ASG
IBM
Zystems
Cressida
Icon
Netflexity
 
  MQSeries.net
Search  Search       Tech Exchange      Education      Certifications      Library      Info Center      SupportPacs      LinkedIn  Search  Search                                                                   FAQ  FAQ   Usergroups  Usergroups
 
Register  ::  Log in Log in to check your private messages
 
RSS Feed - WebSphere MQ Support RSS Feed - Message Broker Support

MQSeries.net Forum IndexGeneral IBM MQ SupportNeed insight - setmqaut large number of userids

Post new topicReply to topic
Need insight - setmqaut large number of userids View previous topic :: View next topic
Author Message
pcelari
PostPosted: Fri Sep 04, 2020 5:48 am Post subject: Need insight - setmqaut large number of userids Reply with quote

Partisan

Joined: 31 Mar 2006
Posts: 378
Location: New York

Greetings...

I recently encountered a client with a qmgr serving hundreds of customers via MQClient. Right now, the client assigns a unique local non-login id to each customer, is setmqaut'ed to a set of queues for one customer. Since managing 300 userids isn't a pretty picture, they want to do it differently after a planned migration.

My idea is, since all their customers access the same set of server applications, internally a single userid should be acceptable, given source IP is used in chlauth to map to a local userid, there really isn't a solid need for one set of ACL entry for each of their 300+ customers. Of course, in theory, such arrangement means one of their customers would be able to put messages to queues for others. But unless we publish the queue names, it's highly unlikely to happen.

My question is: does my idea contradict grossly common good practices?
If it is a bad idea, is there a better way than maintaining 300+ userids on a MQ server?
_________________
pcelari
-----------------------------------------
- a master of always being a newbie
Back to top
View user's profile Send private message
bruce2359
PostPosted: Fri Sep 04, 2020 6:24 am Post subject: Reply with quote

Poobah

Joined: 05 Jan 2008
Posts: 8769
Location: US: west coast, almost. Otherwise, enroute.

Youre describing a group of users needing access to the same resources. ACLs and setmqaut can grant to principle and group.
_________________
My life flows on in endless song;
How can I keep from singing?
Back to top
View user's profile Send private message
exerk
PostPosted: Fri Sep 04, 2020 8:22 am Post subject: Re: Need insight - setmqaut large number of userids Reply with quote

Jedi Council

Joined: 02 Nov 2006
Posts: 6191

pcelari wrote:
...Of course, in theory, such arrangement means one of their customers would be able to put messages to queues for others. But unless we publish the queue names, it's highly unlikely to happen...

Unless they can enumerate the queues...
_________________
It's puzzling, I don't think I've ever seen anything quite like this before...and it's hard to soar like an eagle when you're surrounded by turkeys.

Back to top
View user's profile Send private message
pcelari
PostPosted: Fri Sep 04, 2020 12:04 pm Post subject: Reply with quote

Partisan

Joined: 31 Mar 2006
Posts: 378
Location: New York

thanks for the input. So it seems my solution is reasonable enough....
_________________
pcelari
-----------------------------------------
- a master of always being a newbie
Back to top
View user's profile Send private message
Display posts from previous:
Post new topicReply to topic Page 1 of 1

MQSeries.net Forum IndexGeneral IBM MQ SupportNeed insight - setmqaut large number of userids
Jump to:



You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
Protected by Anti-Spam ACP


Theme by Dustin Baccetti
Powered by phpBB 2001, 2002 phpBB Group

Copyright MQSeries.net. All rights reserved.