Queues that require authorization for non-privileged users

 

Non-privileged users need authorization granted to access the queues used by JMS. For details about access control in WebSphere MQ, see the chapter about protecting WebSphere MQ objects in the WebSphere MQ System Administration Guide.

For JMS point-to-point mode, the access control issues are similar to those for the WebSphere MQ classes for Java:

• Queues that are used by QueueSender need put authority.

• Queues that are used by QueueReceivers and QueueBrowsers need get, inq, and browse authorities.

• The QueueSession.createTemporaryQueue method needs access to the model queue that is defined in the QueueConnectionFactory temporaryModel field (by default this is SYSTEM.DEFAULT.MODEL.QUEUE).

For JMS publish/subscribe mode, the following system queues are used:

• SYSTEM.JMS.ADMIN.QUEUE

• SYSTEM.JMS.REPORT.QUEUE

• SYSTEM.JMS.MODEL.QUEUE

• SYSTEM.JMS.PS.STATUS.QUEUE

• SYSTEM.JMS.ND.SUBSCRIBER.QUEUE

• SYSTEM.JMS.D.SUBSCRIBER.QUEUE

• SYSTEM.JMS.ND.CC.SUBSCRIBER.QUEUE

• SYSTEM.JMS.D.CC.SUBSCRIBER.QUEUE

• SYSTEM.BROKER.CONTROL.QUEUE

Also, any application that publishes messages needs access to the STREAM queue that is specified in the topic connection factory being used. The default value for this is SYSTEM.BROKER.DEFAULT.STREAM.

If you use ConnectionConsumer, additional authorization might be needed. Queues to be read by the ConnectionConsumer must have get, inq and browse authorities. The system dead-letter queue, and any backout-requeue queue or report queue used by the ConnectionConsumer must have put and passall authorities.

uj10670_