| Author |
Message
|
| chrislfxp |
 Posted: Mon Jan 22, 2007 10:39 am Post subject: Setting security so a user can only look at a queue |
 |
|
Newbie
Joined: 22 Jan 2007
Posts: 3
|
We need to have some of our developers monitor the queues on our production server using the M071 tool. I created a specific ID for them to use and I want to lock down the security so they can only read the queue and not put anything in the queues.
I have been using the setmqaut command with various permission changes, but I have not had any success.
Has anyone else been able to restrict an ID to read-only permissions? If you have could you let me know what permissions the user/group has?
Thanks in advance. |
|
| Back to top |
|
 |
| bruce2359 |
| Posted: Mon Jan 22, 2007 12:02 pm Post subject: |
|
|
Guest
|
Yes. Setmqaut works fine for +get -put +browse kinds of permissions. Refer to setmqaut documentation in the System Administration Guide.
Is the username you are testing with in the mq admin? |
|
| Back to top |
|
|
| fjb_saper |
| Posted: Mon Jan 22, 2007 1:48 pm Post subject: |
|
|
Grand High Poobah
Joined: 18 Nov 2003
Posts: 20763
Location: LI,NY
|
And remember on Unix you can forget the userId. It is the group membership that gets set and queried...
Enjoy 
_________________
MQ & Broker admin |
|
| Back to top |
|
|
| chrislfxp |
| Posted: Mon Jan 22, 2007 2:16 pm Post subject: |
|
|
Newbie
Joined: 22 Jan 2007
Posts: 3
|
Hi
This is a windows box. The user is not a member of the MQ admin group.
I ran setmqaut on the box giving the following permissions
for the QM +all +allmqi
for the queues +all
I can can connect via the M071 tool.
If I do a -put to all of the queues I cannot connect
The error I receive on the M071 tool is:
Error opening queue 'QM_QMGRNAME/SYSTEM.DEFAULT.MODEL.QUEUE' RC(2035) Not authorized.
The SYSTEM.DEFAULT.MODEL.QUEUE is a temporary queue. Should I be able to assign permissions to this queue? |
|
| Back to top |
|
|
| chrislfxp |
| Posted: Mon Jan 22, 2007 2:24 pm Post subject: |
|
|
Newbie
Joined: 22 Jan 2007
Posts: 3
|
I had allow put on these two queues
SYSTEM.ADMIN.COMMAND.QUEUE
SYSTEM.DEFAULT.MODEL.QUEUE
I was able to connect with the M071 tool. It appears that I am unable to put any messages in any of the production queues which is what I want. |
|
| Back to top |
|
|
|
|
