| |
|
RSS Feed - WebSphere MQ Support
|
RSS Feed - Message Broker Support
|
  |
|
| User id used in connection??? |
« View previous topic :: View next topic » |
| Author |
Message
|
| oli |
 Posted: Mon May 09, 2011 11:10 pm Post subject: User id used in connection??? |
 |
|
Acolyte
Joined: 14 Jul 2006
Posts: 68
Location: Germany
|
Hi all,
I have a - maybe stupid - question. I'm using MQ 7.0 on Windows (server and client) and I'm connecting to a remote QM using Java. I don't understand the following behavior.
I use the following code to put a message to a queue:
| Code: |
Hashtable props = new Properties();
props.put(CMQC.CHANNEL_PROPERTY, "TEST.SVRCONN");
props.put(CMQC.HOST_NAME_PROPERTY, "myhost.mydomain");
props.put(CMQC.PORT_PROPERTY, 1425);
MQQueueManager qm = new MQQueueManager("MY_QM", props);
MQQueue queue = qm.accessQueue("TEST.IN", MQC.MQOO_OUTPUT);
MQMessage message = new MQMessage();
message.format = CMQC.MQFMT_STRING;
message.expiry = CMQC.MQEI_UNLIMITED;
message.messageId = CMQC.MQMI_NONE;
message.messageType = CMQC.MQMT_DATAGRAM;
queue.put(message);
|
I don't pass any user id and in MQEnvironment a user id is not set. Why can I put a message to that queue? The user that is executing the Java code is not known on the QM machine and an MCA user is not set on the channel.
When browsing the message on the queue it contains the user identifier of the user that is am MQ admin on the QM machine (who started the QM).
When passing a user id using
| Code: |
props.put(CMQC.USER_ID_PROPERTY, "a_user_id");
|
then that user id is checked:
- If the user exists on the QM machine and is member of group "mqm" then the put succeeds and when browsing the message the user identifier of the message is set.
- If the user does not exist on the QM machine or isn't member of group "mqm" then the put fails.
Can anybody explain that behavior?
Where does the user come from if not specified in the properties?
Thanks,
Oli[/list] |
|
| Back to top |
|
 |
| fjb_saper |
| Posted: Tue May 10, 2011 1:48 am Post subject: |
|
|
Grand High Poobah
Joined: 18 Nov 2003
Posts: 20756
Location: LI,NY
|
Searching a little bit on the site would have told you following:
In Java, using a client connection:
If the user is not set on the channel (MCAUser), or on the message / connection(jms), the authority of the user running the channel is used. This is generally a userid belonging to the mqm group and having full authority.
This is why you need to set an MCAUser on all your channels and deal with security issues.
Have fun 
_________________
MQ & Broker admin |
|
| Back to top |
|
|
| oli |
| Posted: Tue May 10, 2011 5:11 am Post subject: |
|
|
Acolyte
Joined: 14 Jul 2006
Posts: 68
Location: Germany
|
Hi fjb_saper,
first thanks for your reply. I seached a little bit more with the correct search terms but I still wonder if I understand correctly.
1. If Java client connects with an empty user id and an MCA User is not set then the client will have full access with the authority of the user that started the channel. If an MCA user is set then that MCA User is used for authorization.
2. If a Java client connects using a user id that user id is used for authorization if no MCA user is set. If MCA user is set the MCA user is used for authorization.
In consequence for me that means:
1. If no MCA user is set a Java client can connect by passing an empty (or no) user id with full authority.
2. If an MCA User is set and that user has some MQ authorizations a Java client can connect no matter if and what user id is passed.
3. If an MCA user is set and that user does not have any MQ authorization no one can connect using that channel. This MCA User cannot be overridden with standard MQ facilities.
In fact there is no possibility to secure the access to a QM with standard MQ facilities except using SSL!!! BlockIP2 security exit may be used to allow to override the MCA User.
Is that correct?
Thanks,
Oli |
|
| Back to top |
|
|
| mqjeff |
| Posted: Tue May 10, 2011 5:26 am Post subject: |
|
|
Grand Master
Joined: 25 Jun 2008
Posts: 17447
|
Yes, you understand the situation.
This is not in the slightest bit a new situation.
No production queue manager should have any channel of any kind that does not have an MCAUSER applied. |
|
| Back to top |
|
|
| PeterPotkay |
| Posted: Tue May 10, 2011 8:40 pm Post subject: |
|
|
Poobah
Joined: 15 May 2001
Posts: 7722
|
| mqjeff wrote: |
| No production queue manager should have any channel of any kind that does not have an MCAUSER applied. |
MCAUSER doesn't really matter for outgoing channels. But for any and all incoming channels, I agree.
_________________
Peter Potkay
Keep Calm and MQ On |
|
| Back to top |
|
|
|
|
|
| |
|
Page 1 of 1 |
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
|
|
|
