Group authorities for resources specific to WebSphere MQ Managed File Transfer

Instead of granting authority to individual users for all of the various objects that might be involved, configure two security groups for the purposes of administering WebSphere® MQ Managed File Transfer access control: FTEUSER and FTEAGENT. It is the responsibility of the IBM® WebSphere MQ administrator to create and populate these groups. The administrator can choose to extend or modify the proposed configuration described here.

Authority to connect to queue managers

Commands that are run by operational users, administrative users, and the IBM WebSphere MQ Explorer need to be able to connect to the command queue manager and coordination queue manager. The agent process and commands that are run to create, alter, or delete the agent need to be able to connect to the agent queue manager.

Grant the FTEUSER group connect authority for the command queue manager and coordination queue manager. For example:
For UNIX, Linux®, and Windows systems:
```
setmqaut -m command_queue_manager -t qmgr -g FTEUSER +connect
setmqaut -m coordination_queue_manager -t qmgr -g FTEUSER +connect
```
Grant the FTEAGENT group connect and inquire authority to the agent queue manager. For example:
For UNIX, Linux, and Windows systems:
```
setmqaut -m agent_queue_manager -t qmgr -g FTEAGENT +connect +inq +setid
```

For information about which command directly connects to which queue manager, see Which WebSphere MQ Managed File Transfer command connects to which queue manager

Authority to put a message on the COMMAND queue that belongs to the agent

The agent command queue must be available to any user who is authorized to request that the agent performs an action. To satisfy this requirement,

Grant the FTEUSER group only put access to the SYSTEM.FTE.COMMAND.agent_name queue. For example:
For UNIX, Linux, and Windows systems:
```
setmqaut -m QM1 -n SYSTEM.FTE.COMMAND.agent_name -t queue -g FTEUSER +put
```
Grant the FTEAGENT group put, get, and setid access to the SYSTEM.FTE.COMMAND.agent_name queue. For example:
For UNIX, Linux, and Windows systems:
```
setmqaut -m QM1 -n SYSTEM.FTE.COMMAND.agent_name -t queue -g FTEAGENT +browse +put +get +setid
```

Authority to put messages on the DATA, STATE, EVENT, and REPLY queues that belong to the agent

Only WebSphere MQ Managed File Transfer agents need to be able to use these system queues, therefore grant the group FTEAGENT put, get and inquire access. The names of these system queues are as follows:

DATA - SYSTEM.FTE.DATA.agent_name
STATE - SYSTEM.FTE.STATE.agent_name
EVENT - SYSTEM.FTE.EVENT.agent_name
REPLY - SYSTEM.FTE.REPLY.agent_name

For example, for the SYSTEM.FTE.DATA.agent_name queue, use a command like the following:

For UNIX, Linux, and Windows systems:

setmqaut -m QM1 -n SYSTEM.FTE.DATA.agent_name -t queue -g FTEAGENT +put +get +inq

Authority that the agent process runs under

The authority that the agent process runs under affects the files the agent can read and write from the file system, and the queues and topics the agent can access. How the authority is configured is system-dependent. Add the user ID that the agent process runs under to the FTEAGENT group. For more information about adding a user ID to a group, see Setting up security and navigate to the information for your operating system.

Authority that the commands and IBM WebSphere MQ Explorer run under

Administrative commands, for example the fteStartAgent command, and the WebSphere MQ Managed File Transfer plug-in for the WebSphere MQ Explorer need to be able to put messages to the SYSTEM.FTE.COMMAND.agent_name queue and retrieve published information from that queue. Add the user IDs that are authorized to run the commands or the IBM WebSphere MQ Explorer to the FTEUSER group. This originator user ID is recorded in the transfer log. For more information about adding a user ID to a group, see Setting up security and navigate to the information for your operating system.

Authority to put messages on the SYSTEM.FTE queue and SYSTEM.FTE topic

Only the agent process needs to be able to place messages on the SYSTEM.FTE queue and SYSTEM.FTE topic. Grant put, get and inquire authority to the FTEAGENT group on the SYSTEM.FTE queue, and grant publish and subscribe authority to the FTEAGENT group on the SYSTEM.FTE topic. For example:

For UNIX, Linux, and Windows systems:

setmqaut -m QM1 -n SYSTEM.FTE -t queue -g FTEAGENT +put +get +inq
setmqaut -m QM1 -n SYSTEM.FTE -t topic -g FTEAGENT +pub +sub +resume

For a message to get published to the SYSTEM.FTE topic, the authority records of the SYSTEM.FTE topic must allow publication by the user ID contained in the message descriptor structure (MQMD) of the message. This is described in Authority to publish log and status messages.

Authority to receive publications on the SYSTEM.FTE topic

Transfer log messages, progress messages, and status messages are intended for general use, so grant the FTEUSER group authority to subscribe to the SYSTEM.FTE topic. For example:

For UNIX, Linux, and Windows systems:

setmqaut -m QM1 -n SYSTEM.FTE -t topic -g FTEUSER +sub

Authority to connect to remote queue managers using transmission queues

In a topology of multiple queue managers, the agent requires put authority on the transmission queues used to connect to the remote queue managers.

Authority to create a temporary reply queue for file transfers

File transfer requests wait for the transfer to complete and rely on a temporary reply queue being created and populated. Grant the FTEUSER group DISPLAY, PUT, GET, and BROWSE authorities on the temporary model queue definition. For example:

For UNIX, Linux, and Windows systems:

setmqaut -m QM1 -n SYSTEM.DEFAULT.MODEL.QUEUE -t queue -g FTEUSER +dsp +put +get +browse

By default this is SYSTEM.DEFAULT.MODEL.QUEUE, but you can configure the name by setting values for the properties 'modelQueueName' and 'dynamicQueuePrefix' in the command.properties file.

The following table summarizes the access control configuration for FTEUSER and FTEAGENT in the security scheme described:

Table 1. Summary of access control configuration for FTEUSER and FTEAGENT
Object	Object type	FTEUSER	FTEAGENT
Agent queue manager	Queue manager		CONNECT, INQ, and SETID. ALT_USER is also required to enable user authority checking.
Coordination queue manager	Queue manager
Command queue manager	Queue manager	CONNECT	CONNECT
SYSTEM.FTE	Local queue		GET and PUT
SYSTEM.FTE.COMMAND.`agent_name`	Local queue	PUT	BROWSE, GET, PUT, and SETID
SYSTEM.FTE.DATA.`agent_name`	Local queue		GET and PUT
SYSTEM.FTE.EVENT.`agent_name`	Local queue		BROWSE, GET and PUT
SYSTEM.FTE.REPLY.`agent_name`	Local queue		GET and PUT
SYSTEM.FTE.STATE.`agent_name`	Local queue		BROWSE, GET, INQ, and PUT
SYSTEM.FTE.WEB.`gateway_name`	Local queue		PUT
SYSTEM.FTE.WEB.RESP.`agent_name`	Local queue		GET
SYSTEM.FTE	Local topic	SUBSCRIBE	PUBLISH and SUBSCRIBE
SYSTEM.DEFAULT.MODEL.QUEUE (or the model queue defined in WebSphere MQ Managed File Transfer that is used to create a temporary reply queue.)	Model queue	BROWSE, DISPLAY, GET, and PUT	BROWSE, DISPLAY, GET, and PUT
Transmission queues to communicate with remote queue managers	Local queue		PUT

Authority to manage transfers through IBM WebSphere MQ Explorer

In addition to granting IBM WebSphere MQ Managed File Transfer authorities to users in situations that are already mentioned on this page, further authorities need to be granted to the IBM WebSphere MQ Managed File Transfer agent user who administers and performs all IBM WebSphere MQ Managed File Transfer operations through IBM WebSphere MQ Explorer. To issue commands such as create, cancel, schedule file transfer, create, delete resource monitors, and create transfer templates, the IBM WebSphere MQ Explorer user must have authority as follows:

Coordination queue manager: connect, inquire, display
Command queue manager: connect, inquire, display
SYSTEM.FTE topic: publish, subscribe
SYSTEM.MQEXPLORER.REPLY.MODEL: display, inquire, get, browse
SYSTEM.ADMIN.COMMAND.QUEUE: inquire, put, display
SYSTEM.DEFAULT.MODEL.QUEUE: get, put, inquire, display, browse

For information about which command directly connects to which queue manager, see Which WebSphere MQ Managed File Transfer command connects to which queue manager.