| Author |
Message
|
| GFORCE |
 Posted: Fri Aug 24, 2007 10:18 am Post subject: Client authorizations |
 |
|
Voyager
Joined: 16 Jun 2003
Posts: 78
Location: WISCONSIN
|
We are trying to connect mqclient from NY to mqserver in midwest. Does his application or api on intel platform require authorization on our aix qmgr?
NY client states that his application does not require it...
_________________
THANKS |
|
| Back to top |
|
 |
| jefflowrey |
| Posted: Fri Aug 24, 2007 10:22 am Post subject: |
|
|
Grand Poobah
Joined: 16 Oct 2002
Posts: 19981
|
Do you want everyone at the NY site to have full and complete access to your entire MQ network?
If not, then you need to secure the channel, or at least put an MCAUser on it.
Please note also that MQ does only provide AUTHORIZATION and does not provide AUTHENTICATION.
_________________
I am *not* the model of the modern major general. |
|
| Back to top |
|
|
| GFORCE |
| Posted: Fri Aug 24, 2007 10:48 am Post subject: Client authorizations |
|
|
Voyager
Joined: 16 Jun 2003
Posts: 78
Location: WISCONSIN
|
So once he sets the mqserver info on his intel box and starts his application he would have full access to mq in our aix box. I would not have to setmqaut on his app?
_________________
THANKS |
|
| Back to top |
|
|
| jefflowrey |
| Posted: Fri Aug 24, 2007 12:25 pm Post subject: |
|
|
Grand Poobah
Joined: 16 Oct 2002
Posts: 19981
|
He wouldn't have full access from a C application.
He would have full access from a Java application.
Anyone who has any access to the channel will have full access from a Java application.
Anyone who has access to ANY MQ channel on the queue manager will have full access from a Java application.
If you set an MCAUser on the channel, anyone who connects to the channel will ONLY have the access that the MCAUser has.
Which you will need to grant, using setmqaut, for the MCAUser.
_________________
I am *not* the model of the modern major general. |
|
| Back to top |
|
|
| fjb_saper |
| Posted: Fri Aug 24, 2007 1:28 pm Post subject: |
|
|
Grand High Poobah
Joined: 18 Nov 2003
Posts: 20756
Location: LI,NY
|
| jefflowrey wrote: |
Which you will need to grant, using setmqaut, for the MCAUser. |
Or more appropriately for the group the MCAUser is a member of.
We usually create a specific MQ purpose group in that case.
It is easier to make new users group members and just refresh security on the qmgr than set up security for a new user...
BTW on Unix platforms the security is set at group level. If you do not specify a group but specify a user on the setmqaut command the system will grant access to the user's primary group...
Enjoy 
_________________
MQ & Broker admin |
|
| Back to top |
|
|
|
|
