| Author |
Message
|
| Deepak_reddy |
 Posted: Tue Mar 06, 2007 10:37 pm Post subject: Regarding Topic Level Security |
 |
|
Novice
Joined: 04 Sep 2006
Posts: 10
|
Hi All,
This is regarding Topic Security involved in Message Brokers.
1.The issue is can I restrict any user accessing my Message Broker instance from subscribing to a Topic.
2.Furthermore how to specify restrictions on subtopics in a Topic for subscriptions.
3.Can I like deny subscriptions to all but let only a set of users only to subscribe on a topic and vice versa.
I have tried doing this using UserNameServer and Topic ACL but facing issues with mentioned 2 and 3 requirements.
Also using UserNameServer in a Domain Account has been problematic.
Any information regarding UserNameServer in a Domain would be really useful. Please provide us with your valuable comments and suggestions about this Topic |
|
| Back to top |
|
 |
| jsware |
| Posted: Thu Mar 08, 2007 6:14 am Post subject: |
|
|
Chevalier
Joined: 17 May 2001
Posts: 455
|
From my notes on enabling Topic Level Security in WBIMBv5:
To enable topic security in a domain, the Configuration Manager settings need to be updated using mqsichangeconfigmgr to identify the User Name Server’s queue manager. To enable topic security on a broker, the configuration of the broker must be changed using the mqsichangebroker command.
Before changing the Configuration Manager or broker settings, standard intercommunication channels between their queue managers and the User Name Server’s queue manager must be created. This ensures that the broker can communicate with the User Name Server.
Once the base WMQ intercommunication has been setup, create and start a User Name Server and then adjust the Configuration Manager and broker settings to identify the User Name Server’s queue manager.
To change the Configuration Manager settings, stop the component and issue the following command. Once completed, start the Configuration Manager:
| Code: |
| mqsichangeconfigmgr –s {UNS_QMGR} |
To change a broker’s settings, stop the component and issue the following command. Once completed successfully, start the broker.
| Code: |
| mqsichangebroker {BROKER_NAME} –s {UNS_QMGR} –j |
Remember to create the intercommunication channels and transmission queues between the Configuration Manager/broker queue manager and the User Name Server queue manager.
For more information on updating the Configuration Manager and broker settings, see the following sections in the WBIMB Toolkit online help:
WebSphere Business Integration Message Broker.
-> Configuring the broker domain.
-> Setting up broker domain security.
-> Enabling topic-based security.
_________________
Regards
John
The pain of low quaility far outlasts the joy of low price. |
|
| Back to top |
|
|
| Deepak_reddy |
| Posted: Tue Mar 13, 2007 8:12 pm Post subject: |
|
|
Novice
Joined: 04 Sep 2006
Posts: 10
|
Thanks Scott,
I have tried out the way you explained the things in setting ACLs and I was also able to deny subscriptions on topics but the real problem I was not able to deny subscriptions on any subtopics. For Eg. I wanted to deny subscriptions on Sports/Cricket. Though I created a topic called Sports and then a subtopic by the name Cricket under it (denied subscriptions) using Toolkit I could still able to subscribe to the Topic Sports/Cricket . I could not figure out why this happened. Need your valuable suggestions on this.
Regards
Deepak N |
|
| Back to top |
|
|
| fjb_saper |
| Posted: Wed Mar 14, 2007 1:54 am Post subject: |
|
|
Grand High Poobah
Joined: 18 Nov 2003
Posts: 20756
Location: LI,NY
|
Did you deny subscriptions on Sports/# ?? 
_________________
MQ & Broker admin |
|
| Back to top |
|
|
| jsware |
| Posted: Wed Mar 14, 2007 5:50 am Post subject: |
|
|
Chevalier
Joined: 17 May 2001
Posts: 455
|
| Deepak_reddy wrote: |
Thanks Scott,
I have tried out the way you explained the things in setting ACLs and I was also able to deny subscriptions on topics but the real problem I was not able to deny subscriptions on any subtopics. For Eg. I wanted to deny subscriptions on Sports/Cricket. Though I created a topic called Sports and then a subtopic by the name Cricket under it (denied subscriptions) using Toolkit I could still able to subscribe to the Topic Sports/Cricket . I could not figure out why this happened. Need your valuable suggestions on this.
Regards
Deepak N |
If you are using the toolkit, is it running under a user ID in one of the mqm/mqsi* groups? If so this may well override any ACL stuff you have setup.
I must admit that I am not an expert on ACLs.
_________________
Regards
John
The pain of low quaility far outlasts the joy of low price. |
|
| Back to top |
|
|
| jefflowrey |
| Posted: Wed Mar 14, 2007 1:02 pm Post subject: |
|
|
Grand Poobah
Joined: 16 Oct 2002
Posts: 19981
|
The groups are obsolete in version 6 - i.e. do not get checked by the ConfigMgr.
I don't know about UNS, but I don't believe it ever checked the groups.
We do need to be careful about distinguishing ACLs for ConfigMgr and ACLs for UNS, it's an entirely different set managed by an entirely different system.
I'm going to go with FJ, that an ACL needs to be created to explicitly deny subtopics.
_________________
I am *not* the model of the modern major general. |
|
| Back to top |
|
|
|
|
