| Author |
Message
|
| k_usa |
 Posted: Wed Jul 03, 2013 8:28 am Post subject: setmqaut not working for channels |
 |
|
Apprentice
Joined: 14 Aug 2006
Posts: 42
Location: NewJersey
|
Hi ,
I am having problem with setmqaut to revoke the channel level permission for a group.
setmqaut -m QM1 -t channel -g gtsd -n CHANNEL1 -all +none
The setmqaut command completed successfully.
dspmqaut -m QM1 -t channel -n CHANNEL1 -g gtsd
Entity gtsd has the following authorizations for object CHANNEL1:
echo "REFRESH SECURITY" | runmqsc QM1
From MQExplorer still having the Display access when accessed using the channel which has MCAuserid='gtsd'. |
|
| Back to top |
|
 |
| mqjeff |
| Posted: Wed Jul 03, 2013 8:34 am Post subject: |
|
|
Grand Master
Joined: 25 Jun 2008
Posts: 17447
|
| MCAUSER forces a user id, not a group id. So it's authorizing based on at least one of the groups that the user gtsd is a member of. |
|
| Back to top |
|
|
| k_usa |
| Posted: Wed Jul 03, 2013 8:49 am Post subject: |
|
|
Apprentice
Joined: 14 Aug 2006
Posts: 42
Location: NewJersey
|
| mqjeff wrote: |
| MCAUSER forces a user id, not a group id. So it's authorizing based on at least one of the groups that the user gtsd is a member of. |
Hi Jeff,
Thanks for the reply.
I am able to set the authorizations on Queues ets.
But I am not able to remove the authorization on Channels.
Here is the gtsd output.
id gtsd
uid=10389(gtsd) gid=63957(gtsd) groups=63957(gtsd)
We have WMQ 8.0.0.1 on Linux. |
|
| Back to top |
|
|
| exerk |
| Posted: Wed Jul 03, 2013 9:49 am Post subject: |
|
|
Jedi Council
Joined: 02 Nov 2006
Posts: 6339
|
| k_usa wrote: |
| We have WMQ 8.0.0.1 on Linux. |
 Wow! I didn't know it was out yet! Or do you mean WebSphere Message Broker/IBM Integration Bus? 
_________________
It's puzzling, I don't think I've ever seen anything quite like this before...and it's hard to soar like an eagle when you're surrounded by turkeys. |
|
| Back to top |
|
|
| k_usa |
| Posted: Wed Jul 03, 2013 10:36 am Post subject: |
|
|
Apprentice
Joined: 14 Aug 2006
Posts: 42
Location: NewJersey
|
| exerk wrote: |
| k_usa wrote: |
| We have WMQ 8.0.0.1 on Linux. |
Wow! I didn't know it was out yet! Or do you mean WebSphere Message Broker/IBM Integration Bus? |
Sorry we have WMQ 7.5.0.1 |
|
| Back to top |
|
|
| JosephGramig |
| Posted: Wed Jul 03, 2013 10:52 am Post subject: |
|
|
Grand Master
Joined: 09 Feb 2006
Posts: 1231
Location: Gold Coast of Florida, USA
|
ok, so the setmqaut on channels is about seeing and managing the channels. Not about who can use them.
Don't use -all +none but -remove to remove the rule (and the rule is about what the user can do to the channel, not with the channel).
If you have no rules, then you can use any SVRCONN so long as the underlying permissions allow you to connect and open and whatever else you need to do.
Think about it...
Use CHLAUTH to control who can use the channel. |
|
| Back to top |
|
|
| k_usa |
| Posted: Thu Aug 15, 2013 9:59 am Post subject: Update |
|
|
Apprentice
Joined: 14 Aug 2006
Posts: 42
Location: NewJersey
|
Just wanted to update everybody that the problem was due to a bug in WMQ 7.5.0.1 .
This problem is resolved in WMQ 7.5.0.2
IBM informed us about this after PMR
Thanks for all the replies |
|
| Back to top |
|
|
| Vitor |
| Posted: Thu Aug 15, 2013 10:02 am Post subject: Re: Update |
|
|
Grand High Poobah
Joined: 11 Nov 2005
Posts: 26093
Location: Texas, USA
|
| k_usa wrote: |
Just wanted to update everybody that the problem was due to a bug in WMQ 7.5.0.1 .
This problem is resolved in WMQ 7.5.0.2 |
We thank you for the update.
_________________
Honesty is the best policy.
Insanity is the best defence. |
|
| Back to top |
|
|
|
|
