Authorizing users for administration

You must activate broker administration security before you can grant or revoke permissions for specific user IDs. When you first activate security, you must set up initial control for each user to authorize them to perform certain operations. You can then grant additional authority, revoke permissions, as required.

You can grant authorities to individual principals (user IDs), to groups of users, or both, on all platforms:

• If you grant a group or a user ID authority at the broker level (on queue SYSTEM.BROKER.AUTH), it does not inherit authority for integration servers. You must explicitly grant authority to all, or to individual, integration servers.
• On Linux and UNIX, you can authorize both principals and groups. However, when authorizing a principal, Message Broker additionally authorizes the primary group of that principal. If there are many users who belong to that primary group, they become authorized at the same time. Message Broker users should consider using groups instead of primary groups for authorization, because of differences in how variants of UNIX use primary groups.
• If a user ID is a member of the WebSphere® MQ security group mqm, it automatically has authority to all WebSphere MQ objects.
• On Windows, if a user ID is a member of the security group Administrators, it automatically has authority to all WebSphere MQ objects.

When you change authorizations on a queue, the broker accesses the updated values the next time that a request is processed. You do not have to stop and restart the broker.

If you update user ID or group membership by using the operating system facilities on the platform on which the broker queue manager is running, you must ensure that the queue manager is aware of these changes. Select the option Refresh Authorization Service in the WebSphere MQ Explorer to notify the queue manager of the updated status.

The authority that is required depends on the requirements of the user:

• Required authority for administrators
• Required authority for users who connect to the broker
• Required authority for recording and replaying data
• Required authority for users of the web user interface
• Required authority for developers

The way in which you set up the required authorities differs by platform:

• Granting and revoking authority on Linux, UNIX, and Windows systems
• Granting and revoking authority on z/OS systems

These platform-specific topics also give examples of command usage for viewing what authorizations are in place by using the WebSphere MQ dspmqaut command, and for dumping this information by using the dmpmqaut command.

For information about the additional permissions that are required for recording and replaying data, see Enabling security for record and replay.