| Author |
Message
|
| jeasterl |
 Posted: Mon Aug 10, 2009 12:38 pm Post subject: |
 |
|
Acolyte
Joined: 24 Jun 2001
Posts: 65
|
I am having a similar issue with the MQMON. I have granted the user administrator rights on the queue manager, and created a local user on the Windows machine and added it to the local mqm group. However, I continue to receive the following error in the event view:
Entity 'jeaster' has insufficient authority to access object 'SYSTEM.ADMIN.COMMAND.QUEUE'.
The specified entity is not authorized to access the required object. The following requested permissions are unauthorized: put
Ensure that the correct level of authority has been set for this entity against the required object, or ensure that the entity is a member of a privileged group.
Below are the rights that 'jeaster' has:
C:\Documents and Settings\SA-MQAdmin>dspmqaut -m QMCISAP15 -n SYSTEM.ADMIN.COMMA
ND.QUEUE -t queue -p jeaster
Entity jeaster has the following authorizations for object SYSTEM.ADMIN.COMMAND.
QUEUE:
get
browse
put
inq
set
crt
dlt
chg
dsp
passid
passall
setid
setall
clr
Any help would be greatly appreciated! |
|
| Back to top |
|
 |
| Vitor |
| Posted: Mon Aug 10, 2009 12:44 pm Post subject: |
|
|
Grand High Poobah
Joined: 11 Nov 2005
Posts: 26093
Location: Texas, USA
|
Split off from this 4 year old post
_________________
Honesty is the best policy.
Insanity is the best defence. |
|
| Back to top |
|
|
| Vitor |
| Posted: Mon Aug 10, 2009 12:48 pm Post subject: |
|
|
Grand High Poobah
Joined: 11 Nov 2005
Posts: 26093
Location: Texas, USA
|
As this is a Windows machine have you rebooted since you added the user to the group?
_________________
Honesty is the best policy.
Insanity is the best defence. |
|
| Back to top |
|
|
| fjb_saper |
| Posted: Mon Aug 10, 2009 11:41 pm Post subject: |
|
|
Grand High Poobah
Joined: 18 Nov 2003
Posts: 20756
Location: LI,NY
|
| Vitor wrote: |
| As this is a Windows machine have you rebooted since you added the user to the group? |
Or just issued a refresh security in runmqsc ? 
_________________
MQ & Broker admin |
|
| Back to top |
|
|
| jeasterl |
| Posted: Tue Aug 11, 2009 12:44 pm Post subject: |
|
|
Acolyte
Joined: 24 Jun 2001
Posts: 65
|
| We have issued the REFRESH SECURITY but have not rebooted the machine....can give that a try |
|
| Back to top |
|
|
| PeterPotkay |
| Posted: Tue Aug 11, 2009 2:46 pm Post subject: |
|
|
Poobah
Joined: 15 May 2001
Posts: 7722
|
This Queue Manager, user ID, MO71 software and user of MO71 are all on the same Windows MQ server?
_________________
Peter Potkay
Keep Calm and MQ On |
|
| Back to top |
|
|
| jeasterl |
| Posted: Thu Aug 13, 2009 7:13 am Post subject: |
|
|
Acolyte
Joined: 24 Jun 2001
Posts: 65
|
| Actually, the SupportPac is running on a seperate machine than the QM. |
|
| Back to top |
|
|
| PeterPotkay |
| Posted: Thu Aug 13, 2009 8:43 am Post subject: |
|
|
Poobah
Joined: 15 May 2001
Posts: 7722
|
User ID jeaster on Windows machine #1 is not the same as user id jeaster on Windows machine #2. The underlying SIDS are different and that is what MQ actually stores the authorities against, even though you enter and it displays only the "friendly" name, jeaster.
An Activity Directory Domain ID like AD/jeaster has the same SID on all machines.
Either use an AD ID and grant authority to that, or better yest tag the MCAUSER of the channel on the QM to the local ID you want, and then SSL or Security Exit protect that channel so only you can use it.
_________________
Peter Potkay
Keep Calm and MQ On |
|
| Back to top |
|
|
| jeasterl |
| Posted: Fri Aug 14, 2009 6:52 am Post subject: |
|
|
Acolyte
Joined: 24 Jun 2001
Posts: 65
|
That was the trick. I forgot about MQ's strict domain level restrictions. Once I granted the AD\jeaster access, there were no further issues with MQMON.
Thanks for all of your assistance! |
|
| Back to top |
|
|
|
|
