IBM MQ Plugin - permissions

[MAkimov]

Hello

I try implement IBM MQ ActiveGate Plugin

I have question about permissions.

In doc says that the user must have at least the following permissions: connect,display,browse,put,inquire

For what objects do you need to give these permissions?

Must we have permissions of for each queue ?

[diego_morales · Accepted solution]

Hi Mikhail,

The user needs those permissions for queues, channels, listener and queue managers.

I don't believe you need to specify it for each individual queue. You can apply it to all queues of the queue manager using wildcards.

You need these permissions because the plugin runs these PCF commands:
MQCMD_INQUIRE_Q_MGR_STATUS
MQCMD_INQUIRE_Q_NAMES
MQCMD_INQUIRE_Q
MQCMD_INQUIRE_Q_STATUS
MQCMD_INQUIRE_CHANNEL_STATUS
MQCMD_INQUIRE_LISTENER_STATUS
MQCMD_RESET_Q_STATS (if you collect Enqueue and Dequeue counts, you will also need the CHG permission on queues)

+put is required because it puts messages in command and audit queues when running those PCF commands.

Thanks,

Diego

[MAkimov]

Hello @Diego M.

Could you please tell us for which commands and queues we should give put permission to the plugin ?

That's right I understand that's enough SYSTEM.ADMIN.COMMAND.QUEUE

[MAkimov]

Hello @Diego M.

The security service of the Bank asks what permissions are required for the plugin. They cannot allow put permissions for all queues (there are several hundred of them)

[diego_morales]

Hi Mikhail,

You're correct, the SYSTEM.ADMIN.COMMAND.QUEUE needs put permission and also the SYSTEM audit queues.

According to IBM:
https://www.ibm.com/support/knowledgecenter/en/SSFKSJ_9.0.0/com.ibm.mq.adm.doc/q020060_.htm

You need:

+dsp permissions to all objects (queue manager, queues, channels, listeners, namelists)
+put permissions to the queues I mentioned above.
+chg to queues you want to get enqueue/dequeue rate.
+ctrl if you want to ping a queue manager to get whether it is responsive.
+connect

With the above, make sure you can connect, inquire all objects.

Hope this helps,

Thanks,

Diego