Enabling security for record and replay

To enable security for record and replay, complete the following steps.

1. To use a web administration server to view and replay data, you must create a system user account on your operating system, such as ibmuser. This system user account functions as a role, which you can associate with one or more web user accounts. You do not need to create this system user account if you are not enabling broker administration security. For more information about roles, see Role-based security.
2. Enable administrative security by setting the -s parameter to active.
   • To enable administrative security when you create the broker, run the mqsicreatebroker, as shown in the following example:

     mqsicreatebroker brokerName -q brokerQueueManagerName -s active 

     (If you run this command on Windows, you must also set the -i parameter. For details, see mqsicreatebroker command.)
   • To enable administrative security for a broker that you have already created, stop the broker, then run the mqsichangebroker, as shown in the following example:

     mqsichangebroker brokerName -s active  

   For more information, see Enabling administration security.
3. To allow users with an assigned role to run record and replay queries on the integration server, ensure that the role (system user account) has inquire (inq) administration authority on the queues SYSTEM.BROKER.AUTH and SYSTEM.BROKER.AUTH.EG.

   For more information, see Authorizing users for administration.

4. In addition to setting administrative security, you must also set security for data capture. The queue SYSTEM.BROKER.DC.AUTH controls the record and replay actions that users with a specified role (such as ibmuser) can complete on the broker. Ensure that the role has the appropriate authorization to complete the following actions on this queue:

   Action	Authority required
   To view data, bit streams, and exception lists	READ (+INQ)
   To replay data	EXECUTE (+SET)

   To change these authorizations, you can use WebSphere MQ commands or the IBM® Integration Explorer.

   To use WebSphere MQ commands, see Granting and revoking authority on Linux, UNIX, and Windows systems.

   To use the IBM Integration Explorer, complete the following steps.

   1. In the MQ Explorer - Navigator view, navigate to IBM WebSphere MQBrokers > Quene Managers, expand your queue manage, and select Queues.
   2. Right-click the queue SYSTEM.BROKER.DC.AUTH, then click Object Authorities > Manage Authority Records.
   3. Expand Specific Profiles and click SYSTEM.BROKER.DC.AUTH.
   4. On the Users tab, select ibmuser and click Edit.
   5. Set the appropriate authorizations and click OK, then close the Manage Authority Records dialog box.
5. If you change authorizations, restart your broker and broker queue manager to ensure that changes take effect.
6. Create a web user account by using the mqsiwebuseradmin command. This web user account is the one that you will use to login to the web user interface for viewing and replaying data. If you have broker administration enabled, you must specify a role for the web user account when you create it. The role is the system user account that you created in Step 1, which has security permissions assigned. For more information, see mqsiwebuseradmin command and Managing web user accounts.