ASG
IBM
Zystems
Cressida
Icon
Netflexity
 
  MQSeries.net
Search  Search       Tech Exchange      Education      Certifications      Library      Info Center      SupportPacs      LinkedIn  Search  Search                                                                   FAQ  FAQ   Usergroups  Usergroups
 
Register  ::  Log in Log in to check your private messages
 
RSS Feed - WebSphere MQ Support RSS Feed - Message Broker Support

MQSeries.net Forum Index » IBM MQ Security » Removing subscriptions with alternate userid

Post new topic  Reply to topic
 Removing subscriptions with alternate userid « View previous topic :: View next topic » 
Author Message
moe
PostPosted: Fri Nov 05, 2010 1:22 am    Post subject: Removing subscriptions with alternate userid Reply with quote

Apprentice

Joined: 05 Sep 2006
Posts: 33
Location: Sydney, Australia

I have a requirement to be able to remove subscriptions with a
"RegistrationUserIdentifier" other than "mqm". The application sending the DeReg command to the broker is connecting using a bindings connection and is running as mqm.

Prior to securing our mq installation, everything connected as mqm so the RegistrationUserIdentifier was always mqm. This meant we could run a utility to send a DeReg command and it would always work.

Now, we are in a situation where some applications are registering subscriptions without the MQREGO_VARIABLE_USER_ID option. As such we cannot remove them with a utility running as mqm.

I'm looking to rectify this situation by modifying the utility to set the userid to the registered userid by using the following code:

Code:


MQEnvironment.userID = userid;
      qMgr = new MQQueueManager(qMgrName);
      System.out.println("\nQueue manager name: " + qMgrName);
      brokerQueue = qMgr.accessQueue(commandQueue,
            (MQC.MQOO_OUTPUT | MQC.MQOO_ALTERNATE_USER_AUTHORITY), "", "",
            userid);

....

MQMessage requestMsg = new MQMessage();
MQPutMessageOptions pmo = new MQPutMessageOptions();

pmo.options = MQC.MQPMO_NEW_MSG_ID | MQC.MQPMO_ALTERNATE_USER_AUTHORITY;

requestMsg.userId = userid;

brokerQueue.put(requestMsg, pmo);


However, what i'm finding with the above code is that despite running as mqm, I receive 2035 errors and a failure to connect to the queue manager:

Code:

Event command (44)      =   Queue manager event
Event reason (2035)      =   Not authorized
Queue Manager name (2015)   =   RETAIL_JMS_MALI_MGR
Reason Qualifier (1)      =   MQRQ_CONN_NOT_AUTHORIZED
User Identifier (3025)      =   mqm
Application name (3024)      =   java


The platform details are:

WebSphere MQ 6.0.2.7 on Solaris SPARC. Unsubscribe utility is a java 1.5 application using the standard mq java api to manually construct messages to dereg subscriptions.
Back to top
View user's profile Send private message
Display posts from previous:   
Post new topic  Reply to topic Page 1 of 1

MQSeries.net Forum Index » IBM MQ Security » Removing subscriptions with alternate userid
Jump to:  



You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
Protected by Anti-Spam ACP
 
 


Theme by Dustin Baccetti
Powered by phpBB © 2001, 2002 phpBB Group

Copyright © MQSeries.net. All rights reserved.