Permissions for acting on integration nodes and resources

Permissions are required for users to act on the integration node and its resources.

The following tables shows the permissions that are required for users to carry out specific tasks, depending on whether you are using queue-based, file-based, or LDAP administration security. If you are using any IBM® Integration Bus functions that require access to WebSphere® MQ, you must also set the required permissions for connecting to the queue manager that is specified on the integration node. For information about the permissions that are required for connecting to the queue manager, see Permissions for connecting to a queue manager.

Table 1. WebSphere MQ queue-based permissions required for acting on an integration node
Action Integration node permission MQ queue-based security: WebSphere MQ permission set on setmqaut command for SYSTEM.BROKER.AUTH queue
View read +INQ
Create write +PUT
Delete write +PUT
Modify write +PUT
Start execute +SET
Stop execute +SET
Inject execute +SET
Table 2. File-based permissions required for acting on an integration node
Action Integration node permission File-based security: File permission set on mqsichangefileauth command, object flag not required
View read read+
Create write write+
Delete write write+
Modify write write+
Start execute execute+
Stop execute execute+
Inject execute execute+
Table 3. LDAP permissions required for acting on an integration node
Action Integration node permission LDAP security: permission set on mqsichangefileauth command, object flag not required
View read read+
Create write write+
Delete write write+
Modify write write+
Start execute execute+
Stop execute execute+
Inject execute execute+
Table 4. WebSphere MQ queue-based permissions required for acting on an integration server
Action Integration node permission MQ queue-based security: WebSphere MQ permission set on setmqaut command for SYSTEM.BROKER.AUTH.EG queue
View read +INQ
Create write +PUT
Delete write +PUT
Modify write +PUT
Start execute +SET
Stop execute +SET
Table 5. File-based permissions required for acting on an integration server
Action Integration node permission File-based security: File permission set on mqsichangefileauth command (include -e integrationServerName flag)
View read read+
Create write write+
Delete write write+
Modify write write+
Start execute execute+
Stop execute execute+
Table 6. LDAP permissions required for acting on an integration server
Action Integration node permission LDAP security: permission set on mqsichangefileauth command (include -e integrationServerName flag)
View read read+
Create write write+
Delete write write+
Modify write write+
Start execute execute+
Stop execute execute+
Table 7. WebSphere MQ queue-based permissions required for acting on a data capture object
Action Integration node permission MQ queue-based security: WebSphere MQ permission set on setmqaut command for SYSTEM.BROKER.DC.AUTH queue
View read +INQ
Replay execute +SET
Table 8. File-based permissions required for acting on a data capture object
Action Integration node permission File-based security: File permission set on mqsichangefileauth command (include -o Data Capture flag )
View read read+
Replay execute execute+
Table 9. LDAP permissions required for acting on a data capture object
Action Integration node permission LDAP security: permission set on mqsichangefileauth command (include -o Data Capture flag )
View read read+
Replay execute execute+

Where no object flag is specified on the mqsichangefileauth command command, permissions are set at the level of the integration node.

For information about using the mqsichangeauthmode command to specify an authorization mode, see Configuring administration security to use file-based, queue-based, or LDAP authorization.

If the queue-based mode of administration security (mq mode) is enabled when you create an integration node, the queue SYSTEM.BROKER.AUTH is created. Read, write, and execute permissions are granted automatically to the user group mqbrkrs on this queue. The SYSTEM.BROKER.AUTH queue is created as a local queue, and is used to define which users are authorized to perform actions on the integration node and the integration node properties.

When you create an integration server on an integration node for which you have enabled queue-based security, the integration server authorization queue SYSTEM.BROKER.AUTH.EG is created, where EG is the name of the integration server. Read, write, and execute permissions are automatically granted to the user group mqbrkrs on this queue.

When you use the mqsicreatebroker command to create an integration node with an associated queue manager, the SYSTEM.BROKER.DC.AUTH queue is created automatically. If you create an integration node without specifying a queue manager, you can modify the integration node afterwards to specify a queue manager and enable administration security in mq mode; however, you must also create the SYSTEM.BROKER.DC.AUTH queue. For information about creating the system queues, see Creating the default IBM Integration Bus queues on a WebSphere MQ queue manager.

For more information about the creation of authorization queues, see Authorization queues for queue-based administration security.