setmqaut

Description

Each authorization to be changed is specified in an authorization list as part of the command. Each item in the list is a string prefixed by a plus sign (+) or a minus sign (-). For example, if you include +put in the authorization list, you grant authority to issue MQPUT calls against a queue. Alternatively, if you include -put in the authorization list, you revoke the authority to issue MQPUT calls.

You can specify any number of principals, user groups, and authorizations in a single command, but you must specify at least one principal or user group.

If a principal is a member of more than one user group, the principal effectively has the combined authorities of all those user groups. On Windows systems, the principal also has all the authorities that have been granted to it explicitly using the setmqaut command.

To alter authorizations for a cluster sender channel that has been automatically generated by a repository, see Channel definition commands.

Required parameters

-t ObjectType

The type of object for which to change authorizations.

Possible values are as follows:

authinfo	An authentication information object
channel or chl	A channel
clntconn or clcn	A client connection channel
comminfo	A communication information object
listener or lstr	A listener
namelist or nl	A namelist
process or prcs	A process
queue or q	A queue
qmgr	A queue manager
rqmname or rqmn	A remote queue manager name
service or srvc	A service
topic or top	A topic

-n Profile

The name of the profile for which to change authorizations. The authorizations apply to all IBM® WebSphere® MQ objects with names that match the profile name specified. The profile name can be generic, using wildcard characters to specify a range of names as explained in Using OAM generic profiles on UNIX or Linux® systems and Windows.

This parameter is required, unless you are changing the authorizations of a queue manager, in which case you must not include it. To change the authorizations of a queue manager use the queue manager name, for example

setmqaut -m QMGR -t qmgr -p user1 +connect

where QMGR is the name of the queue manager and user1 is the user requesting the change.

Each class of object has authority records for each group or principal. These records have the profile name @CLASS and track the crt (create) authority common to all objects of that class. If the crt authority for any object of that class is changed then this record is updated. For example:

profile:     @class
object type: queue
entity:      test
entity type: principal
authority:   crt

This shows that members of the group test have crt authority to the class queue.

Optional parameters

-m QMgrName

The name of the queue manager of the object for which to change authorizations. The name can contain up to 48 characters.

This parameter is optional if you are changing the authorizations of your default queue manager.

-p PrincipalName

The name of the principal for which to change authorizations.

For IBM WebSphere MQ for Windows only, the name of the principal can optionally include a domain name, specified in the following format:

userid@domain

For more information about including domain names on the name of a principal, see Principals and groups .

You must have at least one principal or group.

-g GroupName

The name of the user group for which to change authorizations. You can specify more than one group name, but each name must be prefixed by the -g flag.

For IBM WebSphere MQ for Windows only, the group name can optionally include a domain name, specified in the following formats:

GroupName@domain
domain\GroupName

The IBM WebSphere MQ Object Authority Manager validates the users and groups at the domain level, only if you set the GroupModel attribute to GlobalGroups in the Security stanza of the queue manager.

-s ServiceComponent

The name of the authorization service to which the authorizations apply (if your system supports installable authorization services). This parameter is optional; if you omit it, the authorization update is made to the first installable component for the service.

+remove or -remove

Remove all the authorities from WebSphere MQ objects that match the specified profile.

Authorizations

The authorizations to be granted or revoked. Each item in the list is prefixed by a plus sign (+) or a minus sign (-). The plus sign indicates that authority is to be granted. The minus sign indicates that authority is to be revoked.

For example, to grant authority to issue MQPUT calls, specify +put in the list. To revoke the authority to issue MQPUT calls, specify -put.

Table 1 shows the authorities that can be given to the different object types.

Table 1. Specifying authorities for different object types.

Cross-tabulation of object types versus authority. Each cell contains whether the authority can be given to the object type.

Authority	Queue	Process	Queue manager	Remote queue manager name	Namelist	Topic	Auth info	Clntconn	Channel	Listener	Service	Comminfo
all 1	Yes	Yes	Yes	Yes	Yes	Yes	Yes	Yes	Yes	Yes	Yes	Yes
alladm 2	Yes	Yes	Yes	No	Yes	Yes	Yes	Yes	Yes	Yes	Yes	Yes
allmqi 3	Yes	Yes	Yes	Yes	Yes	Yes	Yes	No	No	No	No	No
none	Yes	Yes	Yes	Yes	Yes	No	Yes	Yes	Yes	Yes	Yes	Yes
altusr	No	No	Yes	No	No	No	No	No	No	No	No	No
browse	Yes	No	No	No	No	No	No	No	No	No	No	No
chg	Yes	Yes	Yes	No	Yes	Yes	Yes	Yes	Yes	Yes	Yes	Yes
clr	Yes	No	No	No	No	Yes	No	No	No	No	No	No
connect	No	No	Yes	No	No	No	No	No	No	No	No	No
crt	Yes	Yes	Yes	No	Yes	Yes	Yes	Yes	Yes	Yes	Yes	Yes
ctrl	No	No	No	No	No	Yes	No	No	Yes	Yes	Yes	No
ctrlx	No	No	No	No	No	No	No	No	Yes	No	No	No
dlt	Yes	Yes	Yes	No	Yes	Yes	Yes	Yes	Yes	Yes	Yes	Yes
dsp	Yes	Yes	Yes	No	Yes	Yes	Yes	Yes	Yes	Yes	Yes	Yes
get	Yes	No	No	No	No	No	No	No	No	No	No	No
pub	No	No	No	No	No	Yes	No	No	No	No	No	No
put	Yes	No	No	Yes	No	No	No	No	No	No	No	No
inq	Yes	Yes	Yes	No	Yes	No	Yes	No	No	No	No	No
passall	Yes	No	No	No	No	No	No	No	No	No	No	No
passid	Yes	No	No	No	No	No	No	No	No	No	No	No
resume	No	No	No	No	No	Yes	No	No	No	No	No	No
set	Yes	Yes	Yes	No	No	No	No	No	No	No	No	No
setall	Yes	No	Yes	No	No	No	No	No	No	No	No	No
setid	Yes	No	Yes	No	No	Yes	No	No	No	No	No	No
sub	No	No	No	No	No	Yes	No	No	No	No	No	No
system	No	No	Yes	No	No	No	No	No	No	No	No	No
Note: all authority is equivalent to the union of the authorities alladm, allmqi, and system appropriate to the object type. alladm authority is equivalent to the union of the individual authorities chg, clr, dlt, dsp, ctrl, and ctrlx appropriate to the object type. crt authority is not included in the subset alladm. allmqi authority is equivalent to the union of the individual authorities altusr, browse, connect, get, inq, pub, put, resume, set, and sub appropriate to the object type.

Description of specific authorities

You should not grant a user an authority (for example, set authority on a queue manager, or system authority) that allows the user to access IBM WebSphere MQ privileged options, unless the required authority is specifically documented, and required to run any WebSphere MQ command, or IBM WebSphere MQ API call.

For example, a user requires system authority to run the setmqaut command.

chg

A user needs chg authority to make any authorization changes on the queue manager. The authorization changes include:

• Changing the authorizations to a profile, object, or class of objects
• Creating and modifying channel authentication records, and so on

A user also needs chg authority to change or set the attributes of an IBM WebSphere MQ object, using PCF or MQSC commands.

crt

If you grant an entity +crt authority to the queue manager, then that entity also gains +crt authority for each object class.

However, when you remove +crt authority against the queue manager object that only removes the authority on the queue manager object class; crt authority for other objects classes are not removed.

Note that crt authority on the queue manager object has no functional use, and is available for backwards-compatibility purposes only.

dlt

Note that the dlt authority against the queue manager object has no functional use, and is available for backwards-compatibility purposes only.

set

A user needs set authority against the queue to change or set the attributes of a queue using the MQSET API call.

set authority on the queue manager is not required for any administrative purpose, or for any application connecting to the queue manager.

However, a user needs set authority against the queue manager to set privileged connection options.

Note that set authority on the process object has no functional use, and is available for backwards-compatibility purposes only.

Important: Privileged connection options are internal to the queue manager and are not available in IBM WebSphere MQ API calls used by IBM WebSphere MQ applications.

system

The setmqaut command makes a privileged IBM WebSphere MQ connection to the queue manager.

Any user who runs IBM WebSphere MQ commands that makes a privileged IBM WebSphere MQ connection needs system authority on the queue manager.

Return codes