Home

 

Authorization to use the WebSphere MQ Explorer

 

Any user can use the WebSphere MQ Explorer, however certain authorities are required to connect, access, and manage queue managers.

To perform local administrative tasks using the WebSphere MQ Explorer, a user is required to have the necessary authority to perform the administrative tasks. If the user is a member of the mqm group, the user has authority to perform all local administrative tasks.

To connect to a remote queue manager and perform remote administrative tasks using the WebSphere MQ Explorer, the user executing the WebSphere MQ Explorer is required to have the following authorities:

• CONNECT authority on the target queue manager object

• INQUIRE authority on the target queue manager object

• DISPLAY authority to the target queue manager object

• INQUIRE authority to the queue, SYSTEM.MQEXPLORER.REPLY.MODEL

• DISPLAY authority to the queue, SYSTEM.MQEXPLORER.REPLY.MODEL

• INPUT authority to the queue, SYSTEM.MQEXPLORER.REPLY.MODEL

• OUTPUT authority to the queue, SYSTEM.ADMIN.COMMAND.QUEUE

• Authority to perform the action selected

To connect to a remote queue manager on WebSphere MQ for z/OS and perform remote administrative tasks using the WebSphere MQ Explorer, the following must be provided:

• A RACF profile for the system queue, SYSTEM.MQEXPLORER.REPLY.MODEL

• A RACF profile for the queues, AMQ.MQEXPLORER.*

In addition, the user executing the WebSphere MQ Explorer is required to have the following authorities:

• RACF UPDATE authority to the system queue, SYSTEM.MQEXPLORER.REPLY.MODEL

• RACF UPDATE authority to the queues, AMQ.MQEXPLORER.*

• CONNECT authority on the target queue manager object

• Authority to perform the action selected

• READ authority to all the hlq.DISPLAY.object profiles in the MQCMDS class

For information on how to grant authority to WebSphere MQ objects, see Authority to work with WebSphere MQ objects.

If a user attempts to perform an operation that they are not authorized to perform, the target queue manager invokes authorization failure procedures and the operation fails.

The default filter in the WebSphere MQ Explorer is to display all WebSphere MQ objects. If there are any WebSphere MQ objects that a user does not have DISPLAY authority to, authorization failures are generated. If authority events are being recorded, restrict the range of objects that are displayed to those that the user has DISPLAY authority to.

 

Parent topic:

Security

fa12080_

 

Home