Home
Authority to administer WebSphere MQ
WebSphere MQ administrators have authority to use all WebSphere MQ commands (including the commands to grant WebSphere MQ authorities for other users)
To be a WebSphere MQ administrator, be a member of a special group called the mqm group (or a member of the Administrators group on Windows systems; see below). The mqm group is created automatically when WebSphere MQ is installed; add further users to the group to allow them to perform administration (including the root user on UNIX systems). All members of this group have access to all resources. This access can be revoked only by removing a user from the mqm group.
On UNIX platforms, a special user ID of mqm is also created, for use by the product only. It must never be available to non-privileged users. All WebSphere MQ objects are owned by user ID mqm.
On Windows systems, members of the Administrators group can also administer any queue manager. We can also create a domain mqm group on the domain controller that contains all privileged user IDs active within the domain, and add it to the local mqm group. Some commands, for example crtmqm, manipulate authorities on WebSphere MQ objects and so need authority to work with these objects (as described below). Members of the mqm group have authority to work with all objects, but there might be circumstances on Windows systems when authority is denied if you have a local user and a domain-authenticated user with the same name. This is described in Principals and groups.
You do not need to be a member of the mqm group to do the following:
- Issue commands from an application program that issues PCF commands, or MQSC commands within an Escape PCF command, unless the commands manipulate channel initiators. (These commands are described in Protecting channel initiator definitions).
- Issue MQI calls from an application program (unless you want to use the fastpath bindings on the MQCONNX call).
- Use the crtmqcvx command to create a fragment of code that performs data conversion on data type structures.
- Use the dspmq command to display queue managers.
- Use the dspmqtrc command to display WebSphere MQ formatted trace output.
Parent topic:
WebSphere MQ security
fa12740_
Home