| |
|
RSS Feed - WebSphere MQ Support
|
RSS Feed - Message Broker Support
|
  |
|
| CHLAUTH in only one QM in the Cluster |
« View previous topic :: View next topic » |
| Author |
Message
|
| k_usa |
 Posted: Wed Feb 19, 2014 8:00 pm Post subject: CHLAUTH in only one QM in the Cluster |
 |
|
Apprentice
Joined: 14 Aug 2006
Posts: 42
Location: NewJersey
|
Hi All,
1) We are trying to enable the CHLAUTH in our MQ Cluster.
When I enabled CHLAUTH on one QM (QM1) in the cluster - as per the CHLAUTH rules it should be blocking the 'mqm' access on all the channels. ( With the default chlauth rules)
But I am still able to put the messages on to the QM1 Cluster Queues using other QM connection information in the cluster (with 'mqm' access).
Wanted to know how this is working ? (Does the CHLAUTH rule applies only to SVRCONN channels ?)
2) Another question is how to block the 'Channel Authentication Records' visibility from mq explorer using setmqaut command ?
We are @ WMQ 7.5.0.2
Appreciate your reply on this. |
|
| Back to top |
|
 |
| bruce2359 |
| Posted: Wed Feb 19, 2014 9:16 pm Post subject: Re: CHLAUTH in only one QM in the Cluster |
|
|
Poobah
Joined: 05 Jan 2008
Posts: 9396
Location: US: west coast, almost. Otherwise, enroute.
|
| k_usa wrote: |
| When I enabled CHLAUTH on one QM (QM1) in the cluster - as per the CHLAUTH rules it should be blocking the 'mqm' access on all the channels. ( With the default chlauth rules) |
What CHLAUTH ruless?
| k_usa wrote: |
| But I am still able to put the messages on to the QM1 Cluster Queues using other QM connection information in the cluster (with 'mqm' access). |
What other QM connection information?
| k_usa wrote: |
| Wanted to know how this is working ? (Does the CHLAUTH rule applies only to SVRCONN channels ?) |
What CHLAUTH rules?
_________________
I like deadlines. I like to wave as they pass by.
ב''ה
Lex Orandi, Lex Credendi, Lex Vivendi. As we Worship, So we Believe, So we Live. |
|
| Back to top |
|
|
| fjb_saper |
| Posted: Wed Feb 19, 2014 10:21 pm Post subject: |
|
|
Grand High Poobah
Joined: 18 Nov 2003
Posts: 20696
Location: LI,NY
|
My understanding is that chlauth rules using clntuser attributes (like the one you mentioned) only work on SVRCONN channels. The ones using IP attributes work on all types of channels.
You may best see that when you create a rule of your own and in the second or third screen of the wizard set the channel name as * and press the button to see the potentially affected channels. If the only type displayed is svrconn then that's the only type affected.
As PeterPotkay mentioned in some post from last year, you might want to set an mcauser on the cluster receiver that has no authority to the command input queue monitored by the command server.
Have fun 
_________________
MQ & Broker admin |
|
| Back to top |
|
|
| k_usa |
| Posted: Thu Feb 20, 2014 6:46 am Post subject: |
|
|
Apprentice
Joined: 14 Aug 2006
Posts: 42
Location: NewJersey
|
| fjb_saper wrote: |
My understanding is that chlauth rules using clntuser attributes (like the one you mentioned) only work on SVRCONN channels. The ones using IP attributes work on all types of channels.
You may best see that when you create a rule of your own and in the second or third screen of the wizard set the channel name as * and press the button to see the potentially affected channels. If the only type displayed is svrconn then that's the only type affected.
As PeterPotkay mentioned in some post from last year, you might want to set an mcauser on the cluster receiver that has no authority to the command input queue monitored by the command server.
Have fun |
Thank you very much for the reply |
|
| Back to top |
|
|
|
|
|
| |
|
Page 1 of 1 |
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
|
|
|
