:49 am Post subject: |
|
|
Poobah
Joined: 05 Jan 2008
Posts: 9470
Location: US: west coast, almost. Otherwise, enroute.
|
| Quote: |
My question then is what is the 'users' group on MQ?
Is that a default setting? |
When you install WMQ, the install process creates the mqm group with ALL authority to everything MQ. You should not add end-users (people that run application programs) to the mqm group.
You should create user groups, like PAYROLL or PROGRAMMER, and grant authority to the objects that application use requires.
_________________
I like deadlines. I like to wave as they pass by.
ב''ה
Lex Orandi, Lex Credendi, Lex Vivendi. As we Worship, So we Believe, So we Live. |
|
| Back to top |
|
|
|
|
