| |
|
RSS Feed - WebSphere MQ Support
|
RSS Feed - Message Broker Support
|
  |
|
| Inquire Authority Events - 2035 |
« View previous topic :: View next topic » |
| Author |
Message
|
| rickwatsonb |
 Posted: Wed Mar 30, 2011 11:13 am Post subject: Inquire Authority Events - 2035 |
 |
|
Voyager
Joined: 15 Aug 2006
Posts: 87
Location: USA: Mid-West
|
Hi,
I am testing new OAM authorities in experimental on UNIX with MQ V6.0.2.6. The JMS application runs on WAS in client mode on a separate UNIX box.
I have enabled AUTHOREV and installed MH05 / MS0B to read the queue manager EVENT queue. The event queue shows two events with ReasonCode: 2035 pertaining to Command: 13 (MQCMD_INQUIRE_Q). The full text is shown below along with a dump of the authorities.
I used T.Rob Wyatt’s white paper for MQI channels as a go-by and, to my knowledge, inquiry has been added where it is allowed.
The event queue does not give specific details and I did not see an option for the xmqdspev command that would give more detail.
(1) What can I do to capture the necessary detail and find out what needs inquire authority?
(2) Any suggestions on the authorities granted (JMS application, connect via client mode, MCAUSER appgrp)?
Thank you
setmqaut -m QMGR.TEST -n SYSTEM.** -t queue -g appgrp +browse +inq +dsp
setmqaut -m QMGR.TEST -n ** -t namelist -g appgrp +inq +dsp
setmqaut -m QMGR.TEST -n ** -t process -g appgrp +inq +dsp
setmqaut -m QMGR.TEST -n ** -t authinfo -g appgrp +inq +dsp
setmqaut -m QMGR.TEST -n ** -t service -g appgrp +dsp
setmqaut -m QMGR.TEST -n ** -t clntconn -g appgrp +dsp
setmqaut -m QMGR.TEST -n SYSTEM.DEAD.LETTER.QUEUE -t queue -g appgrp +browse +inq +put +dsp
setmqaut -m QMGR.TEST -t qmgr -g appgrp +connect +inq +dsp
setmqaut -m QMGR.TEST -n ** -t channel -g appgrp +dsp
setmqaut -m QMGR.TEST -n ** -t queue -g appgrp +browse +get +inq +put +dsp
setmqaut -m QMGR.TEST -n ** -t listener -g appgrp +dsp
setmqaut -m QMGR.TEST -n SYSTEM.MQEXPLORER.REPLY.MODEL -t queue -g appgrp +browse +get +inq +passall +passid +put +set +setall +setid +dsp
setmqaut -m QMGR.TEST -n SYSTEM.DEFAULT.MODEL.QUEUE -t queue -g appgrp +browse +get +inq +passall +passid +put +set +setall +setid +dsp
setmqaut -m QMGR.TEST -n SYSTEM.ADMIN.COMMAND.QUEUE -t queue -g appgrp +inq +put +dsp
./xmqdspev.sh -m QMGR.TEST -q SYSTEM.ADMIN.QMGR.EVENT
-------------------------------------------------------[03/30/2011-11:30:07]----
ReasonCode: 2035
EventName: Not Authorized Type 4 - MQRC_NOT_AUTHORIZED (2035, X'7F3')
Description: Indicates that a command has been issued from a user ID that
is not authorized to access the object specified in the command.
QMgrName: QMGR.TEST
ReasonQualifier: 4 (MQRQ_CMD_NOT_AUTHORIZED)
Command: 13 (MQCMD_INQUIRE_Q)
UserIdentifier: app_user
-------------------------------------------------------[03/30/2011-11:35:02]----
ReasonCode: 2035
EventName: Not Authorized Type 4 - MQRC_NOT_AUTHORIZED (2035, X'7F3')
Description: Indicates that a command has been issued from a user ID that
is not authorized to access the object specified in the command.
QMgrName: QMGR.TEST
ReasonQualifier: 4 (MQRQ_CMD_NOT_AUTHORIZED)
Command: 13 (MQCMD_INQUIRE_Q)
UserIdentifier: app_user |
|
| Back to top |
|
 |
| Toronto_MQ |
| Posted: Wed Mar 30, 2011 11:18 am Post subject: |
|
|
Master
Joined: 10 Jul 2002
Posts: 263
Location: read my name
|
|
| Back to top |
|
|
| rickwatsonb |
| Posted: Wed Mar 30, 2011 11:40 am Post subject: |
|
|
Voyager
Joined: 15 Aug 2006
Posts: 87
Location: USA: Mid-West
|
Thank you Toronto_MQ!
Our plan was to apply OAM authorities and then upgrade to 7.0.x. Due to the inquiry events, it looks like the better plan is to upgrade and then apply OAM. This would verify that the authority events pertain to the information in the link you provided, or something else.
Thanks for your help. |
|
| Back to top |
|
|
| rickwatsonb |
| Posted: Wed Mar 30, 2011 12:08 pm Post subject: |
|
|
Voyager
Joined: 15 Aug 2006
Posts: 87
Location: USA: Mid-West
|
Sorry, I just recalled that we have 6.0.2.10 on EXP since we were previously running a test against WAS.
ede001:/opt/IBM/var/mqm>dspmqver
Name: WebSphere MQ
Version: 6.0.2.10
CMVC level: p600-210-100825
BuildType: IKAP - (Production)
So, my original problem/question still stands.
Any other ideas? |
|
| Back to top |
|
|
| fjb_saper |
| Posted: Wed Mar 30, 2011 6:43 pm Post subject: |
|
|
Grand High Poobah
Joined: 18 Nov 2003
Posts: 20696
Location: LI,NY
|
Remember that if you do use JMS, all calls done from JMS need to have inq on top of which ever other authority they need.
So if you need +get +browse +disp if using JMS you will need +get +browse +disp +inq.
Have fun 
_________________
MQ & Broker admin |
|
| Back to top |
|
|
|
|
|
| |
|
Page 1 of 1 |
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
|
|
|
