| Author |
Message
|
| veeruk |
 Posted: Thu Apr 13, 2006 11:29 am Post subject: amqoamd - small doubt |
 |
|
Acolyte
Joined: 13 Mar 2006
Posts: 73
|
When used the command
amqoamd -s -m QMgr1 > QMgr1.txt
to save the authorizations, I got the output file with all the authorization defined in it. After re-creating the required objects using saveqmgr SP and before re-creating those authorizations to the new queue manager objects, I should change the queue manager name in the new output file to the new queue manager name, RIGHT? i.e instead of QMgr1 to Qmgr2 (say new queue manager)?
Thank you, |
|
| Back to top |
|
 |
| GMcCarthy |
| Posted: Thu Apr 13, 2006 11:34 am Post subject: |
|
|
Centurion
Joined: 06 Nov 2001
Posts: 113
Location: Melville NY
|
Make sure the outputs from amqoamd and saveqmgr reflect the new definitions...including qmgr.
I've always had problems when I defined the authorizations after the object definitions. ESPECIALLY generic ones.
Try doing the authorizations first. |
|
| Back to top |
|
|
| veeruk |
| Posted: Thu Apr 13, 2006 11:38 am Post subject: |
|
|
Acolyte
Joined: 13 Mar 2006
Posts: 73
|
| But since I’ll be creating the authorizations for the objects that are already in place, how can I authorize when there are no objects (i.e before re-creating the objects in new queue manager)?? |
|
| Back to top |
|
|
| GMcCarthy |
| Posted: Thu Apr 13, 2006 11:50 am Post subject: |
|
|
Centurion
Joined: 06 Nov 2001
Posts: 113
Location: Melville NY
|
Yes...before you create the new objects.
I believe that generic authorizations need to be defined before the objects are created or you would have to authorize each object explicitly. |
|
| Back to top |
|
|
| veeruk |
| Posted: Thu Apr 13, 2006 11:59 am Post subject: |
|
|
Acolyte
Joined: 13 Mar 2006
Posts: 73
|
Can you please be more specific?
Let me explain my scenario:
In production : QMgr1
Need to create a QMgr2 in a diff box.
Say I run the commands on QMgr1:
./saveqmgr.exe –m QMgr1 –f & amqoamd -s -m QMgr1 > QMgr1.txt
I create the new QMgr2 in other box using "crtmqm -ll QMgr2".
Now do you mean to import QMgr1.txt before importing the object definition files? |
|
| Back to top |
|
|
| PeterPotkay |
| Posted: Thu Apr 13, 2006 3:20 pm Post subject: |
|
|
Poobah
Joined: 15 May 2001
Posts: 7722
|
| GMcCarthy wrote: |
| I believe that generic authorizations need to be defined before the objects are created or you would have to authorize each object explicitly. |
Nah, before or after makes no diff.
| Code: |
| setmqaut -m GINA -t q -n peter*.** -p KRAMER +put |
will allow KRAMER put access for any queues that start with peter, whether those queues already exist, or if you create them in the future. We rely on this behaviour heavily and us it all the time.
_________________
Peter Potkay
Keep Calm and MQ On |
|
| Back to top |
|
|
| GMcCarthy |
| Posted: Thu Apr 13, 2006 3:46 pm Post subject: |
|
|
Centurion
Joined: 06 Nov 2001
Posts: 113
Location: Melville NY
|
| We had a problem with this. It had something to do with generic vs explicit. When a queue is created MQ does an explicit setmqaut on behalf of himself. I'll look at my notes to find more info. Thanks! |
|
| Back to top |
|
|
| veeruk |
| Posted: Thu Apr 13, 2006 4:36 pm Post subject: |
|
|
Acolyte
Joined: 13 Mar 2006
Posts: 73
|
| But I should replace the queue manager name from the output file of amqoamd with the new queue manager name right? And then import the file into new queue manager? |
|
| Back to top |
|
|
| GMcCarthy |
| Posted: Thu Apr 13, 2006 4:51 pm Post subject: |
|
|
Centurion
Joined: 06 Nov 2001
Posts: 113
Location: Melville NY
|
| Definately, as well as the output generated from saveqmgr |
|
| Back to top |
|
|
| GMcCarthy |
| Posted: Fri Apr 14, 2006 3:15 am Post subject: |
|
|
Centurion
Joined: 06 Nov 2001
Posts: 113
Location: Melville NY
|
| PeterPotkay wrote: |
| GMcCarthy wrote: |
| I believe that generic authorizations need to be defined before the objects are created or you would have to authorize each object explicitly. |
Nah, before or after makes no diff. |
Peter....
From the SAG
"Using generic profiles in the setmqaut command enables you to set a generic authority for all future objects created that fit that profile"
And since we had issues...I took this to mean that they needed to be defined before the queue(s) that matched that profile were created. |
|
| Back to top |
|
|
| fjb_saper |
| Posted: Fri Apr 14, 2006 3:35 am Post subject: |
|
|
Grand High Poobah
Joined: 18 Nov 2003
Posts: 20756
Location: LI,NY
|
Are you sure you did not have any other problem interfering?
Like Peter I have set the authorizations and it worked on existing as well as future queues. In fact we do build our qmgrs and change the scheme a little between dev and prod. In one instance we forgot to add the authorizations.
At the first attempt in prod we got the call. It took us 3 mins to fix. Just ran the authorizations script we had prepared... (and do not forget to add a refresh security just in case... we have it at the end of the authorization script.)
Enjoy 
_________________
MQ & Broker admin |
|
| Back to top |
|
|
| GMcCarthy |
| Posted: Fri Apr 14, 2006 3:42 am Post subject: |
|
|
Centurion
Joined: 06 Nov 2001
Posts: 113
Location: Melville NY
|
Are they generic?
Since we had the problem (many moons ago), I've always done the generic authorizations first and haven't had issues.
I will play with this.
Thanks!
PS...what do you think IBM means by future then? |
|
| Back to top |
|
|
| PeterPotkay |
| Posted: Fri Apr 14, 2006 4:30 am Post subject: |
|
|
Poobah
Joined: 15 May 2001
Posts: 7722
|
| GMcCarthy wrote: |
| PS...what do you think IBM means by future then? |
 It means just that!!! It does NOT say it will not also apply them to existing objects.
_________________
Peter Potkay
Keep Calm and MQ On |
|
| Back to top |
|
|
| GMcCarthy |
| Posted: Fri Apr 14, 2006 4:35 am Post subject: |
|
|
Centurion
Joined: 06 Nov 2001
Posts: 113
Location: Melville NY
|
Interestingly....IBM changed the wording for the V6 Documentation...
OAM generic profiles enable you to set the authority a user has to many objects at once, rather than having to issue separate setmqaut commands against each individual object when it is created. Using generic profiles in the setmqaut command enables you to set a generic authority for all objects that fit that profile.
Wonder why? |
|
| Back to top |
|
|
|
|
