| Author |
Message
|
| nancyk |
 Posted: Thu Feb 27, 2003 7:47 pm Post subject: MQ Security configuration related to user identifier |
 |
|
Newbie
Joined: 12 Feb 2003
Posts: 7
|
We are just getting started with JMS and are trying to get an understanding of security. We ran a JMS application under Websphere 4.0 on AIX and accessed a local queue manager on the same box. The JMS app successfully put to a queue but but we are confused as to why it ran with the mqm useridentifier. We expected this app to get a 2035 since we had not set up the proper security. Any ideas?
Nancy |
|
| Back to top |
|
 |
| vennela |
| Posted: Fri Feb 28, 2003 7:39 am Post subject: |
|
|
Jedi Knight
Joined: 11 Aug 2002
Posts: 4055
Location: Hyderabad, India
|
That's right.
user "mqm" has complete authority on all MQ objects. So your app shouldn't fail. |
|
| Back to top |
|
|
| vmcgloin |
| Posted: Fri Feb 28, 2003 8:31 am Post subject: |
|
|
Knight
Joined: 04 Apr 2002
Posts: 560
Location: Scotland
|
Are you using a client connection? Is the mcauser field for the SVRCONN channel blank, or 'mqm'?
Vicky |
|
| Back to top |
|
|
| nancyk |
| Posted: Fri Feb 28, 2003 5:55 pm Post subject: |
|
|
Newbie
Joined: 12 Feb 2003
Posts: 7
|
Yes, we are using mqseries client connection and the mcauser field for the SVRCONN channel is blank. Our Websphere application server runs under userId webapp1. All message generating programs are deployed on this server. I was hoping to see the userIdentifier property of the message as webapp1. Why do I see mqm as the userIdentifer ? Isn't it a security loophole in mqseries?
Please enlighten me.[/i] |
|
| Back to top |
|
|
| kolban |
| Posted: Fri Feb 28, 2003 9:54 pm Post subject: |
|
|
Grand Master
Joined: 22 May 2001
Posts: 1072
Location: Fort Worth, TX, USA
|
In a JMS application, when you create the QueueConnection by calling the QueueConnectionFactory createQueueConnection() method, you have the option of specifying a userid and password pair. If you do not specify either, then the userid used will be the userid specified in the MCAUSER attribute of the SVRCONN channel definition. If none is specified there, then the userid used will be that running the Listener demon (mqm).
Note that any password specified in the createQueueConnection() method is not authenticated by the IBM's MQ JMS implementation without you implementing your own security exits. |
|
| Back to top |
|
|
|
|
