| Author |
Message
|
| issac |
 Posted: Fri Feb 28, 2014 2:11 am Post subject: Why doesn't setmqaut -all remove crt permission? |
 |
|
Disciple
Joined: 02 Oct 2008
Posts: 158
Location: Shanghai
|
Hello, experts, this is my screenshot:
| Quote: |
C:\Users\issac>dspmqaut -m MQVAS2 -p even -n TESTQ -t queue
实体 even 对于对象 TESTQ 具有下列权限：
get
put
crt
C:\Users\issac>setmqaut -m MQVAS2 -p even -n TESTQ -t queue -all
setmqaut 命令成功完成。
C:\Users\issac>dspmqaut -m MQVAS2 -p even -n TESTQ -t queue
实体 even 对于对象 TESTQ 具有下列权限：
crt
C:\Users\issac>
|
It shows that -all has no effect over crt permission.
I've also tried +all, which does not add crt permission too.
I looked it up in the InfoCenter. Unfortunately it just says
| Quote: |
alladm= chg、clr、crt、dlt、dsp、ctrl∩ctrlx
allmqi = altusr、browse、connect、get、inq、pub、put、resume、set∩sub
|
But it gave no info what "all" means. perhaps it's just too obvious... By intuition I would say all should be any permission available, but the above experiment shows it's not.
_________________
Bazinga! |
|
| Back to top |
|
 |
| zpat |
| Posted: Fri Feb 28, 2014 2:36 am Post subject: |
|
|
Jedi Council
Joined: 19 May 2001
Posts: 5866
Location: UK
|
Is there a generic profile that covers the same queue name?
_________________
Well, I don't think there is any question about it. It can only be attributable to human error. This sort of thing has cropped up before, and it has always been due to human error. |
|
| Back to top |
|
|
| JosephGramig |
| Posted: Fri Feb 28, 2014 7:01 am Post subject: |
|
|
Grand Master
Joined: 09 Feb 2006
Posts: 1244
Location: Gold Coast of Florida, USA
|
|
| Back to top |
|
|
| markt |
| Posted: Fri Feb 28, 2014 11:02 am Post subject: |
|
|
Knight
Joined: 14 May 2002
Posts: 508
|
crt is not really a per-queue permission but dspmqaut shows it for historic reasons as it was the only query interface for ACLs at one time. It's really tied to the @class profile so it can't be removed from individual queues.
The newer dmpmqaut, dmpmqcfg and DISPLAY AUTHREC are all better and more flexible ways to look at permissions. |
|
| Back to top |
|
|
| JosephGramig |
| Posted: Fri Feb 28, 2014 11:21 am Post subject: |
|
|
Grand Master
Joined: 09 Feb 2006
Posts: 1244
Location: Gold Coast of Florida, USA
|
@markt
So, I don't see where you weighed in on this post which seems related to what you are saying...
Seems the new commands don't save/display everything... |
|
| Back to top |
|
|
| fjb_saper |
| Posted: Fri Feb 28, 2014 2:11 pm Post subject: |
|
|
Grand High Poobah
Joined: 18 Nov 2003
Posts: 20756
Location: LI,NY
|
If amqoamd shows a +crt permission, try removing it by running the same command but switching +crt to -crt.
Worked for me. 
_________________
MQ & Broker admin |
|
| Back to top |
|
|
| issac |
| Posted: Fri Feb 28, 2014 4:41 pm Post subject: |
|
|
Disciple
Joined: 02 Oct 2008
Posts: 158
Location: Shanghai
|
Ok, got it. Thanks!
_________________
Bazinga! |
|
| Back to top |
|
|
|
|
