Administering messaging users

Messaging users work with IBM® MQ.

Messaging users perform operations on messaging resources. They can connect to queue managers remotely to send and receive messages. They can be authorized to remotely manage some aspects of queue managers by using client connections such as the IBM MQ Explorer.

Messaging users are distinct from appliance users, who administer the IBM MQ Appliance and configure IBM MQ on the appliance. See Types of user and how they are authenticated for an explanation of the distinction between the two types of user.

After you create messaging users, you must use SET AUTHREC in runmqsc, or use the IBM MQ Console to grant these users access to the required IBM MQ resources.

The appliance reserves the following user IDs for its own use:
  • hacluster
  • mqm
  • mqsystem
  • root
  • sshd
You cannot create user IDs with these names, or delete, modify, or list these user IDs.

Messages that are generated by a queue manager, rather than an application, have the MQMD.UserIdentifier for that message set to mqsystem. Examples of situations where a message is generated by a queue manager are cluster internal state messages being sent to a remote queue manager and distributed pub/sub internal state messages being sent to a remote queue manager. In certain circumstances you might need to know that MQMD.UserIdentifier is set to mqsystem, for example, if messages generated by a queue manager are sent over a channel whose receiving side is using PUTAUT(CTX).

By default, all users belong to the group users. You cannot remove users from the users group, but you can add them to additional groups.

The appliance reserves the following groups for its own use:
  • haclient
  • root
  • sshd
  • utmp

You cannot create groups with these names, or delete or list these groups.

The appliance also provides the standard IBM MQ mqm group. You cannot delete this group, but you can add users to it.

You administer messaging users, and messaging user groups, by using the command line. The commands are run in IBM MQ administration mode, which is entered by typing mqcli on the command line. The following table lists the commands that are available:

Command Description
usercreate (create user) Creates user IDs for messaging users on the IBM MQ Appliance.
userdelete (delete user) Deletes messaging users.
usermodify (modify user) Modifies messaging users
userlist (list users) Lists messaging users, or lists details of a particular user ID.
groupcreate (create user group) Adds user groups for messaging users on the IBM MQ Appliance.
groupdelete (delete user group) Deletes groups for messaging users.
grouplist (list user groups) Lists groups for messaging users.
userbackup (back up users) Backs up messaging users on the IBM MQ Appliance to a file.
userrestore (restore user) Restores messaging users on the IBM MQ Appliance from a file to which they were previously backed up.