ASG
IBM
Zystems
Cressida
Icon
Netflexity
 
  MQSeries.net
Search  Search       Tech Exchange      Education      Certifications      Library      Info Center      SupportPacs      LinkedIn  Search  Search                                                                   FAQ  FAQ   Usergroups  Usergroups
 
Register  ::  Log in Log in to check your private messages
 
RSS Feed - WebSphere MQ Support RSS Feed - Message Broker Support

MQSeries.net Forum Index » General IBM MQ Support » Need insight - setmqaut large number of userids

Post new topic  Reply to topic
 Need insight - setmqaut large number of userids « View previous topic :: View next topic » 
Author Message
pcelari
PostPosted: Fri Sep 04, 2020 5:48 am    Post subject: Need insight - setmqaut large number of userids Reply with quote

Chevalier

Joined: 31 Mar 2006
Posts: 411
Location: New York

Greetings...

I recently encountered a client with a qmgr serving hundreds of customers via MQClient. Right now, the client assigns a unique local non-login id to each customer, is setmqaut'ed to a set of queues for one customer. Since managing 300 userids isn't a pretty picture, they want to do it differently after a planned migration.

My idea is, since all their customers access the same set of server applications, internally a single userid should be acceptable, given source IP is used in chlauth to map to a local userid, there really isn't a solid need for one set of ACL entry for each of their 300+ customers. Of course, in theory, such arrangement means one of their customers would be able to put messages to queues for others. But unless we publish the queue names, it's highly unlikely to happen.

My question is: does my idea contradict grossly common good practices?
If it is a bad idea, is there a better way than maintaining 300+ userids on a MQ server?
_________________
pcelari
-----------------------------------------
- a master of always being a newbie
Back to top
View user's profile Send private message
bruce2359
PostPosted: Fri Sep 04, 2020 6:24 am    Post subject: Reply with quote

Poobah

Joined: 05 Jan 2008
Posts: 9394
Location: US: west coast, almost. Otherwise, enroute.

You’re describing a ‘group’ of users needing access to the same resources. ACLs and setmqaut can grant to principle and group.
_________________
I like deadlines. I like to wave as they pass by.
ב''ה
Lex Orandi, Lex Credendi, Lex Vivendi. As we Worship, So we Believe, So we Live.
Back to top
View user's profile Send private message
exerk
PostPosted: Fri Sep 04, 2020 8:22 am    Post subject: Re: Need insight - setmqaut large number of userids Reply with quote

Jedi Council

Joined: 02 Nov 2006
Posts: 6339

pcelari wrote:
...Of course, in theory, such arrangement means one of their customers would be able to put messages to queues for others. But unless we publish the queue names, it's highly unlikely to happen...

Unless they can enumerate the queues...
_________________
It's puzzling, I don't think I've ever seen anything quite like this before...and it's hard to soar like an eagle when you're surrounded by turkeys.
Back to top
View user's profile Send private message
pcelari
PostPosted: Fri Sep 04, 2020 12:04 pm    Post subject: Reply with quote

Chevalier

Joined: 31 Mar 2006
Posts: 411
Location: New York

thanks for the input. So it seems my solution is reasonable enough....
_________________
pcelari
-----------------------------------------
- a master of always being a newbie
Back to top
View user's profile Send private message
Display posts from previous:   
Post new topic  Reply to topic Page 1 of 1

MQSeries.net Forum Index » General IBM MQ Support » Need insight - setmqaut large number of userids
Jump to:  



You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
Protected by Anti-Spam ACP
 
 


Theme by Dustin Baccetti
Powered by phpBB © 2001, 2002 phpBB Group

Copyright © MQSeries.net. All rights reserved.