ASG
IBM
Zystems
Cressida
Icon
Netflexity
 
  MQSeries.net
Search  Search       Tech Exchange      Education      Certifications      Library      Info Center      SupportPacs      LinkedIn  Search  Search                                                                   FAQ  FAQ   Usergroups  Usergroups
 
Register  ::  Log in Log in to check your private messages
 
RSS Feed - WebSphere MQ Support RSS Feed - Message Broker Support

MQSeries.net Forum Index » Clustering » MQ Security setup

Post new topic  Reply to topic Goto page Previous  1, 2, 3
 MQ Security setup « View previous topic :: View next topic » 
Author Message
Sam Uppu
PostPosted: Wed Mar 18, 2009 4:57 pm    Post subject: Reply with quote

Yatiri

Joined: 11 Nov 2008
Posts: 610

mqjeff wrote:
fjb_saper wrote:
Sam Uppu wrote:

In my case, the cluster queue resides on multiple QMgrs. The application wants to send the messages to a particular cluster queue onto a specific QMgr.

Not sure how to achieve this.

Thanks for your thoughts.

A simple qr will do. IIRC you do not need to fill in the xmitq as the destination qmgr is part of the cluster.

def qr(mydest) rname(clusterqname) rqmname(QM.PARIS)

Have fun


FJ, I think the question is more about using a Reply To QMgr.

In this case, the sending app may not have control over the name put into ReplyToQMgr, and the replying app can't decide to use anything other than the value put in.

A QR is certainly the needed choice, but not with a name anything other than "QM.PARIS".

def qr (QM.PARIS) rname() rqmname(QM.PARIS) cluster(clusname)


I think this will work. I need to test with app team though.

Jeff, do we need to provide the permissions as -all +put to QM.PARIS?. or else do we need also +set +setall as well along with +put?.

Thanks for your suggestions.
Back to top
View user's profile Send private message
fjb_saper
PostPosted: Wed Mar 18, 2009 8:08 pm    Post subject: Reply with quote

Grand High Poobah

Joined: 18 Nov 2003
Posts: 20757
Location: LI,NY

mqjeff wrote:

FJ, I think the question is more about using a Reply To QMgr.

In this case, the sending app may not have control over the name put into ReplyToQMgr, and the replying app can't decide to use anything other than the value put in.

A QR is certainly the needed choice, but not with a name anything other than "QM.PARIS".

def qr (QM.PARIS) rname() rqmname(QM.PARIS) cluster(clusname)


Doh don't know why I was thinking he'd be the requester...
_________________
MQ & Broker admin
Back to top
View user's profile Send private message Send e-mail
Sam Uppu
PostPosted: Thu Mar 19, 2009 11:07 am    Post subject: Reply with quote

Yatiri

Joined: 11 Nov 2008
Posts: 610

mqjeff wrote:
fjb_saper wrote:
Sam Uppu wrote:

In my case, the cluster queue resides on multiple QMgrs. The application wants to send the messages to a particular cluster queue onto a specific QMgr.

Not sure how to achieve this.

Thanks for your thoughts.

A simple qr will do. IIRC you do not need to fill in the xmitq as the destination qmgr is part of the cluster.

def qr(mydest) rname(clusterqname) rqmname(QM.PARIS)

Have fun


FJ, I think the question is more about using a Reply To QMgr.

In this case, the sending app may not have control over the name put into ReplyToQMgr, and the replying app can't decide to use anything other than the value put in.

A QR is certainly the needed choice, but not with a name anything other than "QM.PARIS".

def qr (QM.PARIS) rname() rqmname(QM.PARIS) cluster(clusname)


Jeff,
We tried this and still the app is getting 2035 error.

The source application is connecting to QM.LONDON and trying to put the message onto cluster queue CLUSTERQ defined on QM.PARIS.

We defined the Alias QMgr for QM.PARIS on QM.LONDON in this way:

def qr (QM.PARIS) rname() rqmname(QM.PARIS) cluster(clusname)

The source app is using the QMgr-QM.PARIS along with the cluster queue:
Queue req_queue = qMgr.accessQueue("CLUSTERQ", openOptions,"QM.PARIS", null, null);

and the prmissions are provided for the source application id for the Alias QMgr.

dspmqaut -m QM.LONDON -t queue -n QM.PARIS -p App1
Entity fraud has the following authorizations for object QM.PARIS:
put
set
setall

Still the app is not able to access the queue CLUSTERQ on QM.PARIS and getting 2035 error.

Let me know if my approach is wrong.

Thanks.
Back to top
View user's profile Send private message
fjb_saper
PostPosted: Thu Mar 19, 2009 8:50 pm    Post subject: Reply with quote

Grand High Poobah

Joined: 18 Nov 2003
Posts: 20757
Location: LI,NY

Try and add inq and see if it then works.
_________________
MQ & Broker admin
Back to top
View user's profile Send private message Send e-mail
bruce2359
PostPosted: Sat Mar 21, 2009 8:55 am    Post subject: Reply with quote

Poobah

Joined: 05 Jan 2008
Posts: 9472
Location: US: west coast, almost. Otherwise, enroute.

Quote:
Still the app is not able to access the queue CLUSTERQ on QM.PARIS and getting 2035 error

I gone back and reread this entire post, and I'm confused as to who, where and what, gets the 2035 rc.

Are you saying that the application creating the message is getting 2035 on MQOPEN (or equivalent) to a QRemote definition?

Or are you saying that the MCA on the destination qmgr is getting the 2035 on MQOPEN to the QLocal destination queue?

Or something else?
_________________
I like deadlines. I like to wave as they pass by.
ב''ה
Lex Orandi, Lex Credendi, Lex Vivendi. As we Worship, So we Believe, So we Live.
Back to top
View user's profile Send private message
Sam Uppu
PostPosted: Mon Mar 23, 2009 9:36 am    Post subject: Reply with quote

Yatiri

Joined: 11 Nov 2008
Posts: 610

bruce2359 wrote:
Quote:
Still the app is not able to access the queue CLUSTERQ on QM.PARIS and getting 2035 error

I gone back and reread this entire post, and I'm confused as to who, where and what, gets the 2035 rc.

Are you saying that the application creating the message is getting 2035 on MQOPEN (or equivalent) to a QRemote definition?

Or are you saying that the MCA on the destination qmgr is getting the 2035 on MQOPEN to the QLocal destination queue?

Or something else?


The Application connected to QM.LONDON and trying to put the message onto CLUSTERQ(cluster queue) by providing the QMgr name-QM.PARIS in MQOD.

qMgr.accessQueue("CLUSTERQ",
openOptions,"QM.PARIS", null, null);

If the source application is trying to access a cluster queue by specifying QMgr name in the MQ object descriptor, the source application is getting 2035 error.

The source application id: "App1" is provided with permissions to QMgr-QM.LONDON(connect/inq/set/setall).

I think local Alias queue for the remote cluster queue doesn't resolve when the QMgr name is specified along with queue name in MQOD(as described above).

Let me know your thoughts.

Thanks.
Back to top
View user's profile Send private message
PeterPotkay
PostPosted: Mon Mar 23, 2009 10:44 am    Post subject: Reply with quote

Poobah

Joined: 15 May 2001
Posts: 7722

Sam Uppu wrote:
I think local Alias queue for the remote cluster queue doesn't resolve when the QMgr name is specified along with queue name in MQOD(as described above)


As soon as you supply a non local QM name in the MQOD, MQ Name Resolution ignores the queue name and starts looking for paths that reolve for that QM name (XMITQs, QM Aliases, Default XMITQs, cluster memebership, etc...not in that order by the way).
_________________
Peter Potkay
Keep Calm and MQ On
Back to top
View user's profile Send private message
Sam Uppu
PostPosted: Mon Mar 23, 2009 11:20 am    Post subject: Reply with quote

Yatiri

Joined: 11 Nov 2008
Posts: 610

PeterPotkay wrote:
Sam Uppu wrote:
I think local Alias queue for the remote cluster queue doesn't resolve when the QMgr name is specified along with queue name in MQOD(as described above)


As soon as you supply a non local QM name in the MQOD, MQ Name Resolution ignores the queue name and starts looking for paths that reolve for that QM name (XMITQs, QM Aliases, Default XMITQs, cluster memebership, etc...not in that order by the way).


I tried with Alias QMgr name and still getting 2035 error.

On QM.LONDON(source QMgr)

DEFINE QREMOTE(QM.PARIS) RNMAE(' ') RQMNAME(QM.PARIS).

Privided permissions for the source application id "App1" for the Alias Qmgr.

$ dspmqaut -m QM.LONDON -t queue -n QM.PARIS -p App1
Entity App1 has the following authorizations for object QM.PARIS:
put
set
setall

And the application providing the Qmgr name as QM.PARIS along with CLUSTERQ in MQOD....still getting 2035 error.

Do you recommend any other options to try out?.

Thanks.
Back to top
View user's profile Send private message
bruce2359
PostPosted: Mon Mar 23, 2009 11:39 am    Post subject: Reply with quote

Poobah

Joined: 05 Jan 2008
Posts: 9472
Location: US: west coast, almost. Otherwise, enroute.

If you are on QM.LONDON and want to put a message to CLUSTERQ, but only the instance of CLUSTERQ on QM.PARIS; then on QM.LONDON:

DEF QR(CLUSTERQ) RQMNAME(QM.PARIS) CLUSTER(clusname)

Delete any qmgr-alias definitions for QM.PARIS you have been testing.
_________________
I like deadlines. I like to wave as they pass by.
ב''ה
Lex Orandi, Lex Credendi, Lex Vivendi. As we Worship, So we Believe, So we Live.
Back to top
View user's profile Send private message
Sam Uppu
PostPosted: Mon Mar 23, 2009 12:30 pm    Post subject: Reply with quote

Yatiri

Joined: 11 Nov 2008
Posts: 610

We have request/ reply scenario.
Lets say Requesting app(service requestor) is connected to QM1 and putting the messages onto Request queue(cluster queue) defined on QM2.

In this case we can define an local Alias queue for remote request queue(cluster queue) on QM1 and provide the privileges to the app id for the locally defined Alias queue

DEFINE QALIAS(REQ) TARGQ(REQ) DEFBIND(NOTFIXED)

....This is working.


The destion app(service provider) should respond to the same QMgr where the request is originated from as there are multiple QMgrs which contain the same response queue names. In this case the destination app should respond to the response queue defined on QM1(as there are many response queues defined with the same name on other QMgrs within the cluster). The destination app will come to know this information from MQMD of the request message(ReplyToQueue and ReplyToQMgr fields) where it has to respond to.

In this case the destination app(service provider) need to provide the QMgr name while responding:


Queue req_queue = qMgr.accessQueue("RSP", openOptions,"QM1", null, null);
Where RSP is a response queue(cluster queue) defined on QM1 QMgr(service requestor).

In this case creating an Alias queue for RSP queue on QM2 does not resolve the queue name by providing the queue manager name as QM1 along with Alias Queue(RSP) defined on QM2.

We tried with creating local Alias queue on QM2 for the RSP but the source Application is getting 2035 error.

Also tried with Alias QMgr and still getting 2035 error.

Can anybody let me know what do you guys suggest.

Thanks.
Back to top
View user's profile Send private message
bruce2359
PostPosted: Mon Mar 23, 2009 12:42 pm    Post subject: Reply with quote

Poobah

Joined: 05 Jan 2008
Posts: 9472
Location: US: west coast, almost. Otherwise, enroute.

Is this new addition to your post somehow related to the two prior subjects that have been discussed here?

Please open a new post when the subject changes.
_________________
I like deadlines. I like to wave as they pass by.
ב''ה
Lex Orandi, Lex Credendi, Lex Vivendi. As we Worship, So we Believe, So we Live.
Back to top
View user's profile Send private message
Sam Uppu
PostPosted: Mon Mar 23, 2009 12:48 pm    Post subject: Reply with quote

Yatiri

Joined: 11 Nov 2008
Posts: 610

bruce2359 wrote:
Is this new addition to your post somehow related to the two prior subjects that have been discussed here?

Please open a new post when the subject changes.


Actually it is the same. I just changed queue names. In my previous posts, I mentioned it with CLUSTERQ and here I named it as RSP.

I think I will open a new post as the thread count reached 40 and and need an extra effort to goto 3rd page for the latest post.

We will continue in the new post.

Thanks.
Back to top
View user's profile Send private message
PeterPotkay
PostPosted: Mon Mar 23, 2009 4:57 pm    Post subject: Reply with quote

Poobah

Joined: 15 May 2001
Posts: 7722

Sam Uppu wrote:

I think I will open a new post as the thread count reached 40 and and need an extra effort to goto 3rd page for the latest post.


We need to start a thread of "Classic Posts on mqseries.net.". This one makes the top 10 I think. Phew, I think I'll take a break now. It was tough work scrolling down the web page to post this.



_________________
Peter Potkay
Keep Calm and MQ On
Back to top
View user's profile Send private message
Display posts from previous:   
Post new topic  Reply to topic Goto page Previous  1, 2, 3 Page 3 of 3

MQSeries.net Forum Index » Clustering » MQ Security setup
Jump to:  



You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
Protected by Anti-Spam ACP
 
 


Theme by Dustin Baccetti
Powered by phpBB © 2001, 2002 phpBB Group

Copyright © MQSeries.net. All rights reserved.