| Author |
Message
|
| PascalLap |
 Posted: Wed Jun 20, 2012 11:09 am Post subject: Setmqaut usage with wildcard |
 |
|
Newbie
Joined: 24 Apr 2012
Posts: 5
|
Hello, for some reason the group users has authorization on every queue profile. Including the SYSTEM..... queues.
We try to remove/revoke the authorization with the following command:
setmqaut -m QMANAGER -n "SYSTEM.**" -t q -g users -all
We get a success.... The only problem is that the group is still listed on every SYSTEM queue, and also it has created a profile named: «SYSTEM.**» and gave no access to the group users........
It seem that the wildcard usage is broken... 
This is using version:
Name: WebSphere MQ
Version: 7.0.1.8
What is wrong with the command to delete the group users? |
|
| Back to top |
|
 |
| fjb_saper |
| Posted: Wed Jun 20, 2012 11:55 am Post subject: |
|
|
Grand High Poobah
Joined: 18 Nov 2003
Posts: 20756
Location: LI,NY
|
- save qmgr setup and authorizations (saveqmgr)
- Stop all channels and applications
- Delete the qmgr.
- Recreate it with a user having its primary group as mqm.
- start without channels and connections
- have that same user (primary group mqm) load the qmgr objects and run authorizations
- bounce the qmgr
- open for business
IIRC there is a hard coded permission (all) for the creator of the objects at creation time... and as in Unix/Linux this is at the group level you might get some surprises... I prefer to have all qmgr objects created by usr/grp mqm, but this is not always possible...
If you reassign permissions after creation of the objects by a non mqm group, the result might not always be what you expected...
Have you tried the form of setmqaut that ends with the remove key word (from memory)?
Have fun 
_________________
MQ & Broker admin |
|
| Back to top |
|
|
| PeterPotkay |
| Posted: Wed Jun 20, 2012 12:34 pm Post subject: |
|
|
Poobah
Joined: 15 May 2001
Posts: 7722
|
You probably created the QM with a user ID whose primary group was Users.
Whoops.
_________________
Peter Potkay
Keep Calm and MQ On |
|
| Back to top |
|
|
| PascalLap |
| Posted: Wed Jun 20, 2012 1:03 pm Post subject: |
|
|
Newbie
Joined: 24 Apr 2012
Posts: 5
|
Yeah the default group for the user mqm was «users»....
Guess we will use saveqmgr to make a backup and recreate the manager.
Clean out the save qmgr file to keep our custom config.
Thanks for the help.
(Still shouldn't the wildcard behave differently using the setmqaut command ?) |
|
| Back to top |
|
|
| gbaddeley |
| Posted: Wed Jun 20, 2012 8:16 pm Post subject: Re: Setmqaut usage with wildcard |
|
|
Jedi Knight
Joined: 25 Mar 2003
Posts: 2538
Location: Melbourne, Australia
|
| PascalLap wrote: |
..We try to remove/revoke the authorization with the following command:
setmqaut -m QMANAGER -n "SYSTEM.**" -t q -g users -all
We get a success.... The only problem is that the group is still listed on every SYSTEM queue, and also it has created a profile named: «SYSTEM.**» and gave no access to the group users........
It seem that the wildcard usage is broken... |
No its not... The setmqaut command you gave applies to the "SYSTEM.**" profile, not to all queue type profiles which begin with "SYSTEM." setmqaut only works with one profile at a time, so you need to issue setmqaut commands for every profile you need to change !
The moral of the story is never create a queue manager or define new objects from a userid which does not have 'mqm' as its primary group. Otherwise you will end up with residual profiles for the primary group and authority granted to objects which you never intended, such as "users", which is everyone on the system !
_________________
Glenn |
|
| Back to top |
|
|
| PascalLap |
| Posted: Thu Jun 21, 2012 5:44 am Post subject: |
|
|
Newbie
Joined: 24 Apr 2012
Posts: 5
|
|
| Back to top |
|
|
| exerk |
| Posted: Thu Jun 21, 2012 5:54 am Post subject: |
|
|
Jedi Council
Joined: 02 Nov 2006
Posts: 6339
|
Did that specialist also create the mqm user and group, or was that done for him/her?
_________________
It's puzzling, I don't think I've ever seen anything quite like this before...and it's hard to soar like an eagle when you're surrounded by turkeys. |
|
| Back to top |
|
|
| mqjeff |
| Posted: Thu Jun 21, 2012 7:07 am Post subject: |
|
|
Grand Master
Joined: 25 Jun 2008
Posts: 17447
|
That doesn't change the behavior of the setmqaut command.
It explains it. |
|
| Back to top |
|
|
|
|
