| Author |
Message
|
| vsathyan |
 Posted: Wed Apr 16, 2014 4:07 am Post subject: local and ldap/AD 'mqm' accounts in Linux |
 |
|
Centurion
Joined: 10 Mar 2014
Posts: 121
|
Hi there,
Before we install mq in a linux box, its a requirement that we have a local mqm group and mqm account be created in the server before installing MQ.
If I dont want to use a local 'mqm' account and want to use a 'mqm' group with members in a ldap server or active directory, how can we do this?
We want to do this to avoid the dependency to manage thousands of local 'mqm' accounts and their passwords for the servers we have.
Whats your advise and inputs in this regard?
Thanks,
vSathyan |
|
| Back to top |
|
 |
| JosephGramig |
| Posted: Wed Apr 16, 2014 5:10 am Post subject: Re: local and ldap/AD 'mqm' accounts in Linux |
|
|
Grand Master
Joined: 09 Feb 2006
Posts: 1231
Location: Gold Coast of Florida, USA
|
| vsathyan wrote: |
| Before we install mq in a linux box, its a requirement that we have a local mqm group and mqm account be created in the server before installing MQ. |
No, the install will create them and you probably want them to have the same UID and GID on every box, so you probably do want to create them first. If you create it, you will specify mqm's home directory. If the install creates the account, it will use /var/mqm for mqm's home directory.
| vsathyan wrote: |
If I dont want to use a local 'mqm' account and want to use a 'mqm' group with members in a ldap server or active directory, how can we do this?
We want to do this to avoid the dependency to manage thousands of local 'mqm' accounts and their passwords for the servers we have. |
I think you always want mqm to be local (ID and group). You should not be controlling or setting mqm's password and it should not be known. Use sudo su - mqm to become the mqm ID. Last, think real hard before you put any ID in the mqm group (never root). |
|
| Back to top |
|
|
| subani01491 |
| Posted: Thu May 22, 2014 6:30 am Post subject: |
|
|
Novice
Joined: 19 Mar 2014
Posts: 12
|
@vsathyan , any progress or update on the scenario ? I would appreciate if you can share your experience.
Thank you. |
|
| Back to top |
|
|
| exerk |
| Posted: Thu May 22, 2014 2:38 pm Post subject: Re: local and ldap/AD 'mqm' accounts in Linux |
|
|
Jedi Council
Joined: 02 Nov 2006
Posts: 6339
|
| JosephGramig wrote: |
| vsathyan wrote: |
| Before we install mq in a linux box, its a requirement that we have a local mqm group and mqm account be created in the server before installing MQ. |
No, the install will create them and you probably want them to have the same UID and GID on every box, so you probably do want to create them first. If you create it, you will specify mqm's home directory. If the install creates the account, it will use /var/mqm for mqm's home directory. |
That may change in IBM MQ Version 8.0 but until it's released (23rd May) and I/we get my hands on it I may (yet again) be talking out of an orifice that should be used for other purposes... 
_________________
It's puzzling, I don't think I've ever seen anything quite like this before...and it's hard to soar like an eagle when you're surrounded by turkeys. |
|
| Back to top |
|
|
| SAFraser |
| Posted: Thu May 22, 2014 4:51 pm Post subject: |
|
|
Shaman
Joined: 22 Oct 2003
Posts: 742
Location: Austin, Texas, USA
|
We recently did some research with IBM on this very topic.
We have it (in writing!) that IBM does not care whether mqm is a local or directory service account. MQ is ignorant of the location. Either type account is supported by IBM.
On unix machines, you tell the OS the order in which to seek authentication in the nsswitch.conf file. If, for example, the nsswitch.conf file says "check locally first, then check LDAP", then a call for authentication will look first to the local passwd file; if the user is not found, the OS will go to the next configured authentication source.
I think (haven't had time to test it, but I want to) that MQ will install on Linux so long as it can find the mqm user wherever -- either locally or at a directory service. I'm still working through in my head whether the group can be directory based also -- but I think so.
I bet I'm going to get a lot of debate on that statement! Anyone care to make a small and friendly wager?
 |
|
| Back to top |
|
|
| PeterPotkay |
| Posted: Thu May 22, 2014 5:06 pm Post subject: |
|
|
Poobah
Joined: 15 May 2001
Posts: 7716
|
| SAFraser wrote: |
I think (haven't had time to test it, but I want to) that MQ will install on Linux so long as it can find the mqm user wherever -- either locally or at a directory service. I'm still working through in my head whether the group can be directory based also -- but I think so.
|
It will install on Linux even if it can't find it.
http://pic.dhe.ibm.com/infocenter/wmqv7/v7r5/topic/com.ibm.mq.ins.doc/q008500_.htm
| Quote: |
Linux
RPM creates the mqm user ID and group ID as part of the installation procedure if they do not exist.
|
_________________
Peter Potkay
Keep Calm and MQ On
Last edited by PeterPotkay on Fri May 23, 2014 2:57 am; edited 2 times in total |
|
| Back to top |
|
|
| tczielke |
| Posted: Thu May 22, 2014 6:32 pm Post subject: |
|
|
Guardian
Joined: 08 Jul 2010
Posts: 939
Location: Illinois, USA
|
| SAFraser wrote: |
| We have it (in writing!) that IBM does not care whether mqm is a local or directory service account. MQ is ignorant of the location. Either type account is supported by IBM. |
That would not surprise me. Based on the Unix systems programming code that I have done to query things like ids and groups, the functions are agnostic to whether the ids and groups reside locally on the server, or remotely like with LDAP. If the MQ code is doing something similar, it would not know or care where the mqm id and group exists (locally or remotely), just as long as they do exist.
| SAFraser wrote: |
Anyone care to make a small and friendly wager?
|
That sounds like a sucker's bet to me.  |
|
| Back to top |
|
|
| SAFraser |
| Posted: Fri May 23, 2014 6:16 am Post subject: |
|
|
Shaman
Joined: 22 Oct 2003
Posts: 742
Location: Austin, Texas, USA
|
Pretty much everyone on my team thinks I'll lose the bet.
If only I can find time to test it....... drat.
A challenge at our site is that we use Active Directory. I don't know if we can create a Domain user and a Domain group of the same name (mqm). Certainly that cannot be done locally in Windows. |
|
| Back to top |
|
|
| fjb_saper |
| Posted: Fri May 23, 2014 7:20 am Post subject: |
|
|
Grand High Poobah
Joined: 18 Nov 2003
Posts: 20700
Location: LI,NY
|
| SAFraser wrote: |
Pretty much everyone on my team thinks I'll lose the bet.
If only I can find time to test it....... drat.
A challenge at our site is that we use Active Directory. I don't know if we can create a Domain user and a Domain group of the same name (mqm). Certainly that cannot be done locally in Windows. |
The default domain group is "Domain mqm". As to the users your guess is as good as mine. Remember if on Windows to have the security stanza enabling domain group search so you don't have to qualify the group name with the domain every time.
Also remember to have users/groups with less than 12 chars in the user name... 
_________________
MQ & Broker admin |
|
| Back to top |
|
|
|
|
