ASG
IBM
Zystems
Cressida
Icon
Netflexity
 
  MQSeries.net
Search  Search       Tech Exchange      Education      Certifications      Library      Info Center      SupportPacs      LinkedIn  Search  Search                                                                   FAQ  FAQ   Usergroups  Usergroups
 
Register  ::  Log in Log in to check your private messages
 
RSS Feed - WebSphere MQ Support RSS Feed - Message Broker Support

MQSeries.net Forum Index » General IBM MQ Support » MQ Security, Authority

Post new topic  Reply to topic
 MQ Security, Authority « View previous topic :: View next topic » 
Author Message
mq4you
PostPosted: Thu Jan 18, 2007 6:22 am    Post subject: MQ Security, Authority Reply with quote

Novice

Joined: 27 Nov 2006
Posts: 11

hello!

i'm trying to understand how setmqaut works. for that i did the following things:

i have a little java app, which puts a sample msg into a queue. within the app i can specify the field user-id of the mqmd header.

on my windows machine i generated a new user called 'test' (this user is only part of the group Users.)

the command dspmqaut tells me that that user has no rights at all concerning the queue 'sample'.

now, i use my little java app, where i specify user-id=test and queue='sample'.

i thought that i would receive an reason code back like 'not authorized'. but i'm able to put the message into that queue?

it's a basic question, what did i misunderstood?
Back to top
View user's profile Send private message
jefflowrey
PostPosted: Thu Jan 18, 2007 6:35 am    Post subject: Reply with quote

Grand Poobah

Joined: 16 Oct 2002
Posts: 19981

Java does not pass a valid user id, by default, when you create a client connection.

This is because Java does not normally have access to things like OS user ids.
_________________
I am *not* the model of the modern major general.
Back to top
View user's profile Send private message
mq4you
PostPosted: Thu Jan 18, 2007 6:51 am    Post subject: Reply with quote

Novice

Joined: 27 Nov 2006
Posts: 11

no, i mean that my java-app uses the mq-api to set all the context and overwrite the field user-id with the name 'test'.

is that not the parameter to check security?
Back to top
View user's profile Send private message
jefflowrey
PostPosted: Thu Jan 18, 2007 7:16 am    Post subject: Reply with quote

Grand Poobah

Joined: 16 Oct 2002
Posts: 19981

WebSphere MQ API for Java, or WebSphere MQ JMS API?
_________________
I am *not* the model of the modern major general.
Back to top
View user's profile Send private message
mq4you
PostPosted: Fri Jan 19, 2007 4:57 am    Post subject: Reply with quote

Novice

Joined: 27 Nov 2006
Posts: 11

the java-api. below some sample code.

...
...

MQMessage sampleMessage = new MQMessage();

sampleMessage.format = MQC.MQFMT_STRING;
sampleMessage.messageType = MQC.MQMT_DATAGRAM;

// message context
sampleMessage.userId = "test";
sampleMessage.putApplicationName = "myAppName";
sampleMessage.applicationIdData = "myAppIdData";
sampleMessage.putApplicationType = 0;
sampleMessage.putDateTime = new GregorianCalendar();

String messageId = "myMsgId";
sampleMessage.messageId = messageId.getBytes();
String correlationId = "myCorrelId";
sampleMessage.correlationId = correlationId.getBytes();

sampleMessage.writeUTF("myData");

MQPutMessageOptions pmo = new MQPutMessageOptions();
pmo.options = MQC.MQPMO_SET_ALL_CONTEXT;
Back to top
View user's profile Send private message
jefflowrey
PostPosted: Fri Jan 19, 2007 5:18 am    Post subject: Reply with quote

Grand Poobah

Joined: 16 Oct 2002
Posts: 19981

Alternate user authority checking is performed at MQOpen, not at a normal put. In your case, that would be at "accessQueue".

http://publib.boulder.ibm.com/infocenter/wmqv6/v6r0/index.jsp?topic=/com.ibm.mq.csqzas.doc/sp1woaltau.htm

Alternate user authority is set in the Object Descriptor. The User Id field in the MQMD is not used for alternate authority checking.

http://publib.boulder.ibm.com/infocenter/wmqv6/v6r0/topic/com.ibm.mq.csqzaw.doc/csqzaw1450.htm

See the different forms of accessQueue if you want to use Alternate User Ids
http://publib.boulder.ibm.com/infocenter/wmqv6/v6r0/index.jsp?topic=/com.ibm.mq.csqzaw.doc/csqzaw1455.htm

Or make sure you know what user id is actually in effect when you connect.
_________________
I am *not* the model of the modern major general.
Back to top
View user's profile Send private message
Display posts from previous:   
Post new topic  Reply to topic Page 1 of 1

MQSeries.net Forum Index » General IBM MQ Support » MQ Security, Authority
Jump to:  



You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
Protected by Anti-Spam ACP
 
 


Theme by Dustin Baccetti
Powered by phpBB © 2001, 2002 phpBB Group

Copyright © MQSeries.net. All rights reserved.