IBM WebSphere V5.0 Security - CGISecurity

The authority service component provided with WebSphere MQ is called the
Object Authority Manager (OAM). The OAM is automatically enabled for each
queue manager. If you do not want any authority checks, you can disable the
OAM.
The OAM maintains an access control list (ACL) for each WebSphere MQ object
it is controlling access to. On UNIX systems only group IDs can appear in an
ACL. This means that all members of a group have the same authority. On
Windows, both user IDs and group IDs can appear in an ACL. This means that
authorities can be granted to individual users as well as groups. The control
command setmqaut grants and revokes authorities and is used to maintain ACL.
You can specify any number of authorizations in a single command. For
example, the list of authorizations permits a user or group to put messages on
the queue and to browse them, but to revoke access to get messages the
follwing is used:
+put +browse -get
The following example shows how to use the setmqaut command to grant and
revoke permissions to use an object.
setmqaut -m QM1 -t queue -n ITSO.QUEUE -g ITSOGROUP +put +browse -get
In this example:
► QM1 is the Queue Manager.
► queue is the object type.
► ITSO.QUEUE is the object name.
► ITSOGROUP is the identifier of the group whose authorizations are to change.
► +put +browse -get is the authorization list for the specified queue:
– +put adds authorization to put (MQPUT) messages on the queue
– +browse adds the authorization to browse messages on the queue (to
issue MQGET with the browse option)
– -get removes authorization to get (MQGET) messages from the queue
SSL Support
Many times, it is required to secure data transmitting over an insecure network.
WebSphere MQ supports SSL Version 3.0 on UNIX (installed with WebSphere
MQ), Windows (Windows 200 has SSL support integral to the operating
systems) and z/OS (SSL support is integral to the z/OS operating system).
168 IBM WebSphere V5.0 Security Handbook