Authority checking for PCF commands

When a PCF command is processed, the UserIdentifier from the message descriptor in the command message is used for the required WebSphere® MQ object authority checks. Authority checking is implemented differently on each platform as described in this topic.

The checks are performed on the system on which the command is being processed; therefore this user ID must exist on the target system and have the required authorities to process the command. If the message has come from a remote system, one way of achieving the ID existing on the target system is to have a matching user ID on both the local and remote systems.

WindowsLinuxUNIX

IBM WebSphere MQ for Windows, UNIX and Linux® systems

In order to process any PCF command, the user ID must have dsp authority for the queue manager object on the target system. In addition, WebSphere MQ object authority checks are performed for certain PCF commands, as shown in Table 1.

To process any of the following commands the user ID must belong to group mqm.

Note: For Windows only, the user ID can belong to group Administrators or group mqm.
  • Change Channel
  • Copy Channel
  • Create Channel
  • Delete Channel
  • Ping Channel
  • Reset Channel
  • Start Channel
  • Stop Channel
  • Start Channel Initiator
  • Start Channel Listener
  • Resolve Channel
  • Reset Cluster
  • Refresh Cluster
  • Suspend Queue Manager
  • Resume Queue Manager

WebSphere MQ for HP Integrity NonStop Server

In order to process any PCF command, the user ID must have dsp authority for the queue manager object on the target system. In addition, IBM® WebSphere MQ object authority checks are performed for certain PCF commands, as shown in Table 1.

To process any of the following commands the user ID must belong to group mqm:
  • Change Channel
  • Copy Channel
  • Create Channel
  • Delete Channel
  • Ping Channel
  • Reset Channel
  • Start Channel
  • Stop Channel
  • Start Channel Initiator
  • Start Channel Listener
  • Resolve Channel
  • Reset Cluster
  • Refresh Cluster
  • Suspend Queue Manager
  • Resume Queue Manager

WebSphere MQ Object authorities

Table 1. Windows, HP Integrity NonStop Server, UNIX and Linux systems - object authorities
Command WebSphere MQ object authority Class authority (for object type)
Change Authentication Information dsp and chg n/a
Change Channel dsp and chg n/a
Change Channel Listener dsp and chg n/a
Change Client Connection Channel dsp and chg n/a
Change Namelist dsp and chg n/a
Change Process dsp and chg n/a
Change Queue dsp and chg n/a
Change Queue Manager chg see Note 3 and Note 5 n/a
Change Service dsp and chg n/a
Clear Queue clr n/a
Copy Authentication Information dsp crt
Copy Authentication Information (Replace) see Note 1 from: dsp to: chg crt
Copy Channel dsp crt
Copy Channel (Replace) see Note 1 from: dsp to: chg crt
Copy Channel Listener dsp crt
Copy Channel Listener (Replace) see Note 1 from: dsp to: chg crt
Copy Client Connection Channel dsp crt
Copy Client Connection Channel (Replace) see Note 1 from: dsp to: chg crt
Copy Namelist dsp crt
Copy Namelist (Replace) see Note 1 from: dsp to: dsp and chg crt
Copy Process dsp crt
Copy Process (Replace) see Note 1 from: dsp to: chg crt
Copy Queue dsp crt
Copy Queue (Replace) see Note 1 from: dsp to: dsp and chg crt
Create Authentication Information (system default authentication information) dsp crt
Create Authentication Information (Replace) see Note 1 (system default authentication information) dsp to: chg crt
Create Channel (system default channel) dsp crt
Create Channel (Replace) see Note 1 (system default channel) dsp to: chg crt
Create Channel Listener (system default listener) dsp crt
Create Channel Listener (Replace) see Note 1 (system default listener) dsp to: chg crt
Create Client Connection Channel (system default channel) dsp crt
Create Client Connection Channel (Replace) see Note 1 (system default channel) dsp to: chg crt
Create Namelist (system default namelist) dsp crt
Create Namelist (Replace) see Note 1 (system default namelist) dsp to: dsp and chg crt
Create Process (system default process) dsp crt
Create Process (Replace) see Note 1 (system default process) dsp to: chg crt
Create Queue (system default queue) dsp crt
Create Queue (Replace) see Note 1 (system default queue) dsp to:  dsp and chg crt
Create Service (system default queue) dsp crt
Create Service (Replace) see Note 1 (system default queue) dsp to: chg crt
Delete Authentication Information dsp and dlt n/a
Delete Authority Record (queue manager object) chg see Note 4 see Note 4
Delete Channel dsp and dlt n/a
Delete Channel Listener dsp and dlt n/a
Delete Client Connection Channel dsp and dlt n/a
Delete Namelist dsp and dlt n/a
Delete Process dsp and dlt n/a
Delete Queue dsp and dlt n/a
Delete Service dsp and dlt n/a
Inquire Authentication Information dsp n/a
Inquire Authority Records see Note 4 see Note 4
Inquire Channel dsp n/a
Inquire Channel Listener dsp n/a
Inquire Channel Status (for ChannelType MQCHT_CLSSDR) inq n/a
Inquire Client Connection Channel dsp n/a
Inquire Namelist dsp n/a
Inquire Process dsp n/a
Inquire Queue dsp n/a
Inquire Queue Manager see note 3 n/a
Inquire Queue Status dsp n/a
Inquire Service dsp n/a
Ping Channel ctrl n/a
Ping Queue Manager see note 3 n/a
Refresh Queue Manager (queue manager object) chg n/a
Refresh Security (for SecurityType MQSECTYPE_SSL) (queue manager object) chg n/a
Reset Channel ctrlx n/a
Reset Queue Manager (queue manager object) chg n/a
Reset Queue Statistics dsp and chg n/a
Resolve Channel ctrlx n/a
Set Authority Record (queue manager object) chg see Note 4 see Note 4
Start Channel ctrl n/a
Stop Channel ctrl n/a
Stop Connection (queue manager object) chg n/a
Start Listener ctrl n/a
Stop Listener ctrl n/a
Start Service ctrl n/a
Stop Service ctrl n/a
Escape see Note 2 see Note 2
Notes:
  1. This command applies if the object to be replaced does exist, otherwise the authority check is as for Create, or Copy without Replace.
  2. The required authority is determined by the MQSC command defined by the escape text, and it is equivalent to one of the previous commands.
  3. In order to process any PCF command, the user ID must have dsp authority for the queue manager object on the target system.
  4. This PCF command is authorized unless the command server has been started with the -a parameter. By default the command server starts when the Queue Manager is started, and without the -a parameter. See the System Administration Guide for further information.
  5. Granting a user ID chg authority for a queue manager gives the ability to set authority records for all groups and users. Do not grant this authority to ordinary users or applications.

WebSphere MQ also supplies some channel security exit points so that you can supply your own user exit programs for security checking. Details are given in Displaying a channel manual.