If you want security checking for commands (so you have not defined the command security switch profile hlq.NO.CMD.CHECKS) you must add profiles to the MQCMDS class.
The same security profiles control both MQSC and PCF commands. The names of the RACF(R) profiles for command security checking are based on the MQSC command names themselves. These profiles take the form:
hlq.verb.pkw
where hlq can be either qmgr-name (queue manager name) or qsg-name (queue-sharing group name).
For example, the profile name for the ALTER QLOCAL command in subsystem CSQ1 is:
CSQ1.ALTER.QLOCAL
A profile prefixed by the queue manager name controls the use of the command on that queue manager. A profile prefixed by the queue-sharing group name controls the use of the command on all queue managers within the queue-sharing group. This access can be overridden on an individual queue manager by defining a queue-manager level profile for that command on that queue manager.
If your queue manager is a member of a queue-sharing group and you are using both queue manager and queue-sharing group level security, WebSphere MQ checks for a profile prefixed by the queue manager name first. If it does not find one, it looks for a profile prefixed by the queue-sharing group name.
By setting up command profiles at queue manager level, a user can be restricted from issuing commands on a particular queue manager. Alternatively, you can define one profile for a queue-sharing group for each command verb, and all security checks take place against that profile instead of individual queue managers.
If both subsystem security and queue-sharing group security are active and a local profile is not found, a command security check is performed to see if the user has access to a queue-sharing group profile.
If you use the CMDSCOPE attribute to route a command to other queue managers in a queue-sharing group, security is checked on each queue manager where the command is executed, but not necessarily on the queue manager where the command is entered.
Table 48 shows, for each WebSphere MQ MQSC command, the profiles required for command security checking to be carried out, and the corresponding access level for each profile in the MQCMDS class.
Table 49 shows, for each WebSphere MQ PCF command, the profiles required for command security checking to be carried out, and the corresponding access level for each profile in the MQCMDS class.
Command | Command profile for MQCMDS | Access level for MQCMDS | Command resource profile for MQADMIN | Access level for MQADMIN |
---|---|---|---|---|
ALTER AUTHINFO | hlq.ALTER.AUTHINFO | ALTER | hlq.AUTHINFO.resourcename | ALTER |
ALTER BUFFPOOL | hlq.ALTER.BUFFPOOL | ALTER | No check | - |
ALTER CFSTRUCT | hlq.ALTER.CFSTRUCT | ALTER | No check | - |
ALTER CHANNEL | hlq.ALTER.CHANNEL | ALTER | hlq.CHANNEL.channel | ALTER |
ALTER NAMELIST | hlq.ALTER.NAMELIST | ALTER | hlq.NAMELIST.namelist | ALTER |
ALTER PROCESS | hlq.ALTER.PROCESS | ALTER | hlq.PROCESS.process | ALTER |
ALTER PSID |
hlq.ALTER.PSID | ALTER | No check | - |
ALTER QALIAS | hlq.ALTER.QALIAS | ALTER | hlq.QUEUE.queue | ALTER |
ALTER QLOCAL | hlq.ALTER.QLOCAL | ALTER | hlq.QUEUE.queue | ALTER |
ALTER QMGR | hlq.ALTER.QMGR | ALTER | No check | - |
ALTER QMODEL | hlq.ALTER.QMODEL | ALTER | hlq.QUEUE.queue | ALTER |
ALTER QREMOTE | hlq.ALTER.QREMOTE | ALTER | hlq.QUEUE.queue | ALTER |
ALTER SECURITY | hlq.ALTER.SECURITY | ALTER | No check | - |
ALTER STGCLASS | hlq.ALTER.STGCLASS | ALTER | No check | - |
ALTER TRACE | hlq.ALTER.TRACE | ALTER | No check | - |
ARCHIVE LOG | hlq.ARCHIVE.LOG | CONTROL | No check | - |
BACKUP CFSTRUCT | hlq.BACKUP.CFSTRUCT | CONTROL | No check | - |
CLEAR QLOCAL | hlq.CLEAR.QLOCAL | ALTER | hlq.QUEUE.queue | ALTER |
DEFINE AUTHINFO | hlq.DEFINE.AUTHINFO | ALTER | hlq.AUTHINFO.resourcename | ALTER |
DEFINE BUFFPOOL | hlq.DEFINE.BUFFPOOL | ALTER | No check | - |
DEFINE CFSTRUCT | hlq.DEFINE.CFSTRUCT | ALTER | No check | - |
DEFINE CHANNEL | hlq.DEFINE.CHANNEL | ALTER | hlq.CHANNEL.channel | ALTER |
DEFINE MAXSMSGS | hlq.DEFINE.MAXSMSGS | ALTER | No check | - |
DEFINE NAMELIST | hlq.DEFINE.NAMELIST | ALTER | hlq.NAMELIST.namelist | ALTER |
DEFINE PROCESS | hlq.DEFINE.PROCESS | ALTER | hlq.PROCESS.process | ALTER |
DEFINE PSID | hlq.DEFINE.PSID | ALTER | No check | - |
DEFINE QALIAS | hlq.DEFINE.QALIAS | ALTER | hlq.QUEUE.queue | ALTER |
DEFINE QLOCAL | hlq.DEFINE.QLOCAL | ALTER | hlq.QUEUE.queue | ALTER |
DEFINE QMODEL | hlq.DEFINE.QMODEL | ALTER | hlq.QUEUE.queue | ALTER |
DEFINE QREMOTE | hlq.DEFINE.QREMOTE | ALTER | hlq.QUEUE.queue | ALTER |
DEFINE STGCLASS | hlq.DEFINE.STGCLASS | ALTER | No check | - |
DELETE AUTHINFO | hlq.DELETE.AUTHINFO | ALTER | hlq.AUTHINFO.resourcename | ALTER |
DELETE BUFFPOOL | hlq.DELETE.BUFFPOOL | ALTER | No check | - |
DELETE CFSTRUCT | hlq.DELETE.CFSTRUCT | ALTER | No check | - |
DELETE CHANNEL | hlq.DELETE.CHANNEL | ALTER | hlq.CHANNEL.channel | ALTER |
DELETE NAMELIST | hlq.DELETE.NAMELIST | ALTER | hlq.NAMELIST.namelist | ALTER |
DELETE PROCESS | hlq.DELETE.PROCESS | ALTER | hlq.PROCESS.process | ALTER |
DELETE PSID | hlq.DELETE.PSID | ALTER | No check | - |
DELETE QALIAS | hlq.DELETE.QALIAS | ALTER | hlq.QUEUE.queue | ALTER |
DELETE QLOCAL | hlq.DELETE.QLOCAL | ALTER | hlq.QUEUE.queue | ALTER |
DELETE QMODEL | hlq.DELETE.QMODEL | ALTER | hlq.QUEUE.queue | ALTER |
DELETE QREMOTE | hlq.DELETE.QREMOTE | ALTER | hlq.QUEUE.queue | ALTER |
DELETE STGCLASS | hlq.DELETE.STGCLASS | ALTER | No check | - |
DISPLAY ARCHIVE (1) | hlq.DISPLAY.ARCHIVE | READ | No check | - |
DISPLAY AUTHINFO | hlq.DISPLAY.AUTHINFO | READ | No check | - |
DISPLAY CFSTATUS | hlq.DISPLAY.CFSTATUS | READ | No check | - |
DISPLAY CFSTRUCT | hlq.DISPLAY.CFSTRUCT | READ | No check | - |
DISPLAY CHANNEL | hlq.DISPLAY.CHANNEL | READ | No check | - |
DISPLAY CHINIT | hlq.DISPLAY.CHINIT | READ | No check | - |
DISPLAY CHSTATUS | hlq.DISPLAY.CHSTATUS | READ | No check | - |
DISPLAY CLUSQMGR | hlq.DISPLAY.CLUSQMGR | READ | No check | - |
DISPLAY CMDSERV | hlq.DISPLAY.CMDSERV | READ | No check | - |
DISPLAY CONN (1) | hlq.DISPLAY.CONN | READ | No check | - |
DISPLAY GROUP | hlq.DISPLAY.GROUP | READ | No check | - |
DISPLAY LOG (1) | hlq.DISPLAY.LOG | READ | No check | - |
DISPLAY MAXSMSGS | hlq.DISPLAY.MAXSMSGS | READ | No check | - |
DISPLAY NAMELIST | hlq.DISPLAY.NAMELIST | READ | No check | - |
DISPLAY PROCESS | hlq.DISPLAY.PROCESS | READ | No check | - |
DISPLAY QALIAS | hlq.DISPLAY.QALIAS | READ | No check | - |
DISPLAY QCLUSTER | hlq.DISPLAY.QCLUSTER | READ | No check | - |
DISPLAY QLOCAL | hlq.DISPLAY.QLOCAL | READ | No check | - |
DISPLAY QMGR | hlq.DISPLAY.QMGR | READ | No check | - |
DISPLAY QMODEL | hlq.DISPLAY.QMODEL | READ | No check | - |
DISPLAY QREMOTE | hlq.DISPLAY.QREMOTE | READ | No check | - |
DISPLAY QSTATUS | hlq.DISPLAY.QSTATUS | READ | No check | - |
DISPLAY QUEUE | hlq.DISPLAY.QUEUE | READ | No check | - |
DISPLAY SECURITY | hlq.DISPLAY.SECURITY | READ | No check | - |
DISPLAY STGCLASS | hlq.DISPLAY.STGCLASS | READ | No check | - |
DISPLAY SYSTEM (1) | hlq.DISPLAY.SYSTEM | READ | No check | - |
DISPLAY THREAD | hlq.DISPLAY.THREAD | READ | No check | - |
DISPLAY TRACE | hlq.DISPLAY.TRACE | READ | No check | - |
DISPLAY USAGE (1) | hlq.DISPLAY.USAGE | READ | No check | - |
MOVE QLOCAL | hlq.MOVE.QLOCAL | ALTER | hlq.QUEUE.from-queue hlq.QUEUE.to-queue | ALTER |
PING CHANNEL | hlq.PING.CHANNEL | CONTROL | hlq.CHANNEL.channel | CONTROL |
RECOVER BSDS | hlq.RECOVER.BSDS | CONTROL | No check | - |
RECOVER CFSTRUCT | hlq.RECOVER.CFSTRUCT | CONTROL | No check | - |
REFRESH CLUSTER | hlq.REFRESH.CLUSTER | ALTER | No check | - |
REFRESH QMGR | hlq.REFRESH.QMGR | ALTER | No check | - |
REFRESH SECURITY | hlq.REFRESH.SECURITY | ALTER | No check | - |
RESET CHANNEL | hlq.RESET.CHANNEL | CONTROL | hlq.CHANNEL.channel | CONTROL |
RESET CLUSTER | hlq.RESET.CLUSTER | CONTROL | No check | - |
RESET QSTATS | hlq.RESET.QSTATS | CONTROL | hlq.QUEUE.queue | CONTROL |
RESET TPIPE | hlq.RESET.TPIPE | CONTROL | No check | - |
RESOLVE CHANNEL | hlq.RESOLVE.CHANNEL | CONTROL | hlq.CHANNEL.channel | CONTROL |
RESOLVE INDOUBT | hlq.RESOLVE.INDOUBT | CONTROL | No check | - |
RESUME QMGR | hlq.RESUME.QMGR | CONTROL | No check | - |
RVERIFY SECURITY | hlq.RVERIFY.SECURITY | ALTER | No check | - |
SET ARCHIVE | hlq.SET.ARCHIVE | CONTROL | No check | - |
SET LOG | hlq.SET.LOG | CONTROL | No check | - |
SET SYSTEM | hlq,SET.SYSTEM | CONTROL | No check | - |
START CHANNEL | hlq.START.CHANNEL | CONTROL | hlq.CHANNEL.channel | CONTROL |
START CHINIT | hlq.START.CHINIT | CONTROL | No check | - |
START CMDSERV | hlq.START.CMDSERV | CONTROL | No check | - |
START LISTENER | hlq.START.LISTENER | CONTROL | No check | - |
START QMGR | None (2) | - | - | - |
START TRACE | hlq.START.TRACE | CONTROL | No check | - |
STOP CHANNEL | hlq.STOP.CHANNEL | CONTROL | hlq.CHANNEL.channel | CONTROL |
STOP CHINIT | hlq.STOP.CHINIT | CONTROL | No check | - |
STOP CMDSERV | hlq.STOP.CMDSERV | CONTROL | No check | - |
STOP LISTENER | hlq.STOP.LISTENER | CONTROL | No check | - |
STOP QMGR | hlq.STOP.QMGR | CONTROL | No check | - |
STOP TRACE | hlq.STOP.TRACE | CONTROL | No check | - |
SUSPEND QMGR | hlq.SUSPEND.QMGR | CONTROL | No check | - |
Notes:
|
Command | Command profile for MQCMDS | Access level for MQCMDS | Command resource profile for MQADMIN | Access level for MQADMIN |
---|---|---|---|---|
Backup CF Structure | hlq.BACKUP.CFSTRUCT | CONTROL | No check | - |
Change Authentication Information Object | hlq.ALTER.AUTHINFO | ALTER | hlq.AUTHINFO.resourcename | ALTER |
Change CF Structure | hlq.ALTER.CFSTRUCT | ALTER | No check | - |
Change Channel | hlq.ALTER.CHANNEL | ALTER | hlq.CHANNEL.channel | ALTER |
Change Namelist | hlq.ALTER.NAMELIST | ALTER | hlq.NAMELIST.namelist | ALTER |
Change Process | hlq.ALTER.PROCESS | ALTER | hlq.PROCESS.process | ALTER |
Change Queue | hlq.ALTER.QUEUE | ALTER | hlq.QUEUE.queue | ALTER |
Change Queue Manager | hlq.ALTER.QMGR | ALTER | No check | - |
Change Security | hlq.ALTER.SECURITY | ALTER | No check | - |
Change Storage Class | hlq.ALTER.STGCLASS | ALTER | No check | - |
Clear Queue | hlq.CLEAR.QLOCAL | ALTER | hlq.QUEUE.queue | ALTER |
Copy Authentication Information Object | hlq.DEFINE.AUTHINFO | ALTER | hlq.AUTHINFO.resourcename | ALTER |
Copy CF Structure | hlq.DEFINE.CFSTRUCT | ALTER | No check | - |
Copy Channel | hlq.DEFINE.CHANNEL | ALTER | hlq.CHANNEL.channel | ALTER |
Copy Namelist | hlq.DEFINE.NAMELIST | ALTER | hlq.NAMELIST.namelist | ALTER |
Copy Process | hlq.DEFINE.PROCESS | ALTER | hlq.PROCESS.process | ALTER |
Copy Queue | hlq.DEFINE.QUEUE | ALTER | hlq.QUEUE.queue | ALTER |
Copy Storage Class | hlq.DEFINE.STGCLASS | ALTER | No check | - |
Create Authentication Information Object | hlq.DEFINE.AUTHINFO | ALTER | hlq.AUTHINFO.resourcename | ALTER |
Create CF Structure | hlq.DEFINE.CFSTRUCT | ALTER | No check | - |
Create Channel | hlq.DEFINE.CHANNEL | ALTER | hlq.CHANNEL.channel | ALTER |
Create Namelist | hlq.DEFINE.NAMELIST | ALTER | hlq.NAMELIST.namelist | ALTER |
Create Process | hlq.DEFINE.PROCESS | ALTER | hlq.PROCESS.process | ALTER |
Create Queue | hlq.DEFINE.QUEUE | ALTER | hlq.QUEUE.queue | ALTER |
Create Storage Class | hlq.DEFINE.STGCLASS | ALTER | No check | - |
Delete Authentication Information Object | hlq.DELETE.AUTHINFO | ALTER | hlq.AUTHINFO.resourcename | ALTER |
Delete CF Structure | hlq.DELETE.CFSTRUCT | ALTER | No check | - |
Delete Channel | hlq.DELETE.CHANNEL | ALTER | hlq.CHANNEL.channel | ALTER |
Delete Namelist | hlq.DELETE.NAMELIST | ALTER | hlq.NAMELIST.namelist | ALTER |
Delete Process | hlq.DELETE.PROCESS | ALTER | hlq.PROCESS.process | ALTER |
Delete Queue | hlq.DELETE.QUEUE | ALTER | hlq.QUEUE.queue | ALTER |
Delete Storage Class | hlq.DELETE.STGCLASS | ALTER | No check | - |
Inquire Archive | hlq.DISPLAY.ARCHIVE | READ | No check | - |
Inquire Authentication Information Object | hlq.DISPLAY.AUTHINFO | READ | No check | - |
Inquire Authentication Information Object Names | hlq.DISPLAY.AUTHINFO | READ | No check | - |
Inquire CF Structure | hlq.DISPLAY.CFSTRUCT | READ | No check | - |
Inquire CF Structure Names | hlq.DISPLAY.CFSTRUCT | READ | No check | - |
Inquire CF Structure Status | hlq.DISPLAY.CFSTATUS | READ | No check | - |
Inquire Channel | hlq.DISPLAY.CHANNEL | READ | No check | - |
Inquire Channel Initiator | hlq.DISPLAY.CHINIT | READ | No check | - |
Inquire Channel Names | hlq.DISPLAY.CHANNEL | READ | No check | - |
Inquire Channel Status | hlq.DISPLAY.CHSTATUS | READ | No check | - |
Inquire Cluster Queue Manager | hlq.DISPLAY.CLUSQMGR | READ | No check | - |
Inquire Connection | hlq.DISPLAY.CONN | READ | No check | - |
Inquire Group | hlq.DISPLAY.GROUP | READ | No check | - |
Inquire Log | hlq.DISPLAY.LOG | READ | No check | - |
Inquire Namelist | hlq.DISPLAY.NAMELIST | READ | No check | - |
Inquire Namelist Names | hlq.DISPLAY.NAMELIST | READ | No check | - |
Inquire Process | hlq.DISPLAY.PROCESS | READ | No check | - |
Inquire Process Names | hlq.DISPLAY.PROCESS | READ | No check | - |
Inquire Queue | hlq.DISPLAY.QUEUE | READ | No check | - |
Inquire Queue Manager | hlq.DISPLAY.QMGR | READ | No check | - |
Inquire Queue Names | hlq.DISPLAY.QUEUE | READ | No check | - |
Inquire Queue Status | hlq.DISPLAY.QSTATUS | READ | No check | - |
Inquire Security | hlq.DISPLAY.SECURITY | READ | No check | - |
Inquire Storage Class | hlq.DISPLAY.STGCLASS | READ | No check | - |
Inquire Storage Class Names | hlq.DISPLAY.STGCLASS | READ | No check | - |
Inquire System | hlq.DISPLAY.SYSTEM | READ | No check | - |
Inquire Usage | hlq.DISPLAY.USAGE | READ | No check | - |
Move Queue | hlq.MOVE.QLOCAL | ALTER | hlq.QUEUE.from-queue hlq.QUEUE.to-queue | ALTER |
Ping Channel | hlq.PING.CHANNEL | CONTROL | hlq.CHANNEL.channel | CONTROL |
Recover CF Structure | hlq.RECOVER.CFSTRUCT | CONTROL | No check | - |
Refresh Cluster | hlq.REFRESH.CLUSTER | ALTER | No check | - |
Refresh Queue Manager | hlq.REFRESH.QMGR | ALTER | No check | - |
Refresh Security | hlq.REFRESH.SECURITY | ALTER | No check | - |
Reset Channel | hlq.RESET.CHANNEL | CONTROL | hlq.CHANNEL.channel | CONTROL |
Reset Cluster | hlq.RESET.CLUSTER | CONTROL | No check | - |
Reset Queue Statistics | hlq.RESET.QSTATS | CONTROL | hlq.QUEUE.queue | CONTROL |
Resolve Channel | hlq.RESOLVE.CHANNEL | CONTROL | hlq.CHANNEL.channel | CONTROL |
Resume Queue Manager | hlq.RESUME.QMGR | CONTROL | No check | - |
Resume Queue Manager Cluster | hlq.RESUME.QMGR | CONTROL | No check | - |
Reverify Security | hlq.RVERIFY.SECURITY | ALTER | No check | - |
Set Archive | hlq.SET.ARCHIVE | CONTROL | No check | - |
Set Log | hlq.SET.LOG | CONTROL | No check | - |
Set System | hlq,SET.SYSTEM | CONTROL | No check | - |
Start Channel | hlq.START.CHANNEL | CONTROL | hlq.CHANNEL.channel | CONTROL |
Start Channel Initiator | hlq.START.CHINIT | CONTROL | No check | - |
Start Channel Listener | hlq.START.LISTENER | CONTROL | No check | - |
Stop Channel | hlq.STOP.CHANNEL | CONTROL | hlq.CHANNEL.channel | CONTROL |
Stop Channel Initiator | hlq.STOP.CHINIT | CONTROL | No check | - |
Stop Channel Listener | hlq.STOP.LISTENER | CONTROL | No check | - |
Suspend Queue Manager | hlq.SUSPEND.QMGR | CONTROL | No check | - |
Suspend Queue Manager Cluster | hlq.SUSPEND.QMGR | CONTROL | No check | - |
Notices |
Downloads |
Library |
Support |
Feedback
![]() ![]() |
csq83bj |