| Author |
Message
|
| sijtom0703 |
 Posted: Mon Nov 26, 2012 2:05 pm Post subject: how to setup domain accounts in WebSphere MQ |
 |
|
Voyager
Joined: 28 May 2011
Posts: 84
Location: USA
|
I have a question on providing User Access for WebSphere MQ 7.5 in Windows for Domain users in an Enterprise. I like to know the best possible way of doing this.
I have a Windows Server 2008 and has an domain administrator user serveradmin@domain which I have configured for the IBM MQSeries service to Log On with this account.
This user is added to the local mqm user group and Administrators Group. I could not find the default MUSR_MQADMIN user in local mqm group after installation. Is there any reason for this?
Again some of the users in Domain need access to QUeue Manager through the MQ Application to put and get messages. These users belong to the WebAdmins@domain group. Hence I have added this group to local mqm group.These users does not need Admin access to Queue Manager and hence I have not added to the local Administrators Group in Windows Server Machine.I believe this configuration will ensure the Application users will not be having Admin access and hence will not be blocked by the default BLOCKUSER Channel Authentication record. |
|
| Back to top |
|
 |
| Vitor |
| Posted: Mon Nov 26, 2012 2:27 pm Post subject: Re: how to setup domain accounts in WebSphere MQ |
|
|
Grand High Poobah
Joined: 11 Nov 2005
Posts: 26093
Location: Texas, USA
|
| sijtom0703 wrote: |
| Again some of the users in Domain need access to QUeue Manager through the MQ Application to put and get messages. These users belong to the WebAdmins@domain group. Hence I have added this group to local mqm group.These users does not need Admin access to Queue Manager and hence I have not added to the local Administrators Group in Windows Server Machine.I believe this configuration will ensure the Application users will not be having Admin access and hence will not be blocked by the default BLOCKUSER Channel Authentication record. |
Admin access to the queue manager is granted through membership of the mqm group, Admin access to Windows is granted through membership of the Administrators group.
Basic, basic stuff.
_________________
Honesty is the best policy.
Insanity is the best defence. |
|
| Back to top |
|
|
| bruce2359 |
| Posted: Mon Nov 26, 2012 2:31 pm Post subject: Re: how to setup domain accounts in WebSphere MQ |
|
|
Poobah
Joined: 05 Jan 2008
Posts: 9469
Location: US: west coast, almost. Otherwise, enroute.
|
| Vitor wrote: |
| sijtom0703 wrote: |
| Again some of the users in Domain need access to QUeue Manager through the MQ Application to put and get messages. These users belong to the WebAdmins@domain group. Hence I have added this group to local mqm group.These users does not need Admin access to Queue Manager and hence I have not added to the local Administrators Group in Windows Server Machine.I believe this configuration will ensure the Application users will not be having Admin access and hence will not be blocked by the default BLOCKUSER Channel Authentication record. |
Admin access to the queue manager is granted through membership of the mqm group, Admin access to Windows is granted through membership of the Administrators group.
Basic, basic stuff. |
End-user (non-admin) application access should NOT be granted through mqm group membership.
_________________
I like deadlines. I like to wave as they pass by.
ב''ה
Lex Orandi, Lex Credendi, Lex Vivendi. As we Worship, So we Believe, So we Live. |
|
| Back to top |
|
|
| Vitor |
| Posted: Mon Nov 26, 2012 2:44 pm Post subject: Re: how to setup domain accounts in WebSphere MQ |
|
|
Grand High Poobah
Joined: 11 Nov 2005
Posts: 26093
Location: Texas, USA
|
| bruce2359 wrote: |
| Vitor wrote: |
| sijtom0703 wrote: |
| Again some of the users in Domain need access to QUeue Manager through the MQ Application to put and get messages. These users belong to the WebAdmins@domain group. Hence I have added this group to local mqm group.These users does not need Admin access to Queue Manager and hence I have not added to the local Administrators Group in Windows Server Machine.I believe this configuration will ensure the Application users will not be having Admin access and hence will not be blocked by the default BLOCKUSER Channel Authentication record. |
Admin access to the queue manager is granted through membership of the mqm group, Admin access to Windows is granted through membership of the Administrators group.
Basic, basic stuff. |
End-user (non-admin) application access should NOT be granted through mqm group membership. |
Exactly my point. Keeping users out of the Administrators group does not eliminate WMQ admin access. That's basic.
_________________
Honesty is the best policy.
Insanity is the best defence. |
|
| Back to top |
|
|
| sijtom0703 |
| Posted: Mon Nov 26, 2012 3:26 pm Post subject: |
|
|
Voyager
Joined: 28 May 2011
Posts: 84
Location: USA
|
Thanks!
I now understand Members of mqm group, members of Administrators group and SYSTEM in Windows all are privileged users in WebSphere MQ who has Admin rights. So I believe to provide a non admin user or Application userid to access MQ I have to explicitly provide with setmqaut commad? right?
Why is the MUSR_MQADMIN id missing in my installation?? |
|
| Back to top |
|
|
| exerk |
| Posted: Tue Nov 27, 2012 2:01 am Post subject: |
|
|
Jedi Council
Joined: 02 Nov 2006
Posts: 6339
|
| sijtom0703 wrote: |
| Why is the MUSR_MQADMIN id missing in my installation?? |
Because when you installed WMQ you elected to run the service under a domain-level user.
_________________
It's puzzling, I don't think I've ever seen anything quite like this before...and it's hard to soar like an eagle when you're surrounded by turkeys. |
|
| Back to top |
|
|
| sijtom0703 |
| Posted: Tue Nov 27, 2012 4:41 pm Post subject: |
|
|
Voyager
Joined: 28 May 2011
Posts: 84
Location: USA
|
Thanks! I got it now.  |
|
| Back to top |
|
|
|
|
