IBM Integration Bus, Version 9.0.0.8 Operating Systems: AIX, HP-Itanium, Linux, Solaris, Windows, z/OS

See information about the latest product version

Security requirements for Windows systems

Security requirements depend on the administrative task that you want to perform.

The following tables summarize the requirements for administrative tasks. They show what group membership is required if you are using a local security domain defined on your local system.

Note: If you have enabled broker administration security, you must also set up the authority detailed in Tasks and authorizations for administration security.

Domain users in a multi-workstation domain, or from domains that are in a Windows transitive trust relationship with the local domain, can also perform these administrative tasks. They need to fulfill the group membership requirements specified in the tables. One way to set up this group membership is by adding the domain user to a domain group which in turn is a member of the local group. For an example of how to set up security by using domain groups, see Security in a Windows domain environment.

Task	Command	Authorization
Create, delete or migrate a broker	mqsicreatebroker mqsideletebroker mqsimigratecomponents	Must be a user ID defined in WORKSTATION. Member of Administrators. On Windows systems, the user ID used to run this command must be run from a command prompt with elevated privileges. For more information, see mqsicommandconsole command. Using LDAP: Ensure that the registry is appropriately secured to prevent unauthorized access. The setting of LdapPrincipal and LdapCredentials parameters on mqsichangebroker is not required for correct operation of the broker. The password is not stored in clear text in the file system.
Change a broker	mqsichangebroker	Must be a user ID defined in WORKSTATION. Member of mqbrkrs. If you specify the -s parameter to activate broker administration security, the user ID used to run this command must be a member of the mqm group, because several queues are created for use by the broker. Using LDAP: Ensure that the registry is appropriately secured to prevent unauthorized access. The setting of LdapPrincipal and LdapCredentials parameters on mqsichangebroker is not required for correct operation of the broker. The password is not stored in clear text in the file system.
Add or remove a broker instance	mqsiaddbrokerinstance mqsiremovebrokerinstance	Must be a user ID defined in WORKSTATION. Member of Administrators. On Windows systems, the user ID used to run this command must be run from a command prompt with elevated privileges. For more information, see mqsicommandconsole command.
Backup or restore a broker	mqsibackupbroker mqsirestorebroker	Member of mqbrkrs.
Start a broker, or verify a broker	mqsistart mqsicvp	Member of mqbrkrs. Member of mqm if the queue manager is not already running.
Stop a broker	mqsistop	Member of mqbrkrs. Member of mqm if -q is specified.
Create or delete an integration server	mqsicreateexecutiongroup mqsideleteexecutiongroup	Member of mqbrkrs. If broker administration security is active, the user ID that runs this command must be a member of the group mqm. If you do not want your broker to run with mqm authority, you must work with your WebSphere® MQ administrator to create or delete the appropriate authority queue when you create or delete an integration server.
Start or stop a message flow	mqsistartmsgflow mqsistopmsgflow	Member of mqbrkrs.
Create or delete a configurable service	mqsicreateconfigurableservice mqsideleteconfigurableservice	Member of mqbrkrs.
List brokers	mqsilist	Must be a user ID defined in WORKSTATION. Member of mqbrkrs or mqm to run the command with broker and integration server specified: `mqsilist broker_name integration_server_name`
Show broker properties	mqsireportbroker mqsireportproperties mqsireportflowmonitoring mqsireportflowstats mqsireportflowuserexits mqsireportresourcestats	Member of mqbrkrs.
Change properties	mqsichangeproperties mqsichangeflowmonitoring mqsichangeflowstats mqsichangeflowuserexits mqsichangeresourcestats	Member of mqbrkrs.
Set and update passwords	mqsisetdbparms	Member of mqbrkrs.
List set parameters that are on a broker	mqsireportdbparms	Member of mqbrkrs.
Report or update a broker mode	mqsimode	Member of mqbrkrs.
Deploy an object to a broker	mqsideploy	Member of mqbrkrs.
Reload a broker, integration servers or security	mqsireload mqsireloadsecurity	Member of mqbrkrs.
Trace a broker	mqsichangetrace mqsireporttrace mqsireadlog mqsiformatlog	Must be a user ID defined in WORKSTATION. Member of mqbrkrs.
Add the mqbrkrs group	mqsisetsecurity	Must be a user ID defined in WORKSTATION. Member of Administrators. On Windows systems, the user ID used to run this command must be run from a command prompt with elevated privileges. For more information, see mqsicommandconsole command.
Install, uninstall, or list .NET assemblies in the Global Assembly Cache	mqsiAssemblyInstall	Must be a user ID defined in WORKSTATION. Member of Administrators. On Windows systems, the user ID used to run this command must be run from a command prompt with elevated privileges. For more information, see mqsicommandconsole command.
Global cache administration	mqsicacheadmin	Member of mqbrkrs.
Run commands that require elevated privileges	mqsicommandconsole	Member of Administrators. On Windows systems, the user ID used to run this command must be run from a command prompt with elevated privileges. For more information, see mqsicommandconsole command.
Set up symbolic links needed for coordinated transactions	mqsimanagexalinks	Must be a user ID defined in WORKSTATION. Member of Administrators. On Windows systems, the user ID used to run this command must be run from a command prompt with elevated privileges. For more information, see mqsicommandconsole command.
Package a BAR file	mqsipackagebar	Must be a user ID defined in WORKSTATION. Member of Administrators. On Windows systems, the user ID used to run this command must be run from a command prompt with elevated privileges. For more information, see mqsicommandconsole command. The user ID must have write access to the -w (root location), -a (BAR file location), and -v (trace file location) directories.
Create or modify a web user account	mqsiwebuseradmin	Member of Administrators.

User is...¹	Command Used	Local domain (WORKSTATION)
Running a broker (WebSphere MQ fast path off) (service user ID)²	Not applicable	Must be a user ID defined in WORKSTATION Member of mqbrkrs Must have the `Logon as a service` privilege in the Windows Local Security Policy. This privilege is added when mqsicreatebroker is run, if necessary.
Running a broker (WebSphere MQ fast path on) (service user ID)²	Not applicable	Must be a user ID defined in WORKSTATION Member of mqbrkrs Member of mqm Must have the `Logon as a service` privilege in the Windows Local Security Policy. This privilege is added when mqsicreatebroker is run, if necessary.
Running an IBM® Integration Toolkit³	Start IBM Integration Toolkit from the Start menu	Must be a user ID defined in WORKSTATION. For example, WORKSTATION\User1 is valid, PRIMARY\User2 and TRUSTED\User3 are not.

Notes:

By default when a broker is created, the service user ID is given the required permissions to access to relevant directories of the product directory tree; for example, write access to the logs directory.
This happens even if you set a location that is not the default, with the –w flag on the mqsicreatebroker command, or use the –e flag on the mqsicreatebroker command to create a multi-instance broker. If these permissions are changed manually, you must always ensure that the mqbrkrs group has appropriate access to these locations.
Ensure that mqbrkrs has access to all user-defined queues that you have defined for use by your message flows. You can use the setmqaut command to set permissions.
- Set the following permissions on all input queues:
```
setmqaut -m IB9NODE -n TEST_INPUT -t queue -g mqbrkrs  +get +inq
```
- Set the following permissions on all output queues:
```
setmqaut -m IB9NODE -n TEST_OUTPUT -t queue -g mqbrkrs +put +inq +setall
```
- You might also need to add +passid +passall +setid +setall, depending on your requirements.
All IBM Integration Toolkit users need read access to the WebSphere MQ Java™ \lib subdirectory of the WebSphere MQ home directory (the default location is X:\Program Files\WebSphere MQ, where X: is the operating system disk). This access is restricted to users in the local group mqm by WebSphere MQ. IBM Integration Bus installation overrides this restriction and gives read access for this subdirectory to all users.

Broker security requirements on Windows

On all Windows platforms, there is no longer any requirement for the service user ID to be a member of the Administrators group.

The only requirement is that the service user ID is a member of the mqbrkrs group. In addition, the LocalSystem account can be used as the service user ID by specifying LocalSystem for the –i parameter on the mqsicreatebroker command.

In this case you must enter the –a (password) parameter on the command line, but the value entered is ignored.

ap08683_.htm |

Last updated Friday, 21 July 2017