Security

Use the Security stanza in the qm.ini file to specify options for the Object Authority Manager (OAM).

ClusterQueueAccessControl=RQMName|Xmitq

Set this attribute to check the access control of cluster queues or fully qualified queues hosted on cluster queue managers.

RQMName: The profiles checked for access control of remotely hosted queues are named queues or named queue manager profiles.
Xmitq: The profiles checked for access control of remotely hosted queues are resolved to the SYSTEM.CLUSTER.TRANSMIT.QUEUE.
Xmitq is the default value.

GroupModel=GlobalGroups

This attribute determines whether the OAM checks global groups when determining the group membership of a user on Windows.

The default is not to check global groups.

GlobalGroups: The OAM checks global groups.
With GlobalGroups set, the authorization commands, setmqaut, dspmqaut, and dmpmqaut accept global groups names; see the setmqaut -gparameter.

Note: Setting the ClusterQueueAcessControl=RQMName and having a custom implementation of the Authorization Service at less than MQZAS_VERSION_6 results in the queue manager not starting. In this instance, either set ClusterQueueAcessControl=Xmitq or upgrade the custom Authorization Service to MQZAS_VERSION_6 or greater.