| |
|
RSS Feed - WebSphere MQ Support
|
RSS Feed - Message Broker Support
|
  |
|
| Domain group name |
« View previous topic :: View next topic » |
| Author |
Message
|
| murdeep |
 Posted: Thu Feb 01, 2007 8:17 pm Post subject: Domain group name |
 |
|
Master
Joined: 03 Nov 2004
Posts: 211
|
| My environment is WMB V6 on Windows Server 2003. Does the domain group for mqbrkrs have to be named "Domain mqbrkrs" or can I have any named domain group as long as it is in the local mqbrkrs group? |
|
| Back to top |
|
 |
| jefflowrey |
| Posted: Thu Feb 01, 2007 9:00 pm Post subject: |
|
|
Grand Poobah
Joined: 16 Oct 2002
Posts: 19981
|
mqbrkrs, in v6, is only used for permissions to execute runtime commands.
The v6 configmgr doesn't care about any specific, predefined groups for any permissions. It only cares about what it has been told to care about, using mqsicreateaclentry.
The only user that has any authorities at all, immediately after creating a configmgr, is the configmgr service user.
_________________
I am *not* the model of the modern major general. |
|
| Back to top |
|
|
| murdeep |
| Posted: Thu Feb 01, 2007 9:18 pm Post subject: |
|
|
Master
Joined: 03 Nov 2004
Posts: 211
|
| Jeff, I understand that V6 security has changed. I'm looking at the doc and it refers to the domain mqbrkrs group as "Domain mqbrkrs". At my site that name would be non standard. So I am wondering if I can create a domain group to our naming standard and add it to the local mqbrkrs group. I then plan on adding users to the domain group and creating an acl for the local mqbrkrs group. That way I can minimize the acls I need. |
|
| Back to top |
|
|
| jefflowrey |
| Posted: Fri Feb 02, 2007 2:52 am Post subject: |
|
|
Grand Poobah
Joined: 16 Oct 2002
Posts: 19981
|
Okay. I haven't actually set up a Windows v6 broker, so I'm having to review the documentation (not a bad thing).
mqbrkrs group is only required for broker service users. That is, for the user actually running a broker process.
If you define the broker service users as local users on the machine, then you do not need a group "Domain mqbrkrs". Everything is done with the local mqbrkrs group.
If you need the broker service users to be Domain users, then you will need the domain group, and as has been true with broker since 2.1 at least, it will need to be "Domain mqbrkrs", case sensitive and all that. That group will also need to be a member of the local mqbrkrs on each machine.
For all other kinds of users other than the broker service user, the mqbrkrs group is not used. Broker operators need to be local administrators, and everyone else needs configmgr ACLs.
http://publib.boulder.ibm.com/infocenter/wmbhelp/v6r0m0/index.jsp?topic=/com.ibm.etools.mft.doc/ap03982_.htm
_________________
I am *not* the model of the modern major general. |
|
| Back to top |
|
|
|
|
|
| |
|
Page 1 of 1 |
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
|
|
|
