Potkay, Peter M (CTO Architecture + Engineering)
2013-11-20 23:12:09 UTC
My PMR finally got closed as "working as designed". Dang - I'm 0 for 2 on my last 2 PMRs where I think something is wrong but they say it's working as designed and just open up a RFQ. (My other one was where dmpmqcfg didn't get 100% of the records a QM had for MQ AUTHs).
So here is my RFQ for Websphere Message Broker Explorer to be enhanced so that it doesn't require the MQ Admin to configure a SVRCONN channel that is wide open to the world so that MBX can show Accounting and Statistics data. Please vote if you think its worthwhile.
http://www.ibm.com/developerworks/rfe/execute?use_case=viewRfe&CR_ID=41900
Headline:
Allow your existing secure channel connection in MBX to view Accounting and Statistics data
RFQ ID:
41900
PMR ID:
66477,L6Q,000
Submitter:
PPotkay
Company:
Hartford Fire Insurance Compan
Submitter's ranking of priority:
Medium - Lack of the RFE functionality is a minor road block to deployment/adoption
Brand:
WebSphere
Product family:
Connectivity and Integration
Product:
IBM Integration Bus (WebSphere Message Broker)
Description:
Please enhance Message Broker Explorer to use one SVRCONN channel for all communucations with the Broker, including Accounting and Statistics. Currently we have to use a secondary channel for Accounting andd Statistics in MBX. And there is no way to specify any details for that channel other than the name, so we can't use SSL or an Exit. So while we are already connected in MBX to the Broker over a properly authenticated and authorized channel, to use Accounting and Statistcs via MBX we have to configure an unsecure channel on the queue manager and start up another connection. I opened a PMR but it concluded that requiring a second channel that is wide open from an MQ security perspective is "working as designed".
Use case:
Broker is WMB 8.0.0.3 on a Linux server with MQ 7.5.0.2
MBX 8.0.0.2 is running on a Windows 7 PC with MQ 7.5.0.2
I connect to the Broker in MBX 8.0 over a SVRCONN channel that has a Security Exit configured on it. This insures that only authenticated users can connect to the queue manager over this channel. The queue manager is otherwise secure with no other way for an unauthenticated user to connect.
I am attempting Accounting and Statistics thru MBX as described here.
http://publib.boulder.ibm.com/infocenter/wmbhelp/v8r0m0/topic/com.ibm.etools.mft.doc/bj10420_.htm
Even though I have a secure connection to the broker's Queue Manager in MBX already, viewing the Statistics window wants to open up ANOTHER channel connection to the QM, over SYSTEM.DEF.SVRCONN no less.
I could not find a way around this, so I found the place where I can choose to put the channel name for the 'statistics' connection. And
the only input field is the name of the channel. There is no place to specify SSL or Security Exit info. In my case that means the connection
attempt for this secondary channel is properly rejected by the Security Exit on the Queue Manager.
If I temporarily configure a secondary SVRCONN channel with no security for this secondary connection it works.
To get MBX to work with Accounting and Statistics requires opening up a unsecure channel to the Queue Manager. Please enhance MBX so that it allows us to specify all the connection details we need to make secure connections to the queue manager, even for the Accounting and Statistics channel. But ideally, remove the requirement to make a second connection at all - MBX already has a proper connection to the queue manager, why not use that connection for Accounting and Statistics as well?
Peter Potkay
From: MQSeries List [mailto:MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org] On Behalf Of Potkay, Peter M (CTO Architecture + Engineering)
Sent: Friday, September 27, 2013 2:38 PM
To: MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org
Subject: Viewing accounting and statistics data in MBX
So, thought I'd give this a whirl.
http://publib.boulder.ibm.com/infocenter/wmbhelp/v8r0m0/topic/com.ibm.etools.mft.doc/bj10420_.htm
First problem, even though I have a secure connection to the broker's Queue Manager in MBX already, viewing the Statistics window seems to feel the need to want to open up ANOTHER channel connection to the QM, over SYSTEM.DEF.SVRCONN no less.
Fine, I find the place where I can choose to put the channel name for this 'statistics' connection. And the only input field is the name of the channel. There is no place to specify SSL or Security Exit info. So of course the connection is properly rejected by the exit on the Queue Manager.
If I temporarily configure a wide open channel for this secondary connection it works.
So, as annoying as it is that I have to open a second channel even though I already have a perfectly good, properly authenticated and properly authorized connection already, I can deal with specifying another channel name.
Can someone tell me how to make this secondary connection work over a SVRCONN channel that has SSL and/or an Exit?
Peter Potkay
************************************************************
This communication, including attachments, is for the exclusive use of addressee and may contain proprietary, confidential and/or privileged information. If you are not the intended recipient, any use, copying, disclosure, dissemination or distribution is strictly prohibited. If you are not the intended recipient, please notify the sender immediately by return e-mail, delete this communication and destroy all copies.
************************************************************
________________________________
List Archive<http://listserv.meduniwien.ac.at/archives/mqser-l.html> - Manage Your List Settings<http://listserv.meduniwien.ac.at/cgi-bin/wa?SUBED1=mqser-l&A=1> - Unsubscribe<mailto:LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org?subject=Unsubscribe&BODY=signoff%20mqseries>
Instructions for managing your mailing list subscription are provided in the Listserv General Users Guide available at http://www.lsoft.com<http://www.lsoft.com/resources/manuals.asp>
************************************************************
This communication, including attachments, is for the exclusive use of addressee and may contain proprietary, confidential and/or privileged information. If you are not the intended recipient, any use, copying, disclosure, dissemination or distribution is strictly prohibited. If you are not the intended recipient, please notify the sender immediately by return e-mail, delete this communication and destroy all copies.
************************************************************
To unsubscribe, write to LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org and,
in the message body (not the subject), write: SIGNOFF MQSERIES
Instructions for managing your mailing list subscription are provided in
the Listserv General Users Guide available at http://www.lsoft.com
Archive: http://listserv.meduniwien.ac.at/archives/mqser-l.html
So here is my RFQ for Websphere Message Broker Explorer to be enhanced so that it doesn't require the MQ Admin to configure a SVRCONN channel that is wide open to the world so that MBX can show Accounting and Statistics data. Please vote if you think its worthwhile.
http://www.ibm.com/developerworks/rfe/execute?use_case=viewRfe&CR_ID=41900
Headline:
Allow your existing secure channel connection in MBX to view Accounting and Statistics data
RFQ ID:
41900
PMR ID:
66477,L6Q,000
Submitter:
PPotkay
Company:
Hartford Fire Insurance Compan
Submitter's ranking of priority:
Medium - Lack of the RFE functionality is a minor road block to deployment/adoption
Brand:
WebSphere
Product family:
Connectivity and Integration
Product:
IBM Integration Bus (WebSphere Message Broker)
Description:
Please enhance Message Broker Explorer to use one SVRCONN channel for all communucations with the Broker, including Accounting and Statistics. Currently we have to use a secondary channel for Accounting andd Statistics in MBX. And there is no way to specify any details for that channel other than the name, so we can't use SSL or an Exit. So while we are already connected in MBX to the Broker over a properly authenticated and authorized channel, to use Accounting and Statistcs via MBX we have to configure an unsecure channel on the queue manager and start up another connection. I opened a PMR but it concluded that requiring a second channel that is wide open from an MQ security perspective is "working as designed".
Use case:
Broker is WMB 8.0.0.3 on a Linux server with MQ 7.5.0.2
MBX 8.0.0.2 is running on a Windows 7 PC with MQ 7.5.0.2
I connect to the Broker in MBX 8.0 over a SVRCONN channel that has a Security Exit configured on it. This insures that only authenticated users can connect to the queue manager over this channel. The queue manager is otherwise secure with no other way for an unauthenticated user to connect.
I am attempting Accounting and Statistics thru MBX as described here.
http://publib.boulder.ibm.com/infocenter/wmbhelp/v8r0m0/topic/com.ibm.etools.mft.doc/bj10420_.htm
Even though I have a secure connection to the broker's Queue Manager in MBX already, viewing the Statistics window wants to open up ANOTHER channel connection to the QM, over SYSTEM.DEF.SVRCONN no less.
I could not find a way around this, so I found the place where I can choose to put the channel name for the 'statistics' connection. And
the only input field is the name of the channel. There is no place to specify SSL or Security Exit info. In my case that means the connection
attempt for this secondary channel is properly rejected by the Security Exit on the Queue Manager.
If I temporarily configure a secondary SVRCONN channel with no security for this secondary connection it works.
To get MBX to work with Accounting and Statistics requires opening up a unsecure channel to the Queue Manager. Please enhance MBX so that it allows us to specify all the connection details we need to make secure connections to the queue manager, even for the Accounting and Statistics channel. But ideally, remove the requirement to make a second connection at all - MBX already has a proper connection to the queue manager, why not use that connection for Accounting and Statistics as well?
Peter Potkay
From: MQSeries List [mailto:MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org] On Behalf Of Potkay, Peter M (CTO Architecture + Engineering)
Sent: Friday, September 27, 2013 2:38 PM
To: MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org
Subject: Viewing accounting and statistics data in MBX
So, thought I'd give this a whirl.
http://publib.boulder.ibm.com/infocenter/wmbhelp/v8r0m0/topic/com.ibm.etools.mft.doc/bj10420_.htm
First problem, even though I have a secure connection to the broker's Queue Manager in MBX already, viewing the Statistics window seems to feel the need to want to open up ANOTHER channel connection to the QM, over SYSTEM.DEF.SVRCONN no less.
Fine, I find the place where I can choose to put the channel name for this 'statistics' connection. And the only input field is the name of the channel. There is no place to specify SSL or Security Exit info. So of course the connection is properly rejected by the exit on the Queue Manager.
If I temporarily configure a wide open channel for this secondary connection it works.
So, as annoying as it is that I have to open a second channel even though I already have a perfectly good, properly authenticated and properly authorized connection already, I can deal with specifying another channel name.
Can someone tell me how to make this secondary connection work over a SVRCONN channel that has SSL and/or an Exit?
Peter Potkay
************************************************************
This communication, including attachments, is for the exclusive use of addressee and may contain proprietary, confidential and/or privileged information. If you are not the intended recipient, any use, copying, disclosure, dissemination or distribution is strictly prohibited. If you are not the intended recipient, please notify the sender immediately by return e-mail, delete this communication and destroy all copies.
************************************************************
________________________________
List Archive<http://listserv.meduniwien.ac.at/archives/mqser-l.html> - Manage Your List Settings<http://listserv.meduniwien.ac.at/cgi-bin/wa?SUBED1=mqser-l&A=1> - Unsubscribe<mailto:LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org?subject=Unsubscribe&BODY=signoff%20mqseries>
Instructions for managing your mailing list subscription are provided in the Listserv General Users Guide available at http://www.lsoft.com<http://www.lsoft.com/resources/manuals.asp>
************************************************************
This communication, including attachments, is for the exclusive use of addressee and may contain proprietary, confidential and/or privileged information. If you are not the intended recipient, any use, copying, disclosure, dissemination or distribution is strictly prohibited. If you are not the intended recipient, please notify the sender immediately by return e-mail, delete this communication and destroy all copies.
************************************************************
To unsubscribe, write to LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org and,
in the message body (not the subject), write: SIGNOFF MQSERIES
Instructions for managing your mailing list subscription are provided in
the Listserv General Users Guide available at http://www.lsoft.com
Archive: http://listserv.meduniwien.ac.at/archives/mqser-l.html