| Author |
Message
|
| scott9 |
 Posted: Thu Jul 17, 2003 4:15 pm Post subject: Basic: How to set global MQ authority for all queues |
 |
|
Acolyte
Joined: 11 Jul 2002
Posts: 62
Location: Sacramento,CA
|
Is there a way to grant global authority for all queues to a particular group? The doc indicates that authority must be granted for each object individually, but I want to give a particular group authority to get & put messages to all queues. I want this group to have the same authority for any new queues that are built in the future, without having to reissue the setmqaut command.
Example: setmqaut -m QMGR -n QL* -t q grp +all
This command doesn't give the 'grp' group permission to get messages from the queue: QL.TEST.QUEUE.
Thanks in advance. |
|
| Back to top |
|
 |
| mqonnet |
| Posted: Thu Jul 17, 2003 5:59 pm Post subject: |
|
|
Grand Master
Joined: 18 Feb 2002
Posts: 1114
Location: Boston, Ma, Usa.
|
I dont think setmqaut takes wild cards. But i believe dspmqaut does.
Cheers
Kumar |
|
| Back to top |
|
|
| mrlinux |
| Posted: Thu Jul 17, 2003 6:36 pm Post subject: |
|
|
Grand Master
Joined: 14 Feb 2002
Posts: 1261
Location: Detroit,MI USA
|
Websphere MQ v5.3 supports wildcards with the setmqaut
_________________
Jeff
IBM Certified Developer MQSeries
IBM Certified Specialist MQSeries
IBM Certified Solutions Expert MQSeries |
|
| Back to top |
|
|
| scott9 |
| Posted: Fri Jul 18, 2003 10:57 am Post subject: |
|
|
Acolyte
Joined: 11 Jul 2002
Posts: 62
Location: Sacramento,CA
|
Sorry that I didn't mention this earlier. I'm using WMQ 5.3 CSD04 on AIX.
Example: setmqaut -m QMGR -n QL* -t q grp +all
If WMQ 5.3 setmqaut supports wildcards, I would expect the command above to allow all rights to any queue that begins with QL*. Is there something wrong with the syntax of my command? Thanks in advance. |
|
| Back to top |
|
|
| mrlinux |
| Posted: Fri Jul 18, 2003 11:45 am Post subject: |
|
|
Grand Master
Joined: 14 Feb 2002
Posts: 1261
Location: Detroit,MI USA
|
Does it come back and say successfully completed and
also you may have to do
echo "refresh security" | runmqsc QMGR_NAME
_________________
Jeff
IBM Certified Developer MQSeries
IBM Certified Specialist MQSeries
IBM Certified Solutions Expert MQSeries |
|
| Back to top |
|
|
| mqonnet |
| Posted: Fri Jul 18, 2003 1:22 pm Post subject: |
|
|
Grand Master
Joined: 18 Feb 2002
Posts: 1114
Location: Boston, Ma, Usa.
|
Think, something that we all missed out...
Example from the book.
setmqaut -m saturn.queue.manager -n orange.queue -t queue
-g foxy -allmqi +alladm
setmqaut -m QMGR -n QL* -t q grp +all
you were trying to set attributes group wide, but did not include the "-g" command line argument to specify your group name.
By the way, is "grp" your group name. In the example from the book, foxy is the group the authorizations are being set for.
Cheers
Kumar |
|
| Back to top |
|
|
| scott9 |
| Posted: Fri Jul 18, 2003 1:23 pm Post subject: |
|
|
Acolyte
Joined: 11 Jul 2002
Posts: 62
Location: Sacramento,CA
|
It does return "The setmqaut command completed successfully"
It also returns the authorizations (get, browse...clr) when I run dspmqaut
dspmqaut -m QMGR -n QL* -t q -g grp
I refreshed the security cache and it replies that the WMQ security cache was refreshed; however, it doesn't help. I continue to receive AMQ8135 and 2035 when I attempt to browse the queue QL.TEST.QUEUE. I logged off, then back on just for kicks and that didn't help either.
I should also mention that I'm using both runmqsc and 'q' (a freeware queue management program) to attempt the access. It works fine when I fully qualify QL.TEST.QUEUE in the setmqaut command. |
|
| Back to top |
|
|
| scott9 |
| Posted: Fri Jul 18, 2003 1:27 pm Post subject: |
|
|
Acolyte
Joined: 11 Jul 2002
Posts: 62
Location: Sacramento,CA
|
Reply to Kumar:
I went back in history for the command and I typed it correctly on the system. I just left the '-g' out in this post. Just for fun, I removed '-g' from the command and it complains about syntax. |
|
| Back to top |
|
|
| Prahasith |
| Posted: Fri Jul 18, 2003 4:14 pm Post subject: |
|
|
Disciple
Joined: 16 May 2003
Posts: 184
Location: Kansas City
|
| Instead You can write a perl script or shell script to do the work you intend to. Pass the queue manager name and group name as parameters to the script you write. This would make your job easy. |
|
| Back to top |
|
|
| interactivechannel |
| Posted: Mon Jul 21, 2003 12:46 am Post subject: |
|
|
Voyager
Joined: 20 May 2003
Posts: 94
Location: uk
|
| I'm not convinced the profile authorisations work uniformly across all platforms yet, so its worth trying QL**. Also, use the utility amqoamd to dump the messages from the authorisation queue and check what has been set. |
|
| Back to top |
|
|
| romudd |
| Posted: Tue Sep 16, 2003 6:56 am Post subject: |
|
|
Apprentice
Joined: 12 Aug 2003
Posts: 31
Location: Sao Paulo - Brazil
|
It's a long time since this discussion has ended, you've probably solved your problem. But maybe it helps whoever visits the topic in the future. There is nothing saying that in the documentation, It's just something that I could observe when I had this kind of problem (little bit of guess, so anybody feel free to tell if it is a misinformation)
If you use wildcards with the setmqaut comand, they will not match "dots". For example, QL* will match QLTEST but not QL.TEST, QL.* will match QL.TEST but not QL.TEST.QUEUE, QL.*.* will match QL.TEST.QUEUE but will match none of the others, and so on.
Atenciosamente,
Rodrigo |
|
| Back to top |
|
|
| interactivechannel |
| Posted: Tue Sep 16, 2003 7:34 am Post subject: |
|
|
Voyager
Joined: 20 May 2003
Posts: 94
Location: uk
|
I've played with this a bit more and found, probably as described in the manual, that QL.TEST.QUEUE can be represented by the following:
QL.*.*
QL.**
Q?.**
Q*.** |
|
| Back to top |
|
|
| PeterPotkay |
| Posted: Tue Mar 09, 2004 1:13 pm Post subject: |
|
|
Poobah
Joined: 15 May 2001
Posts: 7722
|
I want to run just one setmqaut command so it works for all queues with the following names:
ABC
ABCMYQUEUENAME
ABC.MYQUEUENAME
ABC.MY.QUEUENAME
ABC.MY.QUEUE.NAME
Anyway to do this?
(ABC** does not do it.)
_________________
Peter Potkay
Keep Calm and MQ On |
|
| Back to top |
|
|
| PeterPotkay |
| Posted: Tue Mar 09, 2004 1:46 pm Post subject: |
|
|
Poobah
Joined: 15 May 2001
Posts: 7722
|
Actually, to further the question, is there one setmqaut command that you could run that would give +inq authority to all the queues on a Queue Manager?
_________________
Peter Potkay
Keep Calm and MQ On |
|
| Back to top |
|
|
| vennela |
| Posted: Tue Mar 09, 2004 1:51 pm Post subject: |
|
|
Jedi Knight
Joined: 11 Aug 2002
Posts: 4055
Location: Hyderabad, India
|
| If you are on 5.3 you can use dmpmqaut I guess. |
|
| Back to top |
|
|
|
|
