IBM MQ basics: security — part 3: object permissions

This time, I’ll be writ­ing about object per­mis­sions only.

Object per­mis­sions allow for fine-grained access con­trol to MQ objects (queues, top­ics, etc.). One can con­fig­ure an user to only be able to read from one spe­cif­ic queue and only write to another.

They can also be used to set­up groups of peo­ple act­ing as MQ admin­is­tra­tors, MQ oper­a­tors, etc.

Object per­mis­sions, called autho­riza­tions in MQ par­lance, are very impor­tant in MQ appli­ca­tion secu­ri­ty because it can pre­vent a user or appli­ca­tion with bad inten­tions to do harm.

With autho­riza­tions you can:

• Allow­ing only admin­is­tra­tors to issue com­mands to man­age MQ resources
• Allow­ing an appli­ca­tion user to “see” and use only the queues it needs access to.
• Lim­it­ing the oper­a­tions an appli­ca­tion can do on a queue, for exam­ple, one appli­ca­tion needs only to put mes­sages to a queue and not read them.

Pri­or to IBM MQ 7.1, on UNIX (at the time it was called IBM Web­Sphere MQ 7.1), one could only con­fig­ure object per­mis­sions based on Unix groups.

Autho­riza­tions can be con­fig­ured using the set­mqaut UNIX^® com­mand or the SET AUTHREC MQSC command.

The fol­low­ing com­mand grants dsp (dis­play) author­i­ty to user mqapp to the queue Q1.R in the queue man­ag­er MQ01:

set­mqaut ‑m MQ01 ‑t queue ‑n Q1.R ‑p mqapp +dsp

You can achieve the same with the fol­low­ing MQSC command:

SET AUTHREC OBJTYPE(QUEUE) PROFILE(Q1.R) PROFILE(‘mqapp’) AUTHADD(DSP)

The most com­mon­ly used autho­riza­tions for queues are list­ed in the fol­low­ing table (MQI are MQ API calls):

There are sev­er­al oth­er autho­riza­tions, but I’ll leave it up to you to fig­ure them out.

In addi­tion to indi­vid­ual autho­riza­tions, there are also the all, allmqi and alladm authorizations.

The all autho­riza­tion, as the name implies, includes all autho­riza­tions; the allmqi includes all MQ API autho­riza­tions and, final­ly, the alladm includes all admin­is­tra­tion authorizations.

The SET AUTHREC MQSC com­mand can be used to add sev­er­al autho­riza­tions at the same time:

SET AUTHREC OBJTYPE(QUEUE) PROFILE(LOCALQ1) PRINCIPAL(‘mqapp’) AUTHADD(GET,PUT,BROWSE)

To remove autho­riza­tions use the AUTHRMV direc­tive of the SET AUTHREC MQSC com­mand instead of AUTHADD:

SET AUTHREC OBJTYPE(QUEUE) PROFILE(LOCALQ1) PRINCIPAL(‘mqapp’) AUTHRMV(GET,PUT,BROWSE)

The above two autho­riza­tions can also be con­fig­ured from the UNIX com­mand line:

set­mqaut ‑m MQ01 ‑t queue ‑n LOCALQ1 ‑p mqapp +get +put +browse

and

set­mqaut ‑m MQ01 ‑t queue ‑n LOCALQ1 ‑p mqapp ‑get ‑put ‑browse

To check which autho­riza­tions a user or group has on a spe­cif­ic MQ object, for exam­ple, the queue LOCALQ1, just run the fol­low­ing command:

dsp­mqaut ‑m MQ01 ‑t queue ‑n LOCALQ1 ‑p mqapp

The out­put could be some­thing like:

Enti­ty mqapp has the fol­low­ing autho­riza­tions for object LOCALQ1:
get
browse
put

 The equiv­a­lent MQSC com­mand to the above is

DISPLAY AUTHREC OBJTYPE(QUEUE) PRINCIPAL(‘mqapp’) PROFILE(LOCALQ1)
4 : DISPLAY AUTHREC OBJTYPE(QUEUE) PRINCIPAL(‘mqapp’) PROFILE(LOCALQ1)
AMQ8864I: Dis­play author­i­ty record details.
PROFILE(LOCALQ1) ENTITY(mqm)
ENTTYPE(GROUP) OBJTYPE(QUEUE)
AUTHLIST(BROWSE,CHG,CLR,DLT,DSP,GET,INQ,PUT,PASSALL,PASSID,SET,SETALL,SETID)
AMQ8864I: Dis­play author­i­ty record details.
PROFILE(LOCALQ1) ENTITY(trindade)
ENTTYPE(GROUP) OBJTYPE(QUEUE)
AUTHLIST(BROWSE,GET,INQ,PUT,PASSALL,PASSID,SET,SETALL,SETID)

It’s also pos­si­ble to dump all autho­riza­tions with the dmp­mqaut command.

dmp­mqaut ‑m MQ01

With the dmp­mqaut com­mand it is also pos­si­ble to dump only autho­riza­tions spe­cif­ic to one object type, one user or user group or a spe­cif­ic MQ object. For that just use the -t, -p or -g and -n com­mand line options, respectively.

For exam­ple, to list all autho­riza­tions for queues in the MQ01 queue man­ag­er applied to user mquser, just use the command:

dmp­mqaut ‑m MQ01 ‑t queue ‑n LOCALQ1

There are oth­er autho­riza­tion types for oth­er object types (for, exam­ple, top­ics have the PUB autho­riza­tion that is need­ed for “writ­ing” – pub­lish­ing – to a top­ic). Per­haps some oth­er article…