| |
|
RSS Feed - WebSphere MQ Support
|
RSS Feed - Message Broker Support
|
  |
|
| WBIMB application database security access |
« View previous topic :: View next topic » |
| Author |
Message
|
| SteveG |
 Posted: Tue Jan 25, 2005 9:41 am Post subject: WBIMB application database security access |
 |
|
Newbie
Joined: 06 Sep 2002
Posts: 6
Location: Seattle
|
As we migrate from WMQI V2.1 to WBIMB V5.0 one of the new features we have an interest in is the ability to isolate access to application databases via the mqsisetdbparms command. Or so I thought.
Under WMQI once a database was set up to be used by a Message Flow, via granting the broker service id access rights in SQL Server, any Message Flow within the broker had access to that database simply by referencing the ODBC DSN in a Compute or Database* node. This presented an issue with applications running in the same broker that should not have each access to each other's databases.
I was thinking the WBIMB would allow us to close this hole. However, if I use the mqsisetdbparms command to create a user id and password pair for a given DSN what would prevent App A from referencing App B's databases if their flows are running in the same broker? The apps do have separately assigned execution groups, and ACL rules that prevent them from seeing each other's execution groups, but the setdbparms command sets the the parms at a broker, not at an execution group level.
Am I missing something? |
|
| Back to top |
|
 |
| JT |
| Posted: Tue Jan 25, 2005 2:39 pm Post subject: |
|
|
Padawan
Joined: 27 Mar 2003
Posts: 1564
Location: Hartford, CT.
|
No, you're not.
| Quote: |
| I was thinking the WBIMB would allow us to close this hole. |
Apparently the scope of the mqsisetdbparms command wasn't as far reaching as you anticipated. It would seem that the intent was to provide a modicum of flexibility, allowing for distinct database ids for each user database, and move away from the single database id for all database access, that id being the broker service id.
| Quote: |
| what would prevent App A from referencing App B's databases if their flows are running in the same broker? |
AFAIK, WBI does not provide a solution for this gap.
However, to ensure this doesn't occur, you could , depending upon your threshold for pain: - Perform a 'code walk-thru'
- Examine the contents of the BAR file, looking for a 'datasource' value that is not authorized for the application.
|
|
| Back to top |
|
|
|
|
|
| |
|
Page 1 of 1 |
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
|
|
|
