Tasks and authorizations for administration security
If you enable integration node administration security, users require specific permissions so that they can complete administration tasks.
The following tables show the list of actions that a user can perform, and
the permissions that you must set to allow them to complete these tasks when administration security
is enabled. The permissions are required regardless of how the user requests the action; from a
custom integration application, the web user interface, or the IBM® App Connect
Enterprise Toolkit.
Note: If you are using the web user interface for administration, then you must have
permission to view integration node properties in addition to the permissions required for
administering the integration node resources that are listed in the following tables. If queue-based security is enabled, a check is made on all SYSTEM.BROKER.AUTH queues
to establish the permissions that the user has. As a result of this check, AMQ8077 messages might be
seen.
In addition to the permissions that are required for the tasks that are shown in the following tables, permissions are also required for connecting to the integration node. For more information, see Authorizing users for administration.
Task category | Tasks | MQ queue-based security | File-based security | ||
---|---|---|---|---|---|
IBM MQ queue | IBM MQ permission (set on setmqaut command) | Object flag (set on mqsichangefileauth command) | File permission (set on mqsichangefileauth command) | ||
Integration node | Set integration node properties | SYSTEM.BROKER.AUTH | +INQ +PUT | read+,write+ | |
View integration node properties | SYSTEM.BROKER.AUTH | +INQ | read+ | ||
Integration servers | Create or delete integration servers | SYSTEM.BROKER.AUTH | +INQ +PUT | read+,write+ | |
Rename integration servers | SYSTEM.BROKER.AUTH | +INQ +PUT | read+,write+ | ||
List integration servers | SYSTEM.BROKER.AUTH | +INQ | read+ | ||
Start or stop integration servers | SYSTEM.BROKER.AUTH | +INQ | read+ | ||
SYSTEM.BROKER.AUTH or SYSTEM.BROKER.AUTH.integrationServerName | +SET | -e integration_server | execute+ | ||
Set integration server properties | SYSTEM.BROKER.AUTH | +INQ | read+ | ||
SYSTEM.BROKER.AUTH.integrationServerName | +PUT | -e integration_server | write+ | ||
View integration server properties | SYSTEM.BROKER.AUTH | +INQ | read+ | ||
SYSTEM.BROKER.AUTH.integrationServerName | +INQ | -e integration_server | read+ | ||
Resource statistics | Start or stop resource statistics collection | SYSTEM.BROKER.AUTH | +INQ | read+ | |
SYSTEM.BROKER.AUTH.integrationServerName1 | +PUT | -e integration_server | write+ | ||
Report resource statistics | SYSTEM.BROKER.AUTH | +INQ | read+ | ||
SYSTEM.BROKER.AUTH.integrationServerName2 | +INQ | -e integration_server | read+ | ||
Message flows | Deploy | SYSTEM.BROKER.AUTH | +INQ | read+ | |
SYSTEM.BROKER.AUTH.integrationServerName | +PUT | -e integration_server | write+ | ||
List message flows and other deployed objects | SYSTEM.BROKER.AUTH | +INQ | read+ | ||
SYSTEM.BROKER.AUTH.integrationServerName | +INQ | -e integration_server | read+ | ||
Start or stop message flows | SYSTEM.BROKER.AUTH | +INQ | read+ | ||
SYSTEM.BROKER.AUTH.integrationServerName | +SET | -e integration_server | execute+ | ||
Delete resources from an integration server | SYSTEM.BROKER.AUTH | +INQ | read+ | ||
SYSTEM.BROKER.AUTH.integrationServerName | +PUT | -e integration_server | write+ | ||
Web user interface | Logon to the web user interface | SYSTEM.BROKER.AUTH | +INQ | read+ | |
Create, delete, or modify web users | SYSTEM.BROKER.AUTH | +PUT | write+ | ||
Changing a web user's password in the web user interface (supplying the old password) | SYSTEM.BROKER.AUTH | +INQ | read+ | ||
Record and replay | View recorded data with record and replay (bit stream or exception-list data) | SYSTEM.BROKER.DC.AUTH | +INQ | -o Data | read+ |
SYSTEM.BROKER.DC.AUTH.integrationServerName4 | +INQ | -e integration_server -o Data | read+ | ||
SYSTEM.BROKER.AUTH | +INQ | read+ | |||
Replay data | SYSTEM.BROKER.DC.AUTH | +INQ | -o Data | read+ | |
SYSTEM.BROKER.DC.AUTH.integrationServerName5 | +INQ +SET | -e integration_server -o Data | read+,execute+ | ||
Create or delete an MQ service in the Integration Registry | SYSTEM.BROKER.AUTH | +INQ +PUT | read+,write+ | ||
Create, update, or delete policies in the web user interface | SYSTEM.BROKER.AUTH | +INQ +PUT | read+,write+ | ||
Attach a policy to an integration server | SYSTEM.BROKER.AUTH.integrationServerName | +INQ +PUT | -e integration_server | read+,write+ | |
Flow exerciser | Enable flow recording for a message flow | SYSTEM.BROKER.AUTH | +INQ | read+ | |
SYSTEM.BROKER.AUTH.integrationServerName | +PUT | -e integration_server | write+ | ||
View recorded messages for a message flow | SYSTEM.BROKER.AUTH | +INQ | read+ | ||
SYSTEM.BROKER.AUTH.integrationServerName | +INQ | -e integration_server | read+ | ||
Clear recorded messages for a message flow | SYSTEM.BROKER.AUTH | +INQ | read+ | ||
SYSTEM.BROKER.AUTH.integrationServerName | +PUT | -e integration_server | write+ | ||
Inject a recorded message into a message flow | SYSTEM.BROKER.AUTH | +INQ | read+ | ||
SYSTEM.BROKER.AUTH.integrationServerName | +SET | -e integration_server | execute+ |
Task category | Tasks | LDAP security |
---|---|---|
LDAP permissions (set in .yaml configuration file) | ||
Integration node | Set integration node properties | 'write+' |
View integration node properties | 'read+' | |
Integration servers | Create or delete integration servers | 'write+' |
Rename integration servers | 'write+' | |
List integration servers | 'read+' | |
Start or stop integration servers | 'execute+' | |
Set integration server properties | 'write+' | |
View integration server properties | 'read+' |
Notes:
- If you are changing resource statistics collection for all integration servers on the integration node, you must grant execute authority for all integration servers.
- If you are reporting resource statistics collection for all integration servers on the integration node, you must grant read authority for all integration servers.
- In the queue name SYSTEM.BROKER.AUTH.integrationServerName, the integrationServerName refers to the name of your integration server.
- In the queue name SYSTEM.BROKER.AUTH.integrationServerName, the integrationServerName refers to the integration server that you configured for recording data. For more information, see Configuring data recording.
- In the queue name SYSTEM.BROKER.AUTH.integrationServerName, the integrationServerName refers to the integration server that you configured to view recorded data. For more information, see Replaying data.
- Where no object flag is specified on the mqsichangefileauth command, the file-based permissions are set at the level of the integration node.
If you grant a user ID authority at the integration node level (on queue SYSTEM.BROKER.AUTH), it does not inherit authority for integration servers. You must explicitly grant authority to all, or to individual, integration servers.