| |
|
RSS Feed - WebSphere MQ Support
|
RSS Feed - Message Broker Support
|
  |
|
| Need insight - setmqaut large number of userids |
« View previous topic :: View next topic » |
| Author |
Message
|
| pcelari |
 Posted: Fri Sep 04, 2020 5:48 am Post subject: Need insight - setmqaut large number of userids |
 |
|
Chevalier
Joined: 31 Mar 2006
Posts: 411
Location: New York
|
Greetings...
I recently encountered a client with a qmgr serving hundreds of customers via MQClient. Right now, the client assigns a unique local non-login id to each customer, is setmqaut'ed to a set of queues for one customer. Since managing 300 userids isn't a pretty picture, they want to do it differently after a planned migration.
My idea is, since all their customers access the same set of server applications, internally a single userid should be acceptable, given source IP is used in chlauth to map to a local userid, there really isn't a solid need for one set of ACL entry for each of their 300+ customers. Of course, in theory, such arrangement means one of their customers would be able to put messages to queues for others. But unless we publish the queue names, it's highly unlikely to happen.
My question is: does my idea contradict grossly common good practices?
If it is a bad idea, is there a better way than maintaining 300+ userids on a MQ server?
_________________
pcelari
-----------------------------------------
- a master of always being a newbie |
|
| Back to top |
|
 |
| bruce2359 |
| Posted: Fri Sep 04, 2020 6:24 am Post subject: |
|
|
Poobah
Joined: 05 Jan 2008
Posts: 9469
Location: US: west coast, almost. Otherwise, enroute.
|
You’re describing a ‘group’ of users needing access to the same resources. ACLs and setmqaut can grant to principle and group.
_________________
I like deadlines. I like to wave as they pass by.
ב''ה
Lex Orandi, Lex Credendi, Lex Vivendi. As we Worship, So we Believe, So we Live. |
|
| Back to top |
|
|
| exerk |
| Posted: Fri Sep 04, 2020 8:22 am Post subject: Re: Need insight - setmqaut large number of userids |
|
|
Jedi Council
Joined: 02 Nov 2006
Posts: 6339
|
| pcelari wrote: |
| ...Of course, in theory, such arrangement means one of their customers would be able to put messages to queues for others. But unless we publish the queue names, it's highly unlikely to happen... |
Unless they can enumerate the queues... 
_________________
It's puzzling, I don't think I've ever seen anything quite like this before...and it's hard to soar like an eagle when you're surrounded by turkeys. |
|
| Back to top |
|
|
| pcelari |
| Posted: Fri Sep 04, 2020 12:04 pm Post subject: |
|
|
Chevalier
Joined: 31 Mar 2006
Posts: 411
Location: New York
|
thanks for the input. So it seems my solution is reasonable enough....
_________________
pcelari
-----------------------------------------
- a master of always being a newbie |
|
| Back to top |
|
|
|
|
|
| |
|
Page 1 of 1 |
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
|
|
|
