MQSeries.net :: View topic - Setting security so a user can only look at a queue

MQSeries.net

Tech Exchange

Education

Certifications

Library

Info Center

SupportPacs

FAQÂ Â

Usergroups

RSS Feed - WebSphere MQ Support

RSS Feed - Message Broker Support

MQSeries.net Forum Index » General IBM MQ Support » Setting security so a user can only look at a queue

Setting security so a user can only look at a queue

« View previous topic :: View next topic »

Author

Message

chrislfxp

Posted: Mon Jan 22, 2007 10:39 am Post subject: Setting security so a user can only look at a queue

Newbie

Joined: 22 Jan 2007
Posts: 3

We need to have some of our developers monitor the queues on our production server using the M071 tool. I created a specific ID for them to use and I want to lock down the security so they can only read the queue and not put anything in the queues.

I have been using the setmqaut command with various permission changes, but I have not had any success.

Has anyone else been able to restrict an ID to read-only permissions? If you have could you let me know what permissions the user/group has?

Thanks in advance.

bruce2359

Posted: Mon Jan 22, 2007 12:02 pm Post subject:

Guest

Yes. Setmqaut works fine for +get -put +browse kinds of permissions. Refer to setmqaut documentation in the System Administration Guide.

Is the username you are testing with in the mq admin?

fjb_saper

Posted: Mon Jan 22, 2007 1:48 pm Post subject:

Grand High Poobah

Joined: 18 Nov 2003
Posts: 20756
Location: LI,NY

And remember on Unix you can forget the userId. It is the group membership that gets set and queried...

Enjoy

_________________
MQ & Broker admin

chrislfxp

Posted: Mon Jan 22, 2007 2:16 pm Post subject:

Newbie

Joined: 22 Jan 2007
Posts: 3

Hi

This is a windows box. The user is not a member of the MQ admin group.

I ran setmqaut on the box giving the following permissions

for the QM +all +allmqi
for the queues +all

I can can connect via the M071 tool.

If I do a -put to all of the queues I cannot connect

The error I receive on the M071 tool is:

Error opening queue 'QM_QMGRNAME/SYSTEM.DEFAULT.MODEL.QUEUE' RC(2035) Not authorized.

The SYSTEM.DEFAULT.MODEL.QUEUE is a temporary queue. Should I be able to assign permissions to this queue?

chrislfxp

Posted: Mon Jan 22, 2007 2:24 pm Post subject:

Newbie

Joined: 22 Jan 2007
Posts: 3

I had allow put on these two queues

SYSTEM.ADMIN.COMMAND.QUEUE
SYSTEM.DEFAULT.MODEL.QUEUE

I was able to connect with the M071 tool. It appears that I am unable to put any messages in any of the production queues which is what I want.

Display posts from previous:

Page 1 of 1

MQSeries.net Forum Index » General IBM MQ Support » Setting security so a user can only look at a queue

Jump to:

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum

Protected by Anti-Spam ACP