MQSeries.net :: View topic - Create Authorization Files in MQSeries 5.2

pzaman · Posted: Tue Mar 05, 2002 10:18 am Post subject:

The Security model of MQSeries 5.2 has changed from that of 5.1. Earlier the authorizations were stored in files in various subfolders under the following directory /var/mqm/qmgrs/<Q MANAGER NAME>/auth/

In version 5.2 the authorizations are stored in a queue called SYSTEM.AUTH.DATA.QUEUE. So the earlier scripts, extracting autorizations from the file structure and writing them to files as rows of setmqaut command, do not work any more.

As a work around, I have created this Unix shell script (store_mq_auth) that does this function without having to read authorization messages from SYSTEM.AUTH.DATA.QUEUE. The store_mq_auth has to be called from another shell script (MQ_Auth). I am giving the code for the two scripts. Hope it is of help to those who migrate to MQ Series 5.2 The executables have to run by a person logged in as mqm.

MQ_Auth:

#!/usr/bin/ksh
#
# Script to save queue managers' authorization files
#
# Usage: MQ_Auth <queue manager name>
#
# Perween Zaman March 2002
#######################################################################

QMGR=$1

DATE=`date '+%Y%m%d'`
MY_AUTH_QMGR=/home/mqm/codes/store_mq_auth

if [ -z $QMGR ]; then
echo "Usage $0 <queue manager name>"
exit 1
fi

SAVEDIR=/var/mqm/auth_files
MY_AUTH_FILE=$SAVEDIR/MQ_Auth.$QMGR.authorization.$DATE

find $SAVEDIR -name "MQ_Auth.$QMGR*" -mtime +60 -exec rm {} ;

$MY_AUTH_QMGR $QMGR > $MY_AUTH_FILE

----------------------------------------------------------------------

store_mq_auth:

#!/usr/bin/ksh
#
# Script to save queue managers' authorization files
#
# Usage: store_mq_auth <queue manager name>
#
# Perween Zaman March 2002
###############################################

qmgr_name=$1

## object type qmgr
for group in `cat /etc/group| cut -d: -f1|sort`
do
auth=`dspmqaut -m $qmgr_name -t qmgr -g $group|cut -d":" -f2`
if [[ -n $auth ]]; then
myauth=""
for pz in $auth
do
prev=$myauth
temp="+$pz"
myauth="$prev $temp"
done
command="setmqaut -m $qmgr_name -t qmgr -g $group -all $myauth"
else
command=""
fi
if [[ -n $command ]]; then
print $command
fi
done
print ""
## object type process
command="setmqaut -m $qmgr_name -t process -n SYSTEM.DEFAULT.PROCESS -g mqm +crt +all"
print $command
print ""

## object type queue
for object in `echo 'DISPLAY QUEUE(*)' | runmqsc $qmgr_name | grep "QUEUE("|cut -d")" -f1| cut -d"*" -f2|cut -d"(" -f2 | sort`
do
for group in `cat /etc/group| cut -d: -f1 | sort`
do

auth=`dspmqaut -m $qmgr_name -t queue -n $object -g $group|cut -d":" -f2`
if [[ -n $auth ]]; then
myauth=""
for pz in $auth
do
prev=$myauth
temp="+$pz"
myauth="$prev $temp"
done
#print MyAuth is:$myauth
command="setmqaut -m $qmgr_name -t queue -n $object -g $group -all $myauth"
else
command=""
myauth=""
fi
if [[ -n $command ]]; then
print $command
fi
done
done
_____________
Perween Zaman

[ This Message was edited by: pzaman on 2002-03-05 10:27 ]