Discussion:
SET AUTHREC versus setmqaut
Potkay, Peter M (CTO Architecture + Engineering)
2013-10-23 14:07:33 UTC
Permalink
Is there any reason to take the time and effort of rewriting my setmqaut scripts into SET AUTHREC commands?

So far the only reason I came up with is that then my standard runmqsc script I use for new QMs could also take care of the security stuff, versus having to run a second script specific to setmqaut.


Are AUTHREC just another way of doing the same thing?
Is setmqaut on the Endangered Species List, so sooner or later I'm gonna have to switch anyway?
Does AUTHREC provide or remove capability compared to setmqaut?

Google doesn't know.....
The new AUTHREC isn't addressed in the Info Center in the "Changed behavior between v6.0 and V7.5" section.


Peter Potkay




************************************************************
This communication, including attachments, is for the exclusive use of addressee and may contain proprietary, confidential and/or privileged information. If you are not the intended recipient, any use, copying, disclosure, dissemination or distribution is strictly prohibited. If you are not the intended recipient, please notify the sender immediately by return e-mail, delete this communication and destroy all copies.
************************************************************

To unsubscribe, write to LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org and,
in the message body (not the subject), write: SIGNOFF MQSERIES
Instructions for managing your mailing list subscription are provided in
the Listserv General Users Guide available at http://www.lsoft.com
Archive: http://listserv.meduniwien.ac.at/archives/mqser-l.html
T.Rob
2013-10-23 14:38:11 UTC
Permalink
For what it's worth the conversion is pretty easy. Run your setmqaut
scripts, then run dmpmqcfg to spit out the SET AUTHREC equivalents.



Personally, it's worth the trouble to me to convert. The setmqaut commands
need to be run from the command line locally and in many shops end up in
different change control systems, sitting on the local filesystem, etc. I
like it much better that I can define an object and then define the ACLs for
that object immediately adjacent to it in the script, that it's one script,
that it can be run remotely, etc.



But then I script everything so YMMV.



-- T.Rob





From: MQSeries List [mailto:MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org] On Behalf Of
Potkay, Peter M (CTO Architecture + Engineering)
Sent: Wednesday, October 23, 2013 10:08 AM
To: MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org
Subject: SET AUTHREC versus setmqaut



Is there any reason to take the time and effort of rewriting my setmqaut
scripts into SET AUTHREC commands?



So far the only reason I came up with is that then my standard runmqsc
script I use for new QMs could also take care of the security stuff, versus
having to run a second script specific to setmqaut.





Are AUTHREC just another way of doing the same thing?

Is setmqaut on the Endangered Species List, so sooner or later I'm gonna
have to switch anyway?

Does AUTHREC provide or remove capability compared to setmqaut?



Google doesn't know...

The new AUTHREC isn't addressed in the Info Center in the "Changed behavior
between v6.0 and V7.5" section.





Peter Potkay







************************************************************
This communication, including attachments, is for the exclusive use of
addressee and may contain proprietary, confidential and/or privileged
information. If you are not the intended recipient, any use, copying,
disclosure, dissemination or distribution is strictly prohibited. If you
are not the intended recipient, please notify the sender immediately by
return e-mail, delete this communication and destroy all copies.
************************************************************



_____

List Archive <http://listserv.meduniwien.ac.at/archives/mqser-l.html> -
Manage Your List Settings
<http://listserv.meduniwien.ac.at/cgi-bin/wa?SUBED1=mqser-l&A=1> -
Unsubscribe
<mailto:LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org?subject=Unsubscribe&BODY=signoff%
20mqseries>

Instructions for managing your mailing list subscription are provided in the
Listserv General Users Guide available at http://www.lsoft.com
<http://www.lsoft.com/resources/manuals.asp>


To unsubscribe, write to LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org and,
in the message body (not the subject), write: SIGNOFF MQSERIES
Instructions for managing your mailing list subscription are provided in
the Listserv General Users Guide available at http://www.lsoft.com
Archive: http://listserv.meduniwien.ac.at/archives/mqser-l.html
Potkay, Peter M (CTO Architecture + Engineering)
2013-10-24 16:02:28 UTC
Permalink
Good idea T.Rob, playing with it now.

Hmmm, while I can tell dmpmqcfg to only grab Authrority Records and spit them out in a runmqsc format, there doesn't appear to be a way to tell it to only do that for Auth Records for a particular User ID. Or at the very least, to at least exclude the records for the mqm ID.

Peter Potkay


From: MQSeries List [mailto:MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org] On Behalf Of T.Rob
Sent: Wednesday, October 23, 2013 10:38 AM
To: MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org
Subject: Re: SET AUTHREC versus setmqaut

For what it's worth the conversion is pretty easy. Run your setmqaut scripts, then run dmpmqcfg to spit out the SET AUTHREC equivalents.

Personally, it's worth the trouble to me to convert. The setmqaut commands need to be run from the command line locally and in many shops end up in different change control systems, sitting on the local filesystem, etc. I like it much better that I can define an object and then define the ACLs for that object immediately adjacent to it in the script, that it's one script, that it can be run remotely, etc.

But then I script everything so YMMV.

-- T.Rob


From: MQSeries List [mailto:MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org] On Behalf Of Potkay, Peter M (CTO Architecture + Engineering)
Sent: Wednesday, October 23, 2013 10:08 AM
To: MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org<mailto:MQSERIES-0lvw86wZMd9k/***@public.gmane.orgAC.AT>
Subject: SET AUTHREC versus setmqaut

Is there any reason to take the time and effort of rewriting my setmqaut scripts into SET AUTHREC commands?

So far the only reason I came up with is that then my standard runmqsc script I use for new QMs could also take care of the security stuff, versus having to run a second script specific to setmqaut.


Are AUTHREC just another way of doing the same thing?
Is setmqaut on the Endangered Species List, so sooner or later I'm gonna have to switch anyway?
Does AUTHREC provide or remove capability compared to setmqaut?

Google doesn't know.....
The new AUTHREC isn't addressed in the Info Center in the "Changed behavior between v6.0 and V7.5" section.


Peter Potkay




************************************************************
This communication, including attachments, is for the exclusive use of addressee and may contain proprietary, confidential and/or privileged information. If you are not the intended recipient, any use, copying, disclosure, dissemination or distribution is strictly prohibited. If you are not the intended recipient, please notify the sender immediately by return e-mail, delete this communication and destroy all copies.
************************************************************

________________________________
List Archive<http://listserv.meduniwien.ac.at/archives/mqser-l.html> - Manage Your List Settings<http://listserv.meduniwien.ac.at/cgi-bin/wa?SUBED1=mqser-l&A=1> - Unsubscribe<mailto:LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org?subject=Unsubscribe&BODY=signoff%20mqseries>

Instructions for managing your mailing list subscription are provided in the Listserv General Users Guide available at http://www.lsoft.com<http://www.lsoft.com/resources/manuals.asp>

________________________________
List Archive<http://listserv.meduniwien.ac.at/archives/mqser-l.html> - Manage Your List Settings<http://listserv.meduniwien.ac.at/cgi-bin/wa?SUBED1=mqser-l&A=1> - Unsubscribe<mailto:LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org?subject=Unsubscribe&BODY=signoff%20mqseries>

Instructions for managing your mailing list subscription are provided in the Listserv General Users Guide available at http://www.lsoft.com<http://www.lsoft.com/resources/manuals.asp>
************************************************************
This communication, including attachments, is for the exclusive use of addressee and may contain proprietary, confidential and/or privileged information. If you are not the intended recipient, any use, copying, disclosure, dissemination or distribution is strictly prohibited. If you are not the intended recipient, please notify the sender immediately by return e-mail, delete this communication and destroy all copies.
************************************************************

To unsubscribe, write to LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org and,
in the message body (not the subject), write: SIGNOFF MQSERIES
Instructions for managing your mailing list subscription are provided in
the Listserv General Users Guide available at http://www.lsoft.com
Archive: http://listserv.meduniwien.ac.at/archives/mqser-l.html
Potkay, Peter M (CTO Architecture + Engineering)
2013-10-24 16:51:25 UTC
Permalink
I noticed some random things missing from my dmpmqcfg that I explicitly set in my setmqaut. I think I should have seen everything because I used this command:
"Command issued: dmpmqcfg -m PETERQM -x authrec -a -o mqsc"


So I did a little test:

setmqaut -m PETERQM -n MY.QUEUE*.** -t queue -g mygrp01 -all +get +browse +put +inq
The setmqaut command completed successfully.

dspmqaut -m PETERQM -n MY.QUEUE*.** -t queue -g mygrp01
Entity mygrp01 has the following authorizations for object MY.QUEUE*.**:
get
browse
put
inq

dmpmqaut -m PETERQM -t queue -n MY.QUEUE*.**
profile: MY.QUEUE*.**
object type: queue
entity: mygrp01
entity type: group
authority: get browse put inq


Old school methods are consistent. Now let's see what dmpmqcfg shows.



dmpmqcfg -x authrec -a -n CHANNEL.CHECKER*.** -m PETERQM -o 1line -t queue
******************************************************************************************
* Script generated on 2013-10-24 at 12.34.42
* Script generated by user 'mqm' on host 'MyServer'
* Queue manager name: PETERQM
* Queue manager platform: UNIX
* Queue manager command level: (750/750)
* Command issued: dmpmqcfg -x authrec -a -n MY.QUEUE*.** -m PETERQM -o 1line -t queue
******************************************************************************************

No other output for this command!
I drop the -t queue flag and run it again.

dmpmqcfg -x authrec -a -n MY.QUEUE*.** -m PETERQM -o 1line
******************************************************************************************
* Script generated on 2013-10-24 at 12.35.50
* Script generated by user 'mqm' on host 'MyServer'
* Queue manager name: PETERQM
* Queue manager platform: UNIX
* Queue manager command level: (750/750)
* Command issued: dmpmqcfg -x authrec -a -n MY.QUEUE*.** -m PETERQM -o 1line
******************************************************************************************
SET AUTHREC PROFILE('self') GROUP('mqm') OBJTYPE(QMGR) AUTHADD(ALTUSR,CHG,CONNECT,DLT,DSP,INQ,SET,SETALL,SETID,CTRL,SYSTEM)
SET AUTHREC PROFILE('self') GROUP('mygrp01') OBJTYPE(QMGR) AUTHADD(CONNECT,INQ)
SET AUTHREC PROFILE('@class') GROUP('mqm') OBJTYPE(QMGR) AUTHADD(CRT)
SET AUTHREC PROFILE('@class') GROUP('mygrp01') OBJTYPE(QMGR) AUTHADD(NONE)


OK, that output is confusing, they don't match the -n MY.QUEUE*.** that I used in the command, so why do they show up this output


There are no queues yet defined on this QM that begin with the name MY.QUEUE.

I'm concerned that dmpmqcfg is not picking up things I set with setmqaut and can see with dspmqaut and MO71. I don't trust this as a method to produce a replacement runmqsc script for my setmqaut script. There are multiple examples like this that did not get picked up from my main setmqaut script. Actually, I don't trust this to backup the authorities of a QM just for backup purposes - it seems I would need to fall back to my setmqaut script to be sure I have everything. :-?


Peter Potkay


From: MQSeries List [mailto:MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org] On Behalf Of Potkay, Peter M (CTO Architecture + Engineering)
Sent: Thursday, October 24, 2013 12:02 PM
To: MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org
Subject: Re: SET AUTHREC versus setmqaut

Good idea T.Rob, playing with it now.

Hmmm, while I can tell dmpmqcfg to only grab Authrority Records and spit them out in a runmqsc format, there doesn't appear to be a way to tell it to only do that for Auth Records for a particular User ID. Or at the very least, to at least exclude the records for the mqm ID.

Peter Potkay

From: MQSeries List [mailto:MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org] On Behalf Of T.Rob
Sent: Wednesday, October 23, 2013 10:38 AM
To: MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org<mailto:MQSERIES-0lvw86wZMd9k/***@public.gmane.orgAC.AT>
Subject: Re: SET AUTHREC versus setmqaut

For what it's worth the conversion is pretty easy. Run your setmqaut scripts, then run dmpmqcfg to spit out the SET AUTHREC equivalents.

Personally, it's worth the trouble to me to convert. The setmqaut commands need to be run from the command line locally and in many shops end up in different change control systems, sitting on the local filesystem, etc. I like it much better that I can define an object and then define the ACLs for that object immediately adjacent to it in the script, that it's one script, that it can be run remotely, etc.

But then I script everything so YMMV.

-- T.Rob


From: MQSeries List [mailto:MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org] On Behalf Of Potkay, Peter M (CTO Architecture + Engineering)
Sent: Wednesday, October 23, 2013 10:08 AM
To: MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org<mailto:MQSERIES-0lvw86wZMd9k/***@public.gmane.orgAC.AT>
Subject: SET AUTHREC versus setmqaut

Is there any reason to take the time and effort of rewriting my setmqaut scripts into SET AUTHREC commands?

So far the only reason I came up with is that then my standard runmqsc script I use for new QMs could also take care of the security stuff, versus having to run a second script specific to setmqaut.


Are AUTHREC just another way of doing the same thing?
Is setmqaut on the Endangered Species List, so sooner or later I'm gonna have to switch anyway?
Does AUTHREC provide or remove capability compared to setmqaut?

Google doesn't know.....
The new AUTHREC isn't addressed in the Info Center in the "Changed behavior between v6.0 and V7.5" section.


Peter Potkay




************************************************************
This communication, including attachments, is for the exclusive use of addressee and may contain proprietary, confidential and/or privileged information. If you are not the intended recipient, any use, copying, disclosure, dissemination or distribution is strictly prohibited. If you are not the intended recipient, please notify the sender immediately by return e-mail, delete this communication and destroy all copies.
************************************************************

________________________________
List Archive<http://listserv.meduniwien.ac.at/archives/mqser-l.html> - Manage Your List Settings<http://listserv.meduniwien.ac.at/cgi-bin/wa?SUBED1=mqser-l&A=1> - Unsubscribe<mailto:LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org?subject=Unsubscribe&BODY=signoff%20mqseries>

Instructions for managing your mailing list subscription are provided in the Listserv General Users Guide available at http://www.lsoft.com<http://www.lsoft.com/resources/manuals.asp>

________________________________
List Archive<http://listserv.meduniwien.ac.at/archives/mqser-l.html> - Manage Your List Settings<http://listserv.meduniwien.ac.at/cgi-bin/wa?SUBED1=mqser-l&A=1> - Unsubscribe<mailto:LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org?subject=Unsubscribe&BODY=signoff%20mqseries>

Instructions for managing your mailing list subscription are provided in the Listserv General Users Guide available at http://www.lsoft.com<http://www.lsoft.com/resources/manuals.asp>

************************************************************
This communication, including attachments, is for the exclusive use of addressee and may contain proprietary, confidential and/or privileged information. If you are not the intended recipient, any use, copying, disclosure, dissemination or distribution is strictly prohibited. If you are not the intended recipient, please notify the sender immediately by return e-mail, delete this communication and destroy all copies.
************************************************************

________________________________
List Archive<http://listserv.meduniwien.ac.at/archives/mqser-l.html> - Manage Your List Settings<http://listserv.meduniwien.ac.at/cgi-bin/wa?SUBED1=mqser-l&A=1> - Unsubscribe<mailto:LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org?subject=Unsubscribe&BODY=signoff%20mqseries>

Instructions for managing your mailing list subscription are provided in the Listserv General Users Guide available at http://www.lsoft.com<http://www.lsoft.com/resources/manuals.asp>
************************************************************
This communication, including attachments, is for the exclusive use of addressee and may contain proprietary, confidential and/or privileged information. If you are not the intended recipient, any use, copying, disclosure, dissemination or distribution is strictly prohibited. If you are not the intended recipient, please notify the sender immediately by return e-mail, delete this communication and destroy all copies.
************************************************************

To unsubscribe, write to LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org and,
in the message body (not the subject), write: SIGNOFF MQSERIES
Instructions for managing your mailing list subscription are provided in
the Listserv General Users Guide available at http://www.lsoft.com
Archive: http://listserv.meduniwien.ac.at/archives/mqser-l.html
Jefferson Lowrey
2013-10-24 18:29:23 UTC
Permalink
Try putting the *'s inside quotes to make sure the shell isn't
interpreting them?


Thank you,

Jeff Lowrey



From: "Potkay, Peter M (CTO Architecture + Engineering)"
<Peter.Potkay-***@public.gmane.org>
To: MQSERIES-JX7+OpRa80QeFbOYke1v4oOpTq8/***@public.gmane.org,
Date: 10/24/2013 12:52 PM
Subject: Re: [MQSERIES] SET AUTHREC versus setmqaut
Sent by: MQSeries List <MQSERIES-JX7+OpRa80QeFbOYke1v4oOpTq8/***@public.gmane.org>



I noticed some random things missing from my dmpmqcfg that I explicitly
set in my setmqaut. I think I should have seen everything because I used
this command:
?Command issued: dmpmqcfg -m PETERQM -x authrec -a -o mqsc?


So I did a little test:

setmqaut -m PETERQM -n MY.QUEUE*.** -t queue -g mygrp01 -all +get +browse
+put +inq
The setmqaut command completed successfully.

dspmqaut -m PETERQM -n MY.QUEUE*.** -t queue -g mygrp01
Entity mygrp01 has the following authorizations for object MY.QUEUE*.**:
get
browse
put
inq

dmpmqaut -m PETERQM -t queue -n MY.QUEUE*.**
profile: MY.QUEUE*.**
object type: queue
entity: mygrp01
entity type: group
authority: get browse put inq


Old school methods are consistent. Now let?s see what dmpmqcfg shows.



dmpmqcfg -x authrec -a -n CHANNEL.CHECKER*.** -m PETERQM -o 1line -t queue
******************************************************************************************
* Script generated on 2013-10-24 at 12.34.42
* Script generated by user 'mqm' on host 'MyServer'
* Queue manager name: PETERQM
* Queue manager platform: UNIX
* Queue manager command level: (750/750)
* Command issued: dmpmqcfg -x authrec -a -n MY.QUEUE*.** -m PETERQM -o
1line -t queue
******************************************************************************************

No other output for this command!
I drop the ?t queue flag and run it again.

dmpmqcfg -x authrec -a -n MY.QUEUE*.** -m PETERQM -o 1line
******************************************************************************************
* Script generated on 2013-10-24 at 12.35.50
* Script generated by user 'mqm' on host 'MyServer'
* Queue manager name: PETERQM
* Queue manager platform: UNIX
* Queue manager command level: (750/750)
* Command issued: dmpmqcfg -x authrec -a -n MY.QUEUE*.** -m PETERQM -o
1line
******************************************************************************************
SET AUTHREC PROFILE('self') GROUP('mqm') OBJTYPE(QMGR)
AUTHADD(ALTUSR,CHG,CONNECT,DLT,DSP,INQ,SET,SETALL,SETID,CTRL,SYSTEM)
SET AUTHREC PROFILE('self') GROUP('mygrp01') OBJTYPE(QMGR)
AUTHADD(CONNECT,INQ)
SET AUTHREC PROFILE('@class') GROUP('mqm') OBJTYPE(QMGR) AUTHADD(CRT)
SET AUTHREC PROFILE('@class') GROUP('mygrp01') OBJTYPE(QMGR) AUTHADD(NONE)


OK, that output is confusing, they don?t match the ?n MY.QUEUE*.** that I
used in the command, so why do they show up this output


There are no queues yet defined on this QM that begin with the name
MY.QUEUE.

I?m concerned that dmpmqcfg is not picking up things I set with setmqaut
and can see with dspmqaut and MO71. I don?t trust this as a method to
produce a replacement runmqsc script for my setmqaut script. There are
multiple examples like this that did not get picked up from my main
setmqaut script. Actually, I don?t trust this to backup the authorities of
a QM just for backup purposes ? it seems I would need to fall back to my
setmqaut script to be sure I have everything. :-?


Peter Potkay


From: MQSeries List [mailto:MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org] On Behalf
Of Potkay, Peter M (CTO Architecture + Engineering)
Sent: Thursday, October 24, 2013 12:02 PM
To: MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org
Subject: Re: SET AUTHREC versus setmqaut

Good idea T.Rob, playing with it now.

Hmmm, while I can tell dmpmqcfg to only grab Authrority Records and spit
them out in a runmqsc format, there doesn?t appear to be a way to tell it
to only do that for Auth Records for a particular User ID. Or at the very
least, to at least exclude the records for the mqm ID.

Peter Potkay

From: MQSeries List [mailto:MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org] On Behalf
Of T.Rob
Sent: Wednesday, October 23, 2013 10:38 AM
To: MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org
Subject: Re: SET AUTHREC versus setmqaut

For what it's worth the conversion is pretty easy. Run your setmqaut
scripts, then run dmpmqcfg to spit out the SET AUTHREC equivalents.

Personally, it's worth the trouble to me to convert. The setmqaut
commands need to be run from the command line locally and in many shops
end up in different change control systems, sitting on the local
filesystem, etc. I like it much better that I can define an object and
then define the ACLs for that object immediately adjacent to it in the
script, that it's one script, that it can be run remotely, etc.

But then I script everything so YMMV.

-- T.Rob


From: MQSeries List [mailto:MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org] On Behalf
Of Potkay, Peter M (CTO Architecture + Engineering)
Sent: Wednesday, October 23, 2013 10:08 AM
To: MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org
Subject: SET AUTHREC versus setmqaut

Is there any reason to take the time and effort of rewriting my setmqaut
scripts into SET AUTHREC commands?

So far the only reason I came up with is that then my standard runmqsc
script I use for new QMs could also take care of the security stuff,
versus having to run a second script specific to setmqaut.


Are AUTHREC just another way of doing the same thing?
Is setmqaut on the Endangered Species List, so sooner or later I?m gonna
have to switch anyway?
Does AUTHREC provide or remove capability compared to setmqaut?

Google doesn?t know?..
The new AUTHREC isn?t addressed in the Info Center in the ?Changed
behavior between v6.0 and V7.5? section.


Peter Potkay



************************************************************
This communication, including attachments, is for the exclusive use of
addressee and may contain proprietary, confidential and/or privileged
information. If you are not the intended recipient, any use, copying,
disclosure, dissemination or distribution is strictly prohibited. If you
are not the intended recipient, please notify the sender immediately by
return e-mail, delete this communication and destroy all copies.
************************************************************


List Archive - Manage Your List Settings - Unsubscribe
Instructions for managing your mailing list subscription are provided in
the Listserv General Users Guide available at http://www.lsoft.com


List Archive - Manage Your List Settings - Unsubscribe
Instructions for managing your mailing list subscription are provided in
the Listserv General Users Guide available at http://www.lsoft.com
************************************************************
This communication, including attachments, is for the exclusive use of
addressee and may contain proprietary, confidential and/or privileged
information. If you are not the intended recipient, any use, copying,
disclosure, dissemination or distribution is strictly prohibited. If you
are not the intended recipient, please notify the sender immediately by
return e-mail, delete this communication and destroy all copies.
************************************************************


List Archive - Manage Your List Settings - Unsubscribe
Instructions for managing your mailing list subscription are provided in
the Listserv General Users Guide available at http://www.lsoft.com
************************************************************
This communication, including attachments, is for the exclusive use of
addressee and may contain proprietary, confidential and/or privileged
information. If you are not the intended recipient, any use, copying,
disclosure, dissemination or distribution is strictly prohibited. If you
are not the intended recipient, please notify the sender immediately by
return e-mail, delete this communication and destroy all copies.
************************************************************


List Archive - Manage Your List Settings - Unsubscribe
Instructions for managing your mailing list subscription are provided in
the Listserv General Users Guide available at http://www.lsoft.com

To unsubscribe, write to LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org and,
in the message body (not the subject), write: SIGNOFF MQSERIES
Instructions for managing your mailing list subscription are provided in
the Listserv General Users Guide available at http://www.lsoft.com
Archive: http://listserv.meduniwien.ac.at/archives/mqser-l.html
Potkay, Peter M (CTO Architecture + Engineering)
2013-10-24 19:10:51 UTC
Permalink
Single or double quotes didn't make a diff. But check it out, DISPLAY AUTHREC in a runmqsc session does see it like dspmqaut and dmpmqaut does.

Seems like dmpmqcfg is the only thing that can't see this profile.



dmpmqcfg -x authrec -a -n MY.QUEUE*.** -m PETERQM -o 1line -t queue
******************************************************************************************
* Script generated on 2013-10-24 at 14.48.04
* Script generated by user 'mqm' on host 'myServer'
* Queue manager name: PETERQM
* Queue manager platform: UNIX
* Queue manager command level: (750/750)
* Command issued: dmpmqcfg -x authrec -a -n MY.QUEUE*.** -m PETERQM -o 1line -t queue
******************************************************************************************


dmpmqcfg -x authrec -a -n 'MY.QUEUE*.**' -m PETERQM -o 1line -t queue
******************************************************************************************
* Script generated on 2013-10-24 at 14.48.17
* Script generated by user 'mqm' on host 'myServer'
* Queue manager name: PETERQM
* Queue manager platform: UNIX
* Queue manager command level: (750/750)
* Command issued: dmpmqcfg -x authrec -a -n MY.QUEUE*.** -m PETERQM -o 1line -t queue
******************************************************************************************


dmpmqcfg -x authrec -a -n "MY.QUEUE*.**" -m PETERQM -o 1line -t queue
******************************************************************************************
* Script generated on 2013-10-24 at 14.49.04
* Script generated by user 'mqm' on host 'myServer'
* Queue manager name: PETERQM
* Queue manager platform: UNIX
* Queue manager command level: (750/750)
* Command issued: dmpmqcfg -x authrec -a -n MY.QUEUE*.** -m PETERQM -o 1line -t queue
******************************************************************************************


runmqsc PETERQM
5724-H72 (C) Copyright IBM Corp. 1994, 2011. ALL RIGHTS RESERVED.
Starting MQSC for queue manager PETERQM.


DISPLAY AUTHREC PROFILE(MY.QUEUE*.**)
1 : DISPLAY AUTHREC PROFILE(MY.QUEUE*.**)
AMQ8864: Display authority record details.
PROFILE(MY.QUEUE*.**) ENTITY(mygrp01)
ENTTYPE(GROUP) OBJTYPE(QUEUE)
AUTHLIST(BROWSE,GET,INQ,PUT)
end
2 : end
One MQSC command read.
No commands have a syntax error.
All valid MQSC commands were processed.



Peter Potkay

From: MQSeries List [mailto:MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org] On Behalf Of Jefferson Lowrey
Sent: Thursday, October 24, 2013 2:29 PM
To: MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org
Subject: Re: SET AUTHREC versus setmqaut

Try putting the *'s inside quotes to make sure the shell isn't interpreting them?


Thank you,

Jeff Lowrey



From: "Potkay, Peter M (CTO Architecture + Engineering)" <Peter.Potkay-***@public.gmane.org<mailto:Peter.Potkay-***@public.gmane.org>>
To: MQSERIES-JX7+OpRa80QeFbOYke1v4oOpTq8/***@public.gmane.org<mailto:MQSERIES-JX7+OpRa80Ties2YCUG/***@public.gmane.orgniwien.ac.at>,
Date: 10/24/2013 12:52 PM
Subject: Re: [MQSERIES] SET AUTHREC versus setmqaut
Sent by: MQSeries List <MQSERIES-JX7+OpRa80QeFbOYke1v4oOpTq8/***@public.gmane.org<mailto:MQSERIES-JX7+OpRa80QeFbOYke1v4oOpTq8/***@public.gmane.org>>
________________________________



I noticed some random things missing from my dmpmqcfg that I explicitly set in my setmqaut. I think I should have seen everything because I used this command:
"Command issued: dmpmqcfg -m PETERQM -x authrec -a -o mqsc"


So I did a little test:

setmqaut -m PETERQM -n MY.QUEUE*.** -t queue -g mygrp01 -all +get +browse +put +inq
The setmqaut command completed successfully.

dspmqaut -m PETERQM -n MY.QUEUE*.** -t queue -g mygrp01
Entity mygrp01 has the following authorizations for object MY.QUEUE*.**:
get
browse
put
inq

dmpmqaut -m PETERQM -t queue -n MY.QUEUE*.**
profile: MY.QUEUE*.**
object type: queue
entity: mygrp01
entity type: group
authority: get browse put inq


Old school methods are consistent. Now let's see what dmpmqcfg shows.



dmpmqcfg -x authrec -a -n CHANNEL.CHECKER*.** -m PETERQM -o 1line -t queue
******************************************************************************************
* Script generated on 2013-10-24 at 12.34.42
* Script generated by user 'mqm' on host 'MyServer'
* Queue manager name: PETERQM
* Queue manager platform: UNIX
* Queue manager command level: (750/750)
* Command issued: dmpmqcfg -x authrec -a -n MY.QUEUE*.** -m PETERQM -o 1line -t queue
******************************************************************************************

No other output for this command!
I drop the -t queue flag and run it again.

dmpmqcfg -x authrec -a -n MY.QUEUE*.** -m PETERQM -o 1line
******************************************************************************************
* Script generated on 2013-10-24 at 12.35.50
* Script generated by user 'mqm' on host 'MyServer'
* Queue manager name: PETERQM
* Queue manager platform: UNIX
* Queue manager command level: (750/750)
* Command issued: dmpmqcfg -x authrec -a -n MY.QUEUE*.** -m PETERQM -o 1line
******************************************************************************************
SET AUTHREC PROFILE('self') GROUP('mqm') OBJTYPE(QMGR) AUTHADD(ALTUSR,CHG,CONNECT,DLT,DSP,INQ,SET,SETALL,SETID,CTRL,SYSTEM)
SET AUTHREC PROFILE('self') GROUP('mygrp01') OBJTYPE(QMGR) AUTHADD(CONNECT,INQ)
SET AUTHREC PROFILE('@class') GROUP('mqm') OBJTYPE(QMGR) AUTHADD(CRT)
SET AUTHREC PROFILE('@class') GROUP('mygrp01') OBJTYPE(QMGR) AUTHADD(NONE)


OK, that output is confusing, they don't match the -n MY.QUEUE*.** that I used in the command, so why do they show up this output


There are no queues yet defined on this QM that begin with the name MY.QUEUE.

I'm concerned that dmpmqcfg is not picking up things I set with setmqaut and can see with dspmqaut and MO71. I don't trust this as a method to produce a replacement runmqsc script for my setmqaut script. There are multiple examples like this that did not get picked up from my main setmqaut script. Actually, I don't trust this to backup the authorities of a QM just for backup purposes - it seems I would need to fall back to my setmqaut script to be sure I have everything. :-?


Peter Potkay


From: MQSeries List [mailto:MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org] On Behalf Of Potkay, Peter M (CTO Architecture + Engineering)
Sent: Thursday, October 24, 2013 12:02 PM
To: MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org<mailto:MQSERIES-0lvw86wZMd9k/***@public.gmane.orgAC.AT>
Subject: Re: SET AUTHREC versus setmqaut

Good idea T.Rob, playing with it now.

Hmmm, while I can tell dmpmqcfg to only grab Authrority Records and spit them out in a runmqsc format, there doesn't appear to be a way to tell it to only do that for Auth Records for a particular User ID. Or at the very least, to at least exclude the records for the mqm ID.

Peter Potkay

From: MQSeries List [mailto:MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org] On Behalf Of T.Rob
Sent: Wednesday, October 23, 2013 10:38 AM
To: MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org<mailto:MQSERIES-0lvw86wZMd9k/***@public.gmane.orgAC.AT>
Subject: Re: SET AUTHREC versus setmqaut

For what it's worth the conversion is pretty easy. Run your setmqaut scripts, then run dmpmqcfg to spit out the SET AUTHREC equivalents.

Personally, it's worth the trouble to me to convert. The setmqaut commands need to be run from the command line locally and in many shops end up in different change control systems, sitting on the local filesystem, etc. I like it much better that I can define an object and then define the ACLs for that object immediately adjacent to it in the script, that it's one script, that it can be run remotely, etc.

But then I script everything so YMMV.

-- T.Rob


From: MQSeries List [mailto:MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org] On Behalf Of Potkay, Peter M (CTO Architecture + Engineering)
Sent: Wednesday, October 23, 2013 10:08 AM
To: MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org<mailto:MQSERIES-0lvw86wZMd9k/***@public.gmane.orgAC.AT>
Subject: SET AUTHREC versus setmqaut

Is there any reason to take the time and effort of rewriting my setmqaut scripts into SET AUTHREC commands?

So far the only reason I came up with is that then my standard runmqsc script I use for new QMs could also take care of the security stuff, versus having to run a second script specific to setmqaut.


Are AUTHREC just another way of doing the same thing?
Is setmqaut on the Endangered Species List, so sooner or later I'm gonna have to switch anyway?
Does AUTHREC provide or remove capability compared to setmqaut?

Google doesn't know.....
The new AUTHREC isn't addressed in the Info Center in the "Changed behavior between v6.0 and V7.5" section.


Peter Potkay




************************************************************
This communication, including attachments, is for the exclusive use of addressee and may contain proprietary, confidential and/or privileged information. If you are not the intended recipient, any use, copying, disclosure, dissemination or distribution is strictly prohibited. If you are not the intended recipient, please notify the sender immediately by return e-mail, delete this communication and destroy all copies.
************************************************************


________________________________

List Archive<http://listserv.meduniwien.ac.at/archives/mqser-l.html> - Manage Your List Settings<http://listserv.meduniwien.ac.at/cgi-bin/wa?SUBED1=mqser-l&A=1> - Unsubscribe<mailto:LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org?subject=Unsubscribe&BODY=signoff%20mqseries>

Instructions for managing your mailing list subscription are provided in the Listserv General Users Guide available at http://www.lsoft.com<http://www.lsoft.com/resources/manuals.asp>


________________________________

List Archive<http://listserv.meduniwien.ac.at/archives/mqser-l.html> - Manage Your List Settings<http://listserv.meduniwien.ac.at/cgi-bin/wa?SUBED1=mqser-l&A=1> - Unsubscribe<mailto:LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org?subject=Unsubscribe&BODY=signoff%20mqseries>

Instructions for managing your mailing list subscription are provided in the Listserv General Users Guide available at http://www.lsoft.com<http://www.lsoft.com/resources/manuals.asp>

************************************************************
This communication, including attachments, is for the exclusive use of addressee and may contain proprietary, confidential and/or privileged information. If you are not the intended recipient, any use, copying, disclosure, dissemination or distribution is strictly prohibited. If you are not the intended recipient, please notify the sender immediately by return e-mail, delete this communication and destroy all copies.
************************************************************


________________________________

List Archive<http://listserv.meduniwien.ac.at/archives/mqser-l.html> - Manage Your List Settings<http://listserv.meduniwien.ac.at/cgi-bin/wa?SUBED1=mqser-l&A=1> - Unsubscribe<mailto:LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org?subject=Unsubscribe&BODY=signoff%20mqseries>

Instructions for managing your mailing list subscription are provided in the Listserv General Users Guide available at http://www.lsoft.com<http://www.lsoft.com/resources/manuals.asp>

************************************************************
This communication, including attachments, is for the exclusive use of addressee and may contain proprietary, confidential and/or privileged information. If you are not the intended recipient, any use, copying, disclosure, dissemination or distribution is strictly prohibited. If you are not the intended recipient, please notify the sender immediately by return e-mail, delete this communication and destroy all copies.
************************************************************



________________________________
List Archive<http://listserv.meduniwien.ac.at/archives/mqser-l.html> - Manage Your List Settings<http://listserv.meduniwien.ac.at/cgi-bin/wa?SUBED1=mqser-l&A=1> - Unsubscribe<mailto:LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org?subject=Unsubscribe&BODY=signoff%20mqseries>

Instructions for managing your mailing list subscription are provided in the Listserv General Users Guide available at http://www.lsoft.com<http://www.lsoft.com/resources/manuals.asp>

________________________________
List Archive<http://listserv.meduniwien.ac.at/archives/mqser-l.html> - Manage Your List Settings<http://listserv.meduniwien.ac.at/cgi-bin/wa?SUBED1=mqser-l&A=1> - Unsubscribe<mailto:LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org?subject=Unsubscribe&BODY=signoff%20mqseries>

Instructions for managing your mailing list subscription are provided in the Listserv General Users Guide available at http://www.lsoft.com<http://www.lsoft.com/resources/manuals.asp>
************************************************************
This communication, including attachments, is for the exclusive use of addressee and may contain proprietary, confidential and/or privileged information. If you are not the intended recipient, any use, copying, disclosure, dissemination or distribution is strictly prohibited. If you are not the intended recipient, please notify the sender immediately by return e-mail, delete this communication and destroy all copies.
************************************************************

To unsubscribe, write to LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org and,
in the message body (not the subject), write: SIGNOFF MQSERIES
Instructions for managing your mailing list subscription are provided in
the Listserv General Users Guide available at http://www.lsoft.com
Archive: http://listserv.meduniwien.ac.at/archives/mqser-l.html
Tim Zielke
2013-10-24 19:43:07 UTC
Permalink
Hi Peter,

I see the same behavior, too. This is on a SLES 11 Linux x86 server with MQ 7.1.0.2. I ran an strace to make sure that the shell interpreter wasn't mangling anything, and the dmpmqcfg command did get the inputs in the correct format.

strace dmpmqcfg -x authrec -a -n SYSTEM.** -m xxxxxxxx -o 1line -t queue 2>/export/home/mqm/strace.out

strace.out output:
execve("/usr/bin/dmpmqcfg", ["dmpmqcfg", "-x", "authrec", "-a", "-n", "SYSTEM.**", "-m", "xxxxxxxx", "-o", "1line", "-t", "queue"], [/* 49 vars */]) = 0

Thanks,
Tim

From: MQSeries List [mailto:MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org] On Behalf Of Potkay, Peter M (CTO Architecture + Engineering)
Sent: Thursday, October 24, 2013 2:11 PM
To: MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org
Subject: Re: SET AUTHREC versus setmqaut

Single or double quotes didn't make a diff. But check it out, DISPLAY AUTHREC in a runmqsc session does see it like dspmqaut and dmpmqaut does.

Seems like dmpmqcfg is the only thing that can't see this profile.



dmpmqcfg -x authrec -a -n MY.QUEUE*.** -m PETERQM -o 1line -t queue
******************************************************************************************
* Script generated on 2013-10-24 at 14.48.04
* Script generated by user 'mqm' on host 'myServer'
* Queue manager name: PETERQM
* Queue manager platform: UNIX
* Queue manager command level: (750/750)
* Command issued: dmpmqcfg -x authrec -a -n MY.QUEUE*.** -m PETERQM -o 1line -t queue
******************************************************************************************


dmpmqcfg -x authrec -a -n 'MY.QUEUE*.**' -m PETERQM -o 1line -t queue
******************************************************************************************
* Script generated on 2013-10-24 at 14.48.17
* Script generated by user 'mqm' on host 'myServer'
* Queue manager name: PETERQM
* Queue manager platform: UNIX
* Queue manager command level: (750/750)
* Command issued: dmpmqcfg -x authrec -a -n MY.QUEUE*.** -m PETERQM -o 1line -t queue
******************************************************************************************


dmpmqcfg -x authrec -a -n "MY.QUEUE*.**" -m PETERQM -o 1line -t queue
******************************************************************************************
* Script generated on 2013-10-24 at 14.49.04
* Script generated by user 'mqm' on host 'myServer'
* Queue manager name: PETERQM
* Queue manager platform: UNIX
* Queue manager command level: (750/750)
* Command issued: dmpmqcfg -x authrec -a -n MY.QUEUE*.** -m PETERQM -o 1line -t queue
******************************************************************************************


runmqsc PETERQM
5724-H72 (C) Copyright IBM Corp. 1994, 2011. ALL RIGHTS RESERVED.
Starting MQSC for queue manager PETERQM.


DISPLAY AUTHREC PROFILE(MY.QUEUE*.**)
1 : DISPLAY AUTHREC PROFILE(MY.QUEUE*.**)
AMQ8864: Display authority record details.
PROFILE(MY.QUEUE*.**) ENTITY(mygrp01)
ENTTYPE(GROUP) OBJTYPE(QUEUE)
AUTHLIST(BROWSE,GET,INQ,PUT)
end
2 : end
One MQSC command read.
No commands have a syntax error.
All valid MQSC commands were processed.



Peter Potkay
From: MQSeries List [mailto:MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org] On Behalf Of Jefferson Lowrey
Sent: Thursday, October 24, 2013 2:29 PM
To: MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org
Subject: Re: SET AUTHREC versus setmqaut

Try putting the *'s inside quotes to make sure the shell isn't interpreting them?


Thank you,

Jeff Lowrey



From: "Potkay, Peter M (CTO Architecture + Engineering)" <Peter.Potkay-***@public.gmane.org<mailto:Peter.Potkay-***@public.gmane.org>>
To: MQSERIES-JX7+OpRa80QeFbOYke1v4oOpTq8/***@public.gmane.org<mailto:MQSERIES-JX7+OpRa80Ties2YCUG/***@public.gmane.orgniwien.ac.at>,
Date: 10/24/2013 12:52 PM
Subject: Re: [MQSERIES] SET AUTHREC versus setmqaut
Sent by: MQSeries List <MQSERIES-JX7+OpRa80QeFbOYke1v4oOpTq8/***@public.gmane.org<mailto:MQSERIES-JX7+OpRa80QeFbOYke1v4oOpTq8/***@public.gmane.org>>
________________________________



I noticed some random things missing from my dmpmqcfg that I explicitly set in my setmqaut. I think I should have seen everything because I used this command:
"Command issued: dmpmqcfg -m PETERQM -x authrec -a -o mqsc"


So I did a little test:

setmqaut -m PETERQM -n MY.QUEUE*.** -t queue -g mygrp01 -all +get +browse +put +inq
The setmqaut command completed successfully.

dspmqaut -m PETERQM -n MY.QUEUE*.** -t queue -g mygrp01
Entity mygrp01 has the following authorizations for object MY.QUEUE*.**:
get
browse
put
inq

dmpmqaut -m PETERQM -t queue -n MY.QUEUE*.**
profile: MY.QUEUE*.**
object type: queue
entity: mygrp01
entity type: group
authority: get browse put inq


Old school methods are consistent. Now let's see what dmpmqcfg shows.



dmpmqcfg -x authrec -a -n CHANNEL.CHECKER*.** -m PETERQM -o 1line -t queue
******************************************************************************************
* Script generated on 2013-10-24 at 12.34.42
* Script generated by user 'mqm' on host 'MyServer'
* Queue manager name: PETERQM
* Queue manager platform: UNIX
* Queue manager command level: (750/750)
* Command issued: dmpmqcfg -x authrec -a -n MY.QUEUE*.** -m PETERQM -o 1line -t queue
******************************************************************************************

No other output for this command!
I drop the -t queue flag and run it again.

dmpmqcfg -x authrec -a -n MY.QUEUE*.** -m PETERQM -o 1line
******************************************************************************************
* Script generated on 2013-10-24 at 12.35.50
* Script generated by user 'mqm' on host 'MyServer'
* Queue manager name: PETERQM
* Queue manager platform: UNIX
* Queue manager command level: (750/750)
* Command issued: dmpmqcfg -x authrec -a -n MY.QUEUE*.** -m PETERQM -o 1line
******************************************************************************************
SET AUTHREC PROFILE('self') GROUP('mqm') OBJTYPE(QMGR) AUTHADD(ALTUSR,CHG,CONNECT,DLT,DSP,INQ,SET,SETALL,SETID,CTRL,SYSTEM)
SET AUTHREC PROFILE('self') GROUP('mygrp01') OBJTYPE(QMGR) AUTHADD(CONNECT,INQ)
SET AUTHREC PROFILE('@class') GROUP('mqm') OBJTYPE(QMGR) AUTHADD(CRT)
SET AUTHREC PROFILE('@class') GROUP('mygrp01') OBJTYPE(QMGR) AUTHADD(NONE)


OK, that output is confusing, they don't match the -n MY.QUEUE*.** that I used in the command, so why do they show up this output


There are no queues yet defined on this QM that begin with the name MY.QUEUE.

I'm concerned that dmpmqcfg is not picking up things I set with setmqaut and can see with dspmqaut and MO71. I don't trust this as a method to produce a replacement runmqsc script for my setmqaut script. There are multiple examples like this that did not get picked up from my main setmqaut script. Actually, I don't trust this to backup the authorities of a QM just for backup purposes - it seems I would need to fall back to my setmqaut script to be sure I have everything. :-?


Peter Potkay


From: MQSeries List [mailto:MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org] On Behalf Of Potkay, Peter M (CTO Architecture + Engineering)
Sent: Thursday, October 24, 2013 12:02 PM
To: MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org<mailto:MQSERIES-0lvw86wZMd9k/***@public.gmane.orgAC.AT>
Subject: Re: SET AUTHREC versus setmqaut

Good idea T.Rob, playing with it now.

Hmmm, while I can tell dmpmqcfg to only grab Authrority Records and spit them out in a runmqsc format, there doesn't appear to be a way to tell it to only do that for Auth Records for a particular User ID. Or at the very least, to at least exclude the records for the mqm ID.

Peter Potkay

From: MQSeries List [mailto:MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org] On Behalf Of T.Rob
Sent: Wednesday, October 23, 2013 10:38 AM
To: MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org<mailto:MQSERIES-0lvw86wZMd9k/***@public.gmane.orgAC.AT>
Subject: Re: SET AUTHREC versus setmqaut

For what it's worth the conversion is pretty easy. Run your setmqaut scripts, then run dmpmqcfg to spit out the SET AUTHREC equivalents.

Personally, it's worth the trouble to me to convert. The setmqaut commands need to be run from the command line locally and in many shops end up in different change control systems, sitting on the local filesystem, etc. I like it much better that I can define an object and then define the ACLs for that object immediately adjacent to it in the script, that it's one script, that it can be run remotely, etc.

But then I script everything so YMMV.

-- T.Rob


From: MQSeries List [mailto:MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org] On Behalf Of Potkay, Peter M (CTO Architecture + Engineering)
Sent: Wednesday, October 23, 2013 10:08 AM
To: MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org<mailto:MQSERIES-0lvw86wZMd9k/***@public.gmane.orgAC.AT>
Subject: SET AUTHREC versus setmqaut

Is there any reason to take the time and effort of rewriting my setmqaut scripts into SET AUTHREC commands?

So far the only reason I came up with is that then my standard runmqsc script I use for new QMs could also take care of the security stuff, versus having to run a second script specific to setmqaut.


Are AUTHREC just another way of doing the same thing?
Is setmqaut on the Endangered Species List, so sooner or later I'm gonna have to switch anyway?
Does AUTHREC provide or remove capability compared to setmqaut?

Google doesn't know.....
The new AUTHREC isn't addressed in the Info Center in the "Changed behavior between v6.0 and V7.5" section.


Peter Potkay




************************************************************
This communication, including attachments, is for the exclusive use of addressee and may contain proprietary, confidential and/or privileged information. If you are not the intended recipient, any use, copying, disclosure, dissemination or distribution is strictly prohibited. If you are not the intended recipient, please notify the sender immediately by return e-mail, delete this communication and destroy all copies.
************************************************************


________________________________

List Archive<http://listserv.meduniwien.ac.at/archives/mqser-l.html> - Manage Your List Settings<http://listserv.meduniwien.ac.at/cgi-bin/wa?SUBED1=mqser-l&A=1> - Unsubscribe<mailto:LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org?subject=Unsubscribe&BODY=signoff%20mqseries>

Instructions for managing your mailing list subscription are provided in the Listserv General Users Guide available at http://www.lsoft.com<http://www.lsoft.com/resources/manuals.asp>


________________________________

List Archive<http://listserv.meduniwien.ac.at/archives/mqser-l.html> - Manage Your List Settings<http://listserv.meduniwien.ac.at/cgi-bin/wa?SUBED1=mqser-l&A=1> - Unsubscribe<mailto:LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org?subject=Unsubscribe&BODY=signoff%20mqseries>

Instructions for managing your mailing list subscription are provided in the Listserv General Users Guide available at http://www.lsoft.com<http://www.lsoft.com/resources/manuals.asp>

************************************************************
This communication, including attachments, is for the exclusive use of addressee and may contain proprietary, confidential and/or privileged information. If you are not the intended recipient, any use, copying, disclosure, dissemination or distribution is strictly prohibited. If you are not the intended recipient, please notify the sender immediately by return e-mail, delete this communication and destroy all copies.
************************************************************


________________________________

List Archive<http://listserv.meduniwien.ac.at/archives/mqser-l.html> - Manage Your List Settings<http://listserv.meduniwien.ac.at/cgi-bin/wa?SUBED1=mqser-l&A=1> - Unsubscribe<mailto:LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org?subject=Unsubscribe&BODY=signoff%20mqseries>

Instructions for managing your mailing list subscription are provided in the Listserv General Users Guide available at http://www.lsoft.com<http://www.lsoft.com/resources/manuals.asp>

************************************************************
This communication, including attachments, is for the exclusive use of addressee and may contain proprietary, confidential and/or privileged information. If you are not the intended recipient, any use, copying, disclosure, dissemination or distribution is strictly prohibited. If you are not the intended recipient, please notify the sender immediately by return e-mail, delete this communication and destroy all copies.
************************************************************



________________________________
List Archive<http://listserv.meduniwien.ac.at/archives/mqser-l.html> - Manage Your List Settings<http://listserv.meduniwien.ac.at/cgi-bin/wa?SUBED1=mqser-l&A=1> - Unsubscribe<mailto:LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org?subject=Unsubscribe&BODY=signoff%20mqseries>

Instructions for managing your mailing list subscription are provided in the Listserv General Users Guide available at http://www.lsoft.com<http://www.lsoft.com/resources/manuals.asp>

________________________________
List Archive<http://listserv.meduniwien.ac.at/archives/mqser-l.html> - Manage Your List Settings<http://listserv.meduniwien.ac.at/cgi-bin/wa?SUBED1=mqser-l&A=1> - Unsubscribe<mailto:LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org?subject=Unsubscribe&BODY=signoff%20mqseries>

Instructions for managing your mailing list subscription are provided in the Listserv General Users Guide available at http://www.lsoft.com<http://www.lsoft.com/resources/manuals.asp>

************************************************************
This communication, including attachments, is for the exclusive use of addressee and may contain proprietary, confidential and/or privileged information. If you are not the intended recipient, any use, copying, disclosure, dissemination or distribution is strictly prohibited. If you are not the intended recipient, please notify the sender immediately by return e-mail, delete this communication and destroy all copies.
************************************************************

________________________________
List Archive<http://listserv.meduniwien.ac.at/archives/mqser-l.html> - Manage Your List Settings<http://listserv.meduniwien.ac.at/cgi-bin/wa?SUBED1=mqser-l&A=1> - Unsubscribe<mailto:LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org?subject=Unsubscribe&BODY=signoff%20mqseries>

Instructions for managing your mailing list subscription are provided in the Listserv General Users Guide available at http://www.lsoft.com<http://www.lsoft.com/resources/manuals.asp>

To unsubscribe, write to LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org and,
in the message body (not the subject), write: SIGNOFF MQSERIES
Instructions for managing your mailing list subscription are provided in
the Listserv General Users Guide available at http://www.lsoft.com
Archive: http://listserv.meduniwien.ac.at/archives/mqser-l.html
Ward Able, Grant
2013-10-25 09:32:43 UTC
Permalink
Peter,
I was just trawling through the InfoCentre (oh how I miss the PDFs!!!) and I saw that you may only have a single "*" and that can only be at the end. Perhaps your uses of *.** is confusing the poor utility?

-n [ * | ObjectName ]
Filter the definitions produced by object or profile name, the object/profile name may contain a single asterisk. The * option can be placed only at the end of the entered filter string.



Regards - Grant.
Telephone Internal: 201496 (London)
Telephone External: +44 (0)207 650 1496

From: MQSeries List [mailto:***@LISTSERV.MEDUNIWIEN.AC.AT] On Behalf Of Potkay, Peter M (CTO Architecture + Engineering)
Sent: 24 October 2013 20:11
To: ***@LISTSERV.MEDUNIWIEN.AC.AT
Subject: Re: SET AUTHREC versus setmqaut

Single or double quotes didn't make a diff. But check it out, DISPLAY AUTHREC in a runmqsc session does see it like dspmqaut and dmpmqaut does.

Seems like dmpmqcfg is the only thing that can't see this profile.



dmpmqcfg -x authrec -a -n MY.QUEUE*.** -m PETERQM -o 1line -t queue
******************************************************************************************
* Script generated on 2013-10-24 at 14.48.04
* Script generated by user 'mqm' on host 'myServer'
* Queue manager name: PETERQM
* Queue manager platform: UNIX
* Queue manager command level: (750/750)
* Command issued: dmpmqcfg -x authrec -a -n MY.QUEUE*.** -m PETERQM -o 1line -t queue
******************************************************************************************


dmpmqcfg -x authrec -a -n 'MY.QUEUE*.**' -m PETERQM -o 1line -t queue
******************************************************************************************
* Script generated on 2013-10-24 at 14.48.17
* Script generated by user 'mqm' on host 'myServer'
* Queue manager name: PETERQM
* Queue manager platform: UNIX
* Queue manager command level: (750/750)
* Command issued: dmpmqcfg -x authrec -a -n MY.QUEUE*.** -m PETERQM -o 1line -t queue
******************************************************************************************


dmpmqcfg -x authrec -a -n "MY.QUEUE*.**" -m PETERQM -o 1line -t queue
******************************************************************************************
* Script generated on 2013-10-24 at 14.49.04
* Script generated by user 'mqm' on host 'myServer'
* Queue manager name: PETERQM
* Queue manager platform: UNIX
* Queue manager command level: (750/750)
* Command issued: dmpmqcfg -x authrec -a -n MY.QUEUE*.** -m PETERQM -o 1line -t queue
******************************************************************************************


runmqsc PETERQM
5724-H72 (C) Copyright IBM Corp. 1994, 2011. ALL RIGHTS RESERVED.
Starting MQSC for queue manager PETERQM.


DISPLAY AUTHREC PROFILE(MY.QUEUE*.**)
1 : DISPLAY AUTHREC PROFILE(MY.QUEUE*.**)
AMQ8864: Display authority record details.
PROFILE(MY.QUEUE*.**) ENTITY(mygrp01)
ENTTYPE(GROUP) OBJTYPE(QUEUE)
AUTHLIST(BROWSE,GET,INQ,PUT)
end
2 : end
One MQSC command read.
No commands have a syntax error.
All valid MQSC commands were processed.



Peter Potkay
From: MQSeries List [mailto:***@LISTSERV.MEDUNIWIEN.AC.AT] On Behalf Of Jefferson Lowrey
Sent: Thursday, October 24, 2013 2:29 PM
To: ***@LISTSERV.MEDUNIWIEN.AC.AT<mailto:***@LISTSERV.MEDUNIWIEN.AC.AT>
Subject: Re: SET AUTHREC versus setmqaut

Try putting the *'s inside quotes to make sure the shell isn't interpreting them?


Thank you,

Jeff Lowrey



From: "Potkay, Peter M (CTO Architecture + Engineering)" <***@THEHARTFORD.COM<mailto:***@THEHARTFORD.COM>>
To: ***@listserv.meduniwien.ac.at<mailto:***@listserv.meduniwien.ac.at>,
Date: 10/24/2013 12:52 PM
Subject: Re: [MQSERIES] SET AUTHREC versus setmqaut
Sent by: MQSeries List <***@listserv.meduniwien.ac.at<mailto:***@listserv.meduniwien.ac.at>>
________________________________



I noticed some random things missing from my dmpmqcfg that I explicitly set in my setmqaut. I think I should have seen everything because I used this command:
"Command issued: dmpmqcfg -m PETERQM -x authrec -a -o mqsc"


So I did a little test:

setmqaut -m PETERQM -n MY.QUEUE*.** -t queue -g mygrp01 -all +get +browse +put +inq
The setmqaut command completed successfully.

dspmqaut -m PETERQM -n MY.QUEUE*.** -t queue -g mygrp01
Entity mygrp01 has the following authorizations for object MY.QUEUE*.**:
get
browse
put
inq

dmpmqaut -m PETERQM -t queue -n MY.QUEUE*.**
profile: MY.QUEUE*.**
object type: queue
entity: mygrp01
entity type: group
authority: get browse put inq


Old school methods are consistent. Now let's see what dmpmqcfg shows.



dmpmqcfg -x authrec -a -n CHANNEL.CHECKER*.** -m PETERQM -o 1line -t queue
******************************************************************************************
* Script generated on 2013-10-24 at 12.34.42
* Script generated by user 'mqm' on host 'MyServer'
* Queue manager name: PETERQM
* Queue manager platform: UNIX
* Queue manager command level: (750/750)
* Command issued: dmpmqcfg -x authrec -a -n MY.QUEUE*.** -m PETERQM -o 1line -t queue
******************************************************************************************

No other output for this command!
I drop the -t queue flag and run it again.

dmpmqcfg -x authrec -a -n MY.QUEUE*.** -m PETERQM -o 1line
******************************************************************************************
* Script generated on 2013-10-24 at 12.35.50
* Script generated by user 'mqm' on host 'MyServer'
* Queue manager name: PETERQM
* Queue manager platform: UNIX
* Queue manager command level: (750/750)
* Command issued: dmpmqcfg -x authrec -a -n MY.QUEUE*.** -m PETERQM -o 1line
******************************************************************************************
SET AUTHREC PROFILE('self') GROUP('mqm') OBJTYPE(QMGR) AUTHADD(ALTUSR,CHG,CONNECT,DLT,DSP,INQ,SET,SETALL,SETID,CTRL,SYSTEM)
SET AUTHREC PROFILE('self') GROUP('mygrp01') OBJTYPE(QMGR) AUTHADD(CONNECT,INQ)
SET AUTHREC PROFILE('@class') GROUP('mqm') OBJTYPE(QMGR) AUTHADD(CRT)
SET AUTHREC PROFILE('@class') GROUP('mygrp01') OBJTYPE(QMGR) AUTHADD(NONE)


OK, that output is confusing, they don't match the -n MY.QUEUE*.** that I used in the command, so why do they show up this output


There are no queues yet defined on this QM that begin with the name MY.QUEUE.

I'm concerned that dmpmqcfg is not picking up things I set with setmqaut and can see with dspmqaut and MO71. I don't trust this as a method to produce a replacement runmqsc script for my setmqaut script. There are multiple examples like this that did not get picked up from my main setmqaut script. Actually, I don't trust this to backup the authorities of a QM just for backup purposes - it seems I would need to fall back to my setmqaut script to be sure I have everything. :-?


Peter Potkay


From: MQSeries List [mailto:***@LISTSERV.MEDUNIWIEN.AC.AT] On Behalf Of Potkay, Peter M (CTO Architecture + Engineering)
Sent: Thursday, October 24, 2013 12:02 PM
To: ***@LISTSERV.MEDUNIWIEN.AC.AT<mailto:***@LISTSERV.MEDUNIWIEN.AC.AT>
Subject: Re: SET AUTHREC versus setmqaut

Good idea T.Rob, playing with it now.

Hmmm, while I can tell dmpmqcfg to only grab Authrority Records and spit them out in a runmqsc format, there doesn't appear to be a way to tell it to only do that for Auth Records for a particular User ID. Or at the very least, to at least exclude the records for the mqm ID.

Peter Potkay

From: MQSeries List [mailto:***@LISTSERV.MEDUNIWIEN.AC.AT] On Behalf Of T.Rob
Sent: Wednesday, October 23, 2013 10:38 AM
To: ***@LISTSERV.MEDUNIWIEN.AC.AT<mailto:***@LISTSERV.MEDUNIWIEN.AC.AT>
Subject: Re: SET AUTHREC versus setmqaut

For what it's worth the conversion is pretty easy. Run your setmqaut scripts, then run dmpmqcfg to spit out the SET AUTHREC equivalents.

Personally, it's worth the trouble to me to convert. The setmqaut commands need to be run from the command line locally and in many shops end up in different change control systems, sitting on the local filesystem, etc. I like it much better that I can define an object and then define the ACLs for that object immediately adjacent to it in the script, that it's one script, that it can be run remotely, etc.

But then I script everything so YMMV.

-- T.Rob


From: MQSeries List [mailto:***@LISTSERV.MEDUNIWIEN.AC.AT] On Behalf Of Potkay, Peter M (CTO Architecture + Engineering)
Sent: Wednesday, October 23, 2013 10:08 AM
To: ***@LISTSERV.MEDUNIWIEN.AC.AT<mailto:***@LISTSERV.MEDUNIWIEN.AC.AT>
Subject: SET AUTHREC versus setmqaut

Is there any reason to take the time and effort of rewriting my setmqaut scripts into SET AUTHREC commands?

So far the only reason I came up with is that then my standard runmqsc script I use for new QMs could also take care of the security stuff, versus having to run a second script specific to setmqaut.


Are AUTHREC just another way of doing the same thing?
Is setmqaut on the Endangered Species List, so sooner or later I'm gonna have to switch anyway?
Does AUTHREC provide or remove capability compared to setmqaut?

Google doesn't know.....
The new AUTHREC isn't addressed in the Info Center in the "Changed behavior between v6.0 and V7.5" section.


Peter Potkay




************************************************************
This communication, including attachments, is for the exclusive use of addressee and may contain proprietary, confidential and/or privileged information. If you are not the intended recipient, any use, copying, disclosure, dissemination or distribution is strictly prohibited. If you are not the intended recipient, please notify the sender immediately by return e-mail, delete this communication and destroy all copies.
************************************************************


________________________________

List Archive<http://listserv.meduniwien.ac.at/archives/mqser-l.html> - Manage Your List Settings<http://listserv.meduniwien.ac.at/cgi-bin/wa?SUBED1=mqser-l&A=1> - Unsubscribe<mailto:***@LISTSERV.MEDUNIWIEN.AC.AT?subject=Unsubscribe&BODY=signoff%20mqseries>

Instructions for managing your mailing list subscription are provided in the Listserv General Users Guide available at http://www.lsoft.com<http://www.lsoft.com/resources/manuals.asp>


________________________________

List Archive<http://listserv.meduniwien.ac.at/archives/mqser-l.html> - Manage Your List Settings<http://listserv.meduniwien.ac.at/cgi-bin/wa?SUBED1=mqser-l&A=1> - Unsubscribe<mailto:***@LISTSERV.MEDUNIWIEN.AC.AT?subject=Unsubscribe&BODY=signoff%20mqseries>

Instructions for managing your mailing list subscription are provided in the Listserv General Users Guide available at http://www.lsoft.com<http://www.lsoft.com/resources/manuals.asp>

************************************************************
This communication, including attachments, is for the exclusive use of addressee and may contain proprietary, confidential and/or privileged information. If you are not the intended recipient, any use, copying, disclosure, dissemination or distribution is strictly prohibited. If you are not the intended recipient, please notify the sender immediately by return e-mail, delete this communication and destroy all copies.
************************************************************


________________________________

List Archive<http://listserv.meduniwien.ac.at/archives/mqser-l.html> - Manage Your List Settings<http://listserv.meduniwien.ac.at/cgi-bin/wa?SUBED1=mqser-l&A=1> - Unsubscribe<mailto:***@LISTSERV.MEDUNIWIEN.AC.AT?subject=Unsubscribe&BODY=signoff%20mqseries>

Instructions for managing your mailing list subscription are provided in the Listserv General Users Guide available at http://www.lsoft.com<http://www.lsoft.com/resources/manuals.asp>

************************************************************
This communication, including attachments, is for the exclusive use of addressee and may contain proprietary, confidential and/or privileged information. If you are not the intended recipient, any use, copying, disclosure, dissemination or distribution is strictly prohibited. If you are not the intended recipient, please notify the sender immediately by return e-mail, delete this communication and destroy all copies.
************************************************************



________________________________
List Archive<http://listserv.meduniwien.ac.at/archives/mqser-l.html> - Manage Your List Settings<http://listserv.meduniwien.ac.at/cgi-bin/wa?SUBED1=mqser-l&A=1> - Unsubscribe<mailto:***@LISTSERV.MEDUNIWIEN.AC.AT?subject=Unsubscribe&BODY=signoff%20mqseries>

Instructions for managing your mailing list subscription are provided in the Listserv General Users Guide available at http://www.lsoft.com<http://www.lsoft.com/resources/manuals.asp>

________________________________
List Archive<http://listserv.meduniwien.ac.at/archives/mqser-l.html> - Manage Your List Settings<http://listserv.meduniwien.ac.at/cgi-bin/wa?SUBED1=mqser-l&A=1> - Unsubscribe<mailto:***@LISTSERV.MEDUNIWIEN.AC.AT?subject=Unsubscribe&BODY=signoff%20mqseries>

Instructions for managing your mailing list subscription are provided in the Listserv General Users Guide available at http://www.lsoft.com<http://www.lsoft.com/resources/manuals.asp>

************************************************************
This communication, including attachments, is for the exclusive use of addressee and may contain proprietary, confidential and/or privileged information. If you are not the intended recipient, any use, copying, disclosure, dissemination or distribution is strictly prohibited. If you are not the intended recipient, please notify the sender immediately by return e-mail, delete this communication and destroy all copies.
************************************************************

________________________________
List Archive<http://listserv.meduniwien.ac.at/archives/mqser-l.html> - Manage Your List Settings<http://listserv.meduniwien.ac.at/cgi-bin/wa?SUBED1=mqser-l&A=1> - Unsubscribe<mailto:***@LISTSERV.MEDUNIWIEN.AC.AT?subject=Unsubscribe&BODY=signoff%20mqseries>

Instructions for managing your mailing list subscription are provided in the Listserv General Users Guide available at http://www.lsoft.com<http://www.lsoft.com/resources/manuals.asp>


<BR>_____________________________________________________________
<FONT size=2><BR>
DTCC DISCLAIMER: This email and any files transmitted with it are
confidential and intended solely for the use of the individual or
entity to whom they are addressed. If you have received this email
in error, please notify us immediately and delete the email and any
attachments from your system. The recipient should check this email
and any attachments for the presence of viruses. The company
accepts no liability for any damage caused by any virus transmitted
by this email.</FONT>

To unsubscribe, write to LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org and,
in the message body (not the subject), write: SIGNOFF MQSERIES
Instructions for managing your mailing list subscription are provided in
the Listserv General Users Guide available at http://www.lsoft.com
Archive: http://listserv.meduniwien.ac.at/archives/mqser-l.html
Tim Zielke
2013-10-25 12:19:25 UTC
Permalink
Hi Grant,

I could be misinterpreting, but I think the part "the object/profile name may contain a single asterisk" is saying that "-n *" is valid. That is how I also interpret the "-n [* | ObjectName]". You can have either "-n *" or "-n ObjectName". And then there is also the restriction that if you use an asterisk on the ObjectName, it must come at the end. Regardless, the text is somewhat ambiguous.

I did try the following:

dmpmqcfg -x authrec -a -n SYSTEM.* -m xxxxxxxx -o 1line -t queue

and that returned results.

However, the following:

dmpmqcfg -x authrec -a -n SYSTEM.** -m xxxxxxxx -o 1line -t queue

did not.

There does seem to be something wrong with the -n filtering of the dmpmqcfg command, when you end with multiple asterisks.

Thanks,
Tim


From: MQSeries List [mailto:MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org] On Behalf Of Ward Able, Grant
Sent: Friday, October 25, 2013 4:33 AM
To: MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org
Subject: Re: SET AUTHREC versus setmqaut

Peter,
I was just trawling through the InfoCentre (oh how I miss the PDFs!!!) and I saw that you may only have a single "*" and that can only be at the end. Perhaps your uses of *.** is confusing the poor utility?

-n [ * | ObjectName ]
Filter the definitions produced by object or profile name, the object/profile name may contain a single asterisk. The * option can be placed only at the end of the entered filter string.



Regards - Grant.
Telephone Internal: 201496 (London)
Telephone External: +44 (0)207 650 1496

From: MQSeries List [mailto:MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org] On Behalf Of Potkay, Peter M (CTO Architecture + Engineering)
Sent: 24 October 2013 20:11
To: MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org
Subject: Re: SET AUTHREC versus setmqaut

Single or double quotes didn't make a diff. But check it out, DISPLAY AUTHREC in a runmqsc session does see it like dspmqaut and dmpmqaut does.

Seems like dmpmqcfg is the only thing that can't see this profile.



dmpmqcfg -x authrec -a -n MY.QUEUE*.** -m PETERQM -o 1line -t queue
******************************************************************************************
* Script generated on 2013-10-24 at 14.48.04
* Script generated by user 'mqm' on host 'myServer'
* Queue manager name: PETERQM
* Queue manager platform: UNIX
* Queue manager command level: (750/750)
* Command issued: dmpmqcfg -x authrec -a -n MY.QUEUE*.** -m PETERQM -o 1line -t queue
******************************************************************************************


dmpmqcfg -x authrec -a -n 'MY.QUEUE*.**' -m PETERQM -o 1line -t queue
******************************************************************************************
* Script generated on 2013-10-24 at 14.48.17
* Script generated by user 'mqm' on host 'myServer'
* Queue manager name: PETERQM
* Queue manager platform: UNIX
* Queue manager command level: (750/750)
* Command issued: dmpmqcfg -x authrec -a -n MY.QUEUE*.** -m PETERQM -o 1line -t queue
******************************************************************************************


dmpmqcfg -x authrec -a -n "MY.QUEUE*.**" -m PETERQM -o 1line -t queue
******************************************************************************************
* Script generated on 2013-10-24 at 14.49.04
* Script generated by user 'mqm' on host 'myServer'
* Queue manager name: PETERQM
* Queue manager platform: UNIX
* Queue manager command level: (750/750)
* Command issued: dmpmqcfg -x authrec -a -n MY.QUEUE*.** -m PETERQM -o 1line -t queue
******************************************************************************************


runmqsc PETERQM
5724-H72 (C) Copyright IBM Corp. 1994, 2011. ALL RIGHTS RESERVED.
Starting MQSC for queue manager PETERQM.


DISPLAY AUTHREC PROFILE(MY.QUEUE*.**)
1 : DISPLAY AUTHREC PROFILE(MY.QUEUE*.**)
AMQ8864: Display authority record details.
PROFILE(MY.QUEUE*.**) ENTITY(mygrp01)
ENTTYPE(GROUP) OBJTYPE(QUEUE)
AUTHLIST(BROWSE,GET,INQ,PUT)
end
2 : end
One MQSC command read.
No commands have a syntax error.
All valid MQSC commands were processed.



Peter Potkay
From: MQSeries List [mailto:MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org] On Behalf Of Jefferson Lowrey
Sent: Thursday, October 24, 2013 2:29 PM
To: MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org<mailto:MQSERIES-0lvw86wZMd9k/***@public.gmane.orgAC.AT>
Subject: Re: SET AUTHREC versus setmqaut

Try putting the *'s inside quotes to make sure the shell isn't interpreting them?


Thank you,

Jeff Lowrey



From: "Potkay, Peter M (CTO Architecture + Engineering)" <Peter.Potkay-***@public.gmane.org<mailto:Peter.Potkay-***@public.gmane.org>>
To: MQSERIES-JX7+OpRa80QeFbOYke1v4oOpTq8/***@public.gmane.org<mailto:MQSERIES-JX7+OpRa80Ties2YCUG/***@public.gmane.orgniwien.ac.at>,
Date: 10/24/2013 12:52 PM
Subject: Re: [MQSERIES] SET AUTHREC versus setmqaut
Sent by: MQSeries List <MQSERIES-JX7+OpRa80QeFbOYke1v4oOpTq8/***@public.gmane.org<mailto:MQSERIES-JX7+OpRa80QeFbOYke1v4oOpTq8/***@public.gmane.org>>
________________________________



I noticed some random things missing from my dmpmqcfg that I explicitly set in my setmqaut. I think I should have seen everything because I used this command:
"Command issued: dmpmqcfg -m PETERQM -x authrec -a -o mqsc"


So I did a little test:

setmqaut -m PETERQM -n MY.QUEUE*.** -t queue -g mygrp01 -all +get +browse +put +inq
The setmqaut command completed successfully.

dspmqaut -m PETERQM -n MY.QUEUE*.** -t queue -g mygrp01
Entity mygrp01 has the following authorizations for object MY.QUEUE*.**:
get
browse
put
inq

dmpmqaut -m PETERQM -t queue -n MY.QUEUE*.**
profile: MY.QUEUE*.**
object type: queue
entity: mygrp01
entity type: group
authority: get browse put inq


Old school methods are consistent. Now let's see what dmpmqcfg shows.



dmpmqcfg -x authrec -a -n CHANNEL.CHECKER*.** -m PETERQM -o 1line -t queue
******************************************************************************************
* Script generated on 2013-10-24 at 12.34.42
* Script generated by user 'mqm' on host 'MyServer'
* Queue manager name: PETERQM
* Queue manager platform: UNIX
* Queue manager command level: (750/750)
* Command issued: dmpmqcfg -x authrec -a -n MY.QUEUE*.** -m PETERQM -o 1line -t queue
******************************************************************************************

No other output for this command!
I drop the -t queue flag and run it again.

dmpmqcfg -x authrec -a -n MY.QUEUE*.** -m PETERQM -o 1line
******************************************************************************************
* Script generated on 2013-10-24 at 12.35.50
* Script generated by user 'mqm' on host 'MyServer'
* Queue manager name: PETERQM
* Queue manager platform: UNIX
* Queue manager command level: (750/750)
* Command issued: dmpmqcfg -x authrec -a -n MY.QUEUE*.** -m PETERQM -o 1line
******************************************************************************************
SET AUTHREC PROFILE('self') GROUP('mqm') OBJTYPE(QMGR) AUTHADD(ALTUSR,CHG,CONNECT,DLT,DSP,INQ,SET,SETALL,SETID,CTRL,SYSTEM)
SET AUTHREC PROFILE('self') GROUP('mygrp01') OBJTYPE(QMGR) AUTHADD(CONNECT,INQ)
SET AUTHREC PROFILE('@class') GROUP('mqm') OBJTYPE(QMGR) AUTHADD(CRT)
SET AUTHREC PROFILE('@class') GROUP('mygrp01') OBJTYPE(QMGR) AUTHADD(NONE)


OK, that output is confusing, they don't match the -n MY.QUEUE*.** that I used in the command, so why do they show up this output


There are no queues yet defined on this QM that begin with the name MY.QUEUE.

I'm concerned that dmpmqcfg is not picking up things I set with setmqaut and can see with dspmqaut and MO71. I don't trust this as a method to produce a replacement runmqsc script for my setmqaut script. There are multiple examples like this that did not get picked up from my main setmqaut script. Actually, I don't trust this to backup the authorities of a QM just for backup purposes - it seems I would need to fall back to my setmqaut script to be sure I have everything. :-?


Peter Potkay


From: MQSeries List [mailto:MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org] On Behalf Of Potkay, Peter M (CTO Architecture + Engineering)
Sent: Thursday, October 24, 2013 12:02 PM
To: MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org<mailto:MQSERIES-0lvw86wZMd9k/***@public.gmane.orgAC.AT>
Subject: Re: SET AUTHREC versus setmqaut

Good idea T.Rob, playing with it now.

Hmmm, while I can tell dmpmqcfg to only grab Authrority Records and spit them out in a runmqsc format, there doesn't appear to be a way to tell it to only do that for Auth Records for a particular User ID. Or at the very least, to at least exclude the records for the mqm ID.

Peter Potkay

From: MQSeries List [mailto:MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org] On Behalf Of T.Rob
Sent: Wednesday, October 23, 2013 10:38 AM
To: MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org<mailto:MQSERIES-0lvw86wZMd9k/***@public.gmane.orgAC.AT>
Subject: Re: SET AUTHREC versus setmqaut

For what it's worth the conversion is pretty easy. Run your setmqaut scripts, then run dmpmqcfg to spit out the SET AUTHREC equivalents.

Personally, it's worth the trouble to me to convert. The setmqaut commands need to be run from the command line locally and in many shops end up in different change control systems, sitting on the local filesystem, etc. I like it much better that I can define an object and then define the ACLs for that object immediately adjacent to it in the script, that it's one script, that it can be run remotely, etc.

But then I script everything so YMMV.

-- T.Rob


From: MQSeries List [mailto:MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org] On Behalf Of Potkay, Peter M (CTO Architecture + Engineering)
Sent: Wednesday, October 23, 2013 10:08 AM
To: MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org<mailto:MQSERIES-0lvw86wZMd9k/***@public.gmane.orgAC.AT>
Subject: SET AUTHREC versus setmqaut

Is there any reason to take the time and effort of rewriting my setmqaut scripts into SET AUTHREC commands?

So far the only reason I came up with is that then my standard runmqsc script I use for new QMs could also take care of the security stuff, versus having to run a second script specific to setmqaut.


Are AUTHREC just another way of doing the same thing?
Is setmqaut on the Endangered Species List, so sooner or later I'm gonna have to switch anyway?
Does AUTHREC provide or remove capability compared to setmqaut?

Google doesn't know.....
The new AUTHREC isn't addressed in the Info Center in the "Changed behavior between v6.0 and V7.5" section.


Peter Potkay




************************************************************
This communication, including attachments, is for the exclusive use of addressee and may contain proprietary, confidential and/or privileged information. If you are not the intended recipient, any use, copying, disclosure, dissemination or distribution is strictly prohibited. If you are not the intended recipient, please notify the sender immediately by return e-mail, delete this communication and destroy all copies.
************************************************************


________________________________

List Archive<http://listserv.meduniwien.ac.at/archives/mqser-l.html> - Manage Your List Settings<http://listserv.meduniwien.ac.at/cgi-bin/wa?SUBED1=mqser-l&A=1> - Unsubscribe<mailto:LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org?subject=Unsubscribe&BODY=signoff%20mqseries>

Instructions for managing your mailing list subscription are provided in the Listserv General Users Guide available at http://www.lsoft.com<http://www.lsoft.com/resources/manuals.asp>


________________________________

List Archive<http://listserv.meduniwien.ac.at/archives/mqser-l.html> - Manage Your List Settings<http://listserv.meduniwien.ac.at/cgi-bin/wa?SUBED1=mqser-l&A=1> - Unsubscribe<mailto:LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org?subject=Unsubscribe&BODY=signoff%20mqseries>

Instructions for managing your mailing list subscription are provided in the Listserv General Users Guide available at http://www.lsoft.com<http://www.lsoft.com/resources/manuals.asp>

************************************************************
This communication, including attachments, is for the exclusive use of addressee and may contain proprietary, confidential and/or privileged information. If you are not the intended recipient, any use, copying, disclosure, dissemination or distribution is strictly prohibited. If you are not the intended recipient, please notify the sender immediately by return e-mail, delete this communication and destroy all copies.
************************************************************


________________________________

List Archive<http://listserv.meduniwien.ac.at/archives/mqser-l.html> - Manage Your List Settings<http://listserv.meduniwien.ac.at/cgi-bin/wa?SUBED1=mqser-l&A=1> - Unsubscribe<mailto:LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org?subject=Unsubscribe&BODY=signoff%20mqseries>

Instructions for managing your mailing list subscription are provided in the Listserv General Users Guide available at http://www.lsoft.com<http://www.lsoft.com/resources/manuals.asp>

************************************************************
This communication, including attachments, is for the exclusive use of addressee and may contain proprietary, confidential and/or privileged information. If you are not the intended recipient, any use, copying, disclosure, dissemination or distribution is strictly prohibited. If you are not the intended recipient, please notify the sender immediately by return e-mail, delete this communication and destroy all copies.
************************************************************



________________________________
List Archive<http://listserv.meduniwien.ac.at/archives/mqser-l.html> - Manage Your List Settings<http://listserv.meduniwien.ac.at/cgi-bin/wa?SUBED1=mqser-l&A=1> - Unsubscribe<mailto:LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org?subject=Unsubscribe&BODY=signoff%20mqseries>

Instructions for managing your mailing list subscription are provided in the Listserv General Users Guide available at http://www.lsoft.com<http://www.lsoft.com/resources/manuals.asp>

________________________________
List Archive<http://listserv.meduniwien.ac.at/archives/mqser-l.html> - Manage Your List Settings<http://listserv.meduniwien.ac.at/cgi-bin/wa?SUBED1=mqser-l&A=1> - Unsubscribe<mailto:LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org?subject=Unsubscribe&BODY=signoff%20mqseries>

Instructions for managing your mailing list subscription are provided in the Listserv General Users Guide available at http://www.lsoft.com<http://www.lsoft.com/resources/manuals.asp>

************************************************************
This communication, including attachments, is for the exclusive use of addressee and may contain proprietary, confidential and/or privileged information. If you are not the intended recipient, any use, copying, disclosure, dissemination or distribution is strictly prohibited. If you are not the intended recipient, please notify the sender immediately by return e-mail, delete this communication and destroy all copies.
************************************************************

________________________________
List Archive<http://listserv.meduniwien.ac.at/archives/mqser-l.html> - Manage Your List Settings<http://listserv.meduniwien.ac.at/cgi-bin/wa?SUBED1=mqser-l&A=1> - Unsubscribe<mailto:LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org?subject=Unsubscribe&BODY=signoff%20mqseries>

Instructions for managing your mailing list subscription are provided in the Listserv General Users Guide available at http://www.lsoft.com<http://www.lsoft.com/resources/manuals.asp>

_____________________________________________________________
DTCC DISCLAIMER: This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error, please notify us immediately and delete the email and any attachments from your system. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email.
________________________________
List Archive<http://listserv.meduniwien.ac.at/archives/mqser-l.html> - Manage Your List Settings<http://listserv.meduniwien.ac.at/cgi-bin/wa?SUBED1=mqser-l&A=1> - Unsubscribe<mailto:LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org?subject=Unsubscribe&BODY=signoff%20mqseries>

Instructions for managing your mailing list subscription are provided in the Listserv General Users Guide available at http://www.lsoft.com<http://www.lsoft.com/resources/manuals.asp>

To unsubscribe, write to LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org and,
in the message body (not the subject), write: SIGNOFF MQSERIES
Instructions for managing your mailing list subscription are provided in
the Listserv General Users Guide available at http://www.lsoft.com
Archive: http://listserv.meduniwien.ac.at/archives/mqser-l.html
Potkay, Peter M (CTO Architecture + Engineering)
2013-10-25 12:48:21 UTC
Permalink
I think you're on to something with the multiple asterisks. And, it also seems to be impacted on whether there is an object that already exists or not that matches the profile.

I do not have any queues that start with NEW.QUEUE at this point.


setmqaut -m PETERQM -t q -n NEW.QUEUE*.** -g mygrp01 +inq
The setmqaut command completed successfully.

dspmqaut -m PETERQM -t q -n NEW.QUEUE*.** -g mygrp01
Entity mygrp01 has the following authorizations for object NEW.QUEUE*.**:
inq

dmpmqaut -m PETERQM -t q -n NEW.QUEUE*.**
profile: NEW.QUEUE*.**
object type: queue
entity: mygrp01
entity type: group
authority: inq



No problems for dspmqaut or dmpmqaut to recognize this new profile. Now let's try dmpmqcfg



dmpmqcfg -x authrec -a -n "NEW.QUEUE*.**" -m PETERQM -o 1line -t queue
******************************************************************************************
* Script generated on 2013-10-25 at 08.34.28
* Script generated by user 'mqm' on host 'myServer'
* Queue manager name: PETERQM
* Queue manager platform: UNIX
* Queue manager command level: (750/750)
* Command issued: dmpmqcfg -x authrec -a -n NEW.QUEUE*.** -m PETERQM -o 1line -t queue
******************************************************************************************

Again with only 1 asterisk:

dmpmqcfg -x authrec -a -n "NEW.QUEUE*" -m PETERQM -o 1line -t queue
******************************************************************************************
* Script generated on 2013-10-25 at 08.34.45
* Script generated by user 'mqm' on host 'myServer'
* Queue manager name: PETERQM
* Queue manager platform: UNIX
* Queue manager command level: (750/750)
* Command issued: dmpmqcfg -x authrec -a -n NEW.QUEUE* -m PETERQM -o 1line -t queue
******************************************************************************************
* No matching queue objects



Notice that while both attempts with dmpmqcfg fail to get a hit, the second command where I use only one asterisk produces one extra line of output.


Now I'll create one queue that matches this profile name.



runmqsc PETERQM
5724-H72 (C) Copyright IBM Corp. 1994, 2011. ALL RIGHTS RESERVED.
Starting MQSC for queue manager PETERQM.


DEF QL (NEW.QUEUE.ONE)
1 : DEF QL (NEW.QUEUE.ONE)
AMQ8006: WebSphere MQ queue created.
end
2 : end
One MQSC command read.
No commands have a syntax error.
All valid MQSC commands were processed.


dmpmqcfg -x authrec -a -n "NEW.QUEUE*.**" -m PETERQM -o 1line -t queue
******************************************************************************************
* Script generated on 2013-10-25 at 08.37.21
* Script generated by user 'mqm' on host 'myServer'
* Queue manager name: PETERQM
* Queue manager platform: UNIX
* Queue manager command level: (750/750)
* Command issued: dmpmqcfg -x authrec -a -n NEW.QUEUE*.** -m PETERQM -o 1line -t queue
******************************************************************************************

With multiple asterisks still no joy.



dmpmqcfg -x authrec -a -n "NEW.QUEUE*" -m PETERQM -o 1line -t queue
******************************************************************************************
* Script generated on 2013-10-25 at 08.37.25
* Script generated by user 'mqm' on host 'myServer'
* Queue manager name: PETERQM
* Queue manager platform: UNIX
* Queue manager command level: (750/750)
* Command issued: dmpmqcfg -x authrec -a -n NEW.QUEUE* -m PETERQM -o 1line -t queue
******************************************************************************************
SET AUTHREC PROFILE('NEW.QUEUE.ONE') GROUP('mqm') OBJTYPE(QUEUE) AUTHADD(BROWSE,CHG,CLR,DLT,DSP,GET,INQ,PUT,PASSALL,PASSID,SET,SETALL,SETID)
SET AUTHREC PROFILE('NEW.QUEUE*.**') GROUP('mygrp01') OBJTYPE(QUEUE) AUTHADD(INQ)


Hello!



I'll copy and paste this email into a PMR now.
And rely on dmpmqaut or dspmqaut in the meantime to get an accurate list of authority records for a Queue Manager.






Peter Potkay


From: MQSeries List [mailto:MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org] On Behalf Of Tim Zielke
Sent: Friday, October 25, 2013 8:19 AM
To: MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org
Subject: Re: SET AUTHREC versus setmqaut

Hi Grant,

I could be misinterpreting, but I think the part "the object/profile name may contain a single asterisk" is saying that "-n *" is valid. That is how I also interpret the "-n [* | ObjectName]". You can have either "-n *" or "-n ObjectName". And then there is also the restriction that if you use an asterisk on the ObjectName, it must come at the end. Regardless, the text is somewhat ambiguous.

I did try the following:

dmpmqcfg -x authrec -a -n SYSTEM.* -m xxxxxxxx -o 1line -t queue

and that returned results.

However, the following:

dmpmqcfg -x authrec -a -n SYSTEM.** -m xxxxxxxx -o 1line -t queue

did not.

There does seem to be something wrong with the -n filtering of the dmpmqcfg command, when you end with multiple asterisks.

Thanks,
Tim

From: MQSeries List [mailto:MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org] On Behalf Of Ward Able, Grant
Sent: Friday, October 25, 2013 4:33 AM
To: MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org<mailto:MQSERIES-0lvw86wZMd9k/***@public.gmane.orgAC.AT>
Subject: Re: SET AUTHREC versus setmqaut

Peter,
I was just trawling through the InfoCentre (oh how I miss the PDFs!!!) and I saw that you may only have a single "*" and that can only be at the end. Perhaps your uses of *.** is confusing the poor utility?

-n [ * | ObjectName ]
Filter the definitions produced by object or profile name, the object/profile name may contain a single asterisk. The * option can be placed only at the end of the entered filter string.



Regards - Grant.
Telephone Internal: 201496 (London)
Telephone External: +44 (0)207 650 1496

From: MQSeries List [mailto:MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org] On Behalf Of Potkay, Peter M (CTO Architecture + Engineering)
Sent: 24 October 2013 20:11
To: MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org<mailto:MQSERIES-0lvw86wZMd9k/***@public.gmane.orgAC.AT>
Subject: Re: SET AUTHREC versus setmqaut

Single or double quotes didn't make a diff. But check it out, DISPLAY AUTHREC in a runmqsc session does see it like dspmqaut and dmpmqaut does.

Seems like dmpmqcfg is the only thing that can't see this profile.



dmpmqcfg -x authrec -a -n MY.QUEUE*.** -m PETERQM -o 1line -t queue
******************************************************************************************
* Script generated on 2013-10-24 at 14.48.04
* Script generated by user 'mqm' on host 'myServer'
* Queue manager name: PETERQM
* Queue manager platform: UNIX
* Queue manager command level: (750/750)
* Command issued: dmpmqcfg -x authrec -a -n MY.QUEUE*.** -m PETERQM -o 1line -t queue
******************************************************************************************


dmpmqcfg -x authrec -a -n 'MY.QUEUE*.**' -m PETERQM -o 1line -t queue
******************************************************************************************
* Script generated on 2013-10-24 at 14.48.17
* Script generated by user 'mqm' on host 'myServer'
* Queue manager name: PETERQM
* Queue manager platform: UNIX
* Queue manager command level: (750/750)
* Command issued: dmpmqcfg -x authrec -a -n MY.QUEUE*.** -m PETERQM -o 1line -t queue
******************************************************************************************


dmpmqcfg -x authrec -a -n "MY.QUEUE*.**" -m PETERQM -o 1line -t queue
******************************************************************************************
* Script generated on 2013-10-24 at 14.49.04
* Script generated by user 'mqm' on host 'myServer'
* Queue manager name: PETERQM
* Queue manager platform: UNIX
* Queue manager command level: (750/750)
* Command issued: dmpmqcfg -x authrec -a -n MY.QUEUE*.** -m PETERQM -o 1line -t queue
******************************************************************************************


runmqsc PETERQM
5724-H72 (C) Copyright IBM Corp. 1994, 2011. ALL RIGHTS RESERVED.
Starting MQSC for queue manager PETERQM.


DISPLAY AUTHREC PROFILE(MY.QUEUE*.**)
1 : DISPLAY AUTHREC PROFILE(MY.QUEUE*.**)
AMQ8864: Display authority record details.
PROFILE(MY.QUEUE*.**) ENTITY(mygrp01)
ENTTYPE(GROUP) OBJTYPE(QUEUE)
AUTHLIST(BROWSE,GET,INQ,PUT)
end
2 : end
One MQSC command read.
No commands have a syntax error.
All valid MQSC commands were processed.



Peter Potkay
From: MQSeries List [mailto:MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org] On Behalf Of Jefferson Lowrey
Sent: Thursday, October 24, 2013 2:29 PM
To: MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org<mailto:MQSERIES-0lvw86wZMd9k/***@public.gmane.orgAC.AT>
Subject: Re: SET AUTHREC versus setmqaut

Try putting the *'s inside quotes to make sure the shell isn't interpreting them?


Thank you,

Jeff Lowrey



From: "Potkay, Peter M (CTO Architecture + Engineering)" <Peter.Potkay-***@public.gmane.org<mailto:Peter.Potkay-***@public.gmane.org>>
To: MQSERIES-JX7+OpRa80QeFbOYke1v4oOpTq8/***@public.gmane.org<mailto:MQSERIES-JX7+OpRa80Ties2YCUG/***@public.gmane.orgniwien.ac.at>,
Date: 10/24/2013 12:52 PM
Subject: Re: [MQSERIES] SET AUTHREC versus setmqaut
Sent by: MQSeries List <MQSERIES-JX7+OpRa80QeFbOYke1v4oOpTq8/***@public.gmane.org<mailto:MQSERIES-JX7+OpRa80QeFbOYke1v4oOpTq8/***@public.gmane.org>>
________________________________



I noticed some random things missing from my dmpmqcfg that I explicitly set in my setmqaut. I think I should have seen everything because I used this command:
"Command issued: dmpmqcfg -m PETERQM -x authrec -a -o mqsc"


So I did a little test:

setmqaut -m PETERQM -n MY.QUEUE*.** -t queue -g mygrp01 -all +get +browse +put +inq
The setmqaut command completed successfully.

dspmqaut -m PETERQM -n MY.QUEUE*.** -t queue -g mygrp01
Entity mygrp01 has the following authorizations for object MY.QUEUE*.**:
get
browse
put
inq

dmpmqaut -m PETERQM -t queue -n MY.QUEUE*.**
profile: MY.QUEUE*.**
object type: queue
entity: mygrp01
entity type: group
authority: get browse put inq


Old school methods are consistent. Now let's see what dmpmqcfg shows.



dmpmqcfg -x authrec -a -n CHANNEL.CHECKER*.** -m PETERQM -o 1line -t queue
******************************************************************************************
* Script generated on 2013-10-24 at 12.34.42
* Script generated by user 'mqm' on host 'MyServer'
* Queue manager name: PETERQM
* Queue manager platform: UNIX
* Queue manager command level: (750/750)
* Command issued: dmpmqcfg -x authrec -a -n MY.QUEUE*.** -m PETERQM -o 1line -t queue
******************************************************************************************

No other output for this command!
I drop the -t queue flag and run it again.

dmpmqcfg -x authrec -a -n MY.QUEUE*.** -m PETERQM -o 1line
******************************************************************************************
* Script generated on 2013-10-24 at 12.35.50
* Script generated by user 'mqm' on host 'MyServer'
* Queue manager name: PETERQM
* Queue manager platform: UNIX
* Queue manager command level: (750/750)
* Command issued: dmpmqcfg -x authrec -a -n MY.QUEUE*.** -m PETERQM -o 1line
******************************************************************************************
SET AUTHREC PROFILE('self') GROUP('mqm') OBJTYPE(QMGR) AUTHADD(ALTUSR,CHG,CONNECT,DLT,DSP,INQ,SET,SETALL,SETID,CTRL,SYSTEM)
SET AUTHREC PROFILE('self') GROUP('mygrp01') OBJTYPE(QMGR) AUTHADD(CONNECT,INQ)
SET AUTHREC PROFILE('@class') GROUP('mqm') OBJTYPE(QMGR) AUTHADD(CRT)
SET AUTHREC PROFILE('@class') GROUP('mygrp01') OBJTYPE(QMGR) AUTHADD(NONE)


OK, that output is confusing, they don't match the -n MY.QUEUE*.** that I used in the command, so why do they show up this output


There are no queues yet defined on this QM that begin with the name MY.QUEUE.

I'm concerned that dmpmqcfg is not picking up things I set with setmqaut and can see with dspmqaut and MO71. I don't trust this as a method to produce a replacement runmqsc script for my setmqaut script. There are multiple examples like this that did not get picked up from my main setmqaut script. Actually, I don't trust this to backup the authorities of a QM just for backup purposes - it seems I would need to fall back to my setmqaut script to be sure I have everything. :-?


Peter Potkay


From: MQSeries List [mailto:MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org] On Behalf Of Potkay, Peter M (CTO Architecture + Engineering)
Sent: Thursday, October 24, 2013 12:02 PM
To: MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org<mailto:MQSERIES-0lvw86wZMd9k/***@public.gmane.orgAC.AT>
Subject: Re: SET AUTHREC versus setmqaut

Good idea T.Rob, playing with it now.

Hmmm, while I can tell dmpmqcfg to only grab Authrority Records and spit them out in a runmqsc format, there doesn't appear to be a way to tell it to only do that for Auth Records for a particular User ID. Or at the very least, to at least exclude the records for the mqm ID.

Peter Potkay

From: MQSeries List [mailto:MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org] On Behalf Of T.Rob
Sent: Wednesday, October 23, 2013 10:38 AM
To: MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org<mailto:MQSERIES-0lvw86wZMd9k/***@public.gmane.orgAC.AT>
Subject: Re: SET AUTHREC versus setmqaut

For what it's worth the conversion is pretty easy. Run your setmqaut scripts, then run dmpmqcfg to spit out the SET AUTHREC equivalents.

Personally, it's worth the trouble to me to convert. The setmqaut commands need to be run from the command line locally and in many shops end up in different change control systems, sitting on the local filesystem, etc. I like it much better that I can define an object and then define the ACLs for that object immediately adjacent to it in the script, that it's one script, that it can be run remotely, etc.

But then I script everything so YMMV.

-- T.Rob


From: MQSeries List [mailto:MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org] On Behalf Of Potkay, Peter M (CTO Architecture + Engineering)
Sent: Wednesday, October 23, 2013 10:08 AM
To: MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org<mailto:MQSERIES-0lvw86wZMd9k/***@public.gmane.orgAC.AT>
Subject: SET AUTHREC versus setmqaut

Is there any reason to take the time and effort of rewriting my setmqaut scripts into SET AUTHREC commands?

So far the only reason I came up with is that then my standard runmqsc script I use for new QMs could also take care of the security stuff, versus having to run a second script specific to setmqaut.


Are AUTHREC just another way of doing the same thing?
Is setmqaut on the Endangered Species List, so sooner or later I'm gonna have to switch anyway?
Does AUTHREC provide or remove capability compared to setmqaut?

Google doesn't know.....
The new AUTHREC isn't addressed in the Info Center in the "Changed behavior between v6.0 and V7.5" section.


Peter Potkay




************************************************************
This communication, including attachments, is for the exclusive use of addressee and may contain proprietary, confidential and/or privileged information. If you are not the intended recipient, any use, copying, disclosure, dissemination or distribution is strictly prohibited. If you are not the intended recipient, please notify the sender immediately by return e-mail, delete this communication and destroy all copies.
************************************************************


________________________________

List Archive<http://listserv.meduniwien.ac.at/archives/mqser-l.html> - Manage Your List Settings<http://listserv.meduniwien.ac.at/cgi-bin/wa?SUBED1=mqser-l&A=1> - Unsubscribe<mailto:LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org?subject=Unsubscribe&BODY=signoff%20mqseries>

Instructions for managing your mailing list subscription are provided in the Listserv General Users Guide available at http://www.lsoft.com<http://www.lsoft.com/resources/manuals.asp>


________________________________

List Archive<http://listserv.meduniwien.ac.at/archives/mqser-l.html> - Manage Your List Settings<http://listserv.meduniwien.ac.at/cgi-bin/wa?SUBED1=mqser-l&A=1> - Unsubscribe<mailto:LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org?subject=Unsubscribe&BODY=signoff%20mqseries>

Instructions for managing your mailing list subscription are provided in the Listserv General Users Guide available at http://www.lsoft.com<http://www.lsoft.com/resources/manuals.asp>

************************************************************
This communication, including attachments, is for the exclusive use of addressee and may contain proprietary, confidential and/or privileged information. If you are not the intended recipient, any use, copying, disclosure, dissemination or distribution is strictly prohibited. If you are not the intended recipient, please notify the sender immediately by return e-mail, delete this communication and destroy all copies.
************************************************************


________________________________

List Archive<http://listserv.meduniwien.ac.at/archives/mqser-l.html> - Manage Your List Settings<http://listserv.meduniwien.ac.at/cgi-bin/wa?SUBED1=mqser-l&A=1> - Unsubscribe<mailto:LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org?subject=Unsubscribe&BODY=signoff%20mqseries>

Instructions for managing your mailing list subscription are provided in the Listserv General Users Guide available at http://www.lsoft.com<http://www.lsoft.com/resources/manuals.asp>

************************************************************
This communication, including attachments, is for the exclusive use of addressee and may contain proprietary, confidential and/or privileged information. If you are not the intended recipient, any use, copying, disclosure, dissemination or distribution is strictly prohibited. If you are not the intended recipient, please notify the sender immediately by return e-mail, delete this communication and destroy all copies.
************************************************************



________________________________
List Archive<http://listserv.meduniwien.ac.at/archives/mqser-l.html> - Manage Your List Settings<http://listserv.meduniwien.ac.at/cgi-bin/wa?SUBED1=mqser-l&A=1> - Unsubscribe<mailto:LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org?subject=Unsubscribe&BODY=signoff%20mqseries>

Instructions for managing your mailing list subscription are provided in the Listserv General Users Guide available at http://www.lsoft.com<http://www.lsoft.com/resources/manuals.asp>

________________________________
List Archive<http://listserv.meduniwien.ac.at/archives/mqser-l.html> - Manage Your List Settings<http://listserv.meduniwien.ac.at/cgi-bin/wa?SUBED1=mqser-l&A=1> - Unsubscribe<mailto:LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org?subject=Unsubscribe&BODY=signoff%20mqseries>

Instructions for managing your mailing list subscription are provided in the Listserv General Users Guide available at http://www.lsoft.com<http://www.lsoft.com/resources/manuals.asp>

************************************************************
This communication, including attachments, is for the exclusive use of addressee and may contain proprietary, confidential and/or privileged information. If you are not the intended recipient, any use, copying, disclosure, dissemination or distribution is strictly prohibited. If you are not the intended recipient, please notify the sender immediately by return e-mail, delete this communication and destroy all copies.
************************************************************

________________________________
List Archive<http://listserv.meduniwien.ac.at/archives/mqser-l.html> - Manage Your List Settings<http://listserv.meduniwien.ac.at/cgi-bin/wa?SUBED1=mqser-l&A=1> - Unsubscribe<mailto:LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org?subject=Unsubscribe&BODY=signoff%20mqseries>

Instructions for managing your mailing list subscription are provided in the Listserv General Users Guide available at http://www.lsoft.com<http://www.lsoft.com/resources/manuals.asp>

_____________________________________________________________
DTCC DISCLAIMER: This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error, please notify us immediately and delete the email and any attachments from your system. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email.
________________________________
List Archive<http://listserv.meduniwien.ac.at/archives/mqser-l.html> - Manage Your List Settings<http://listserv.meduniwien.ac.at/cgi-bin/wa?SUBED1=mqser-l&A=1> - Unsubscribe<mailto:LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org?subject=Unsubscribe&BODY=signoff%20mqseries>

Instructions for managing your mailing list subscription are provided in the Listserv General Users Guide available at http://www.lsoft.com<http://www.lsoft.com/resources/manuals.asp>

________________________________
List Archive<http://listserv.meduniwien.ac.at/archives/mqser-l.html> - Manage Your List Settings<http://listserv.meduniwien.ac.at/cgi-bin/wa?SUBED1=mqser-l&A=1> - Unsubscribe<mailto:LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org?subject=Unsubscribe&BODY=signoff%20mqseries>

Instructions for managing your mailing list subscription are provided in the Listserv General Users Guide available at http://www.lsoft.com<http://www.lsoft.com/resources/manuals.asp>
************************************************************
This communication, including attachments, is for the exclusive use of addressee and may contain proprietary, confidential and/or privileged information. If you are not the intended recipient, any use, copying, disclosure, dissemination or distribution is strictly prohibited. If you are not the intended recipient, please notify the sender immediately by return e-mail, delete this communication and destroy all copies.
************************************************************

To unsubscribe, write to LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org and,
in the message body (not the subject), write: SIGNOFF MQSERIES
Instructions for managing your mailing list subscription are provided in
the Listserv General Users Guide available at http://www.lsoft.com
Archive: http://listserv.meduniwien.ac.at/archives/mqser-l.html
Potkay, Peter M (CTO Architecture + Engineering)
2013-10-30 00:49:05 UTC
Permalink
This is a problem with dmpmqcfg that goes beyond generic profiles. Consider the following example for a profile I created that has no wild characters in it. The runmqsc command to display authority records shows it, yet dmpmqcfg does not.

setmqaut -m PETERQM -t q -n THIS.QUEUE.DOES.NOT.EXITS.YET -g mygrp01 +inq
The setmqaut command completed successfully.

dspmqaut -m PETERQM -t q -g mygrp01 -n THIS.QUEUE.DOES.NOT.EXITS.YET
Entity mqappgrp01 has the following authorizations for object THIS.QUEUE.DOES.NOT.EXITS.YET:
inq

runmqsc PETERQM
5724-H72 (C) Copyright IBM Corp. 1994, 2011. ALL RIGHTS RESERVED.
Starting MQSC for queue manager PETERQM.

DISPLAY AUTHREC

AMQ8864: Display authority record details.
PROFILE(THIS.QUEUE.DOES.NOT.EXITS.YET)
ENTITY(mygrp01) ENTTYPE(GROUP)
OBJTYPE(QUEUE) AUTHLIST(INQ)


dmpmqcfg -x authrec -a -m PETERQM -o 1line -t queue -n THIS.QUEUE.DOES.NOT.EXITS.YET
******************************************************************************************
* Script generated on 2013-10-29 at 20.18.26
* Script generated by user 'mqm' on host 'myServer'
* Queue manager name: PETERQM
* Queue manager platform: UNIX
* Queue manager command level: (750/750)
* Command issued: dmpmqcfg -x authrec -a -m PETERQM -o 1line -t queue -n THIS.QUEUE.DOES.NOT.EXITS.YET
******************************************************************************************
* No matching queue objects



I have a PMR open.

The dspmqaut, dmpmqaut, amqoamd and runmqsc methods of reporting on what a QM knows about these type of profiles do report them. The dmpmqcfg command does not.

Be careful if you replaced MS03 with dmpmqcfg when it comes to authority records - you may not be getting 100% of what you think you are if you have profiles defined for future queues yet to be defined.

Peter Potkay


From: MQSeries List [mailto:MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org] On Behalf Of Potkay, Peter M (CTO Architecture + Engineering)
Sent: Friday, October 25, 2013 8:48 AM
To: MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org
Subject: Re: SET AUTHREC versus setmqaut

I think you're on to something with the multiple asterisks. And, it also seems to be impacted on whether there is an object that already exists or not that matches the profile.

I do not have any queues that start with NEW.QUEUE at this point.


setmqaut -m PETERQM -t q -n NEW.QUEUE*.** -g mygrp01 +inq
The setmqaut command completed successfully.

dspmqaut -m PETERQM -t q -n NEW.QUEUE*.** -g mygrp01
Entity mygrp01 has the following authorizations for object NEW.QUEUE*.**:
inq

dmpmqaut -m PETERQM -t q -n NEW.QUEUE*.**
profile: NEW.QUEUE*.**
object type: queue
entity: mygrp01
entity type: group
authority: inq



No problems for dspmqaut or dmpmqaut to recognize this new profile. Now let's try dmpmqcfg



dmpmqcfg -x authrec -a -n "NEW.QUEUE*.**" -m PETERQM -o 1line -t queue
******************************************************************************************
* Script generated on 2013-10-25 at 08.34.28
* Script generated by user 'mqm' on host 'myServer'
* Queue manager name: PETERQM
* Queue manager platform: UNIX
* Queue manager command level: (750/750)
* Command issued: dmpmqcfg -x authrec -a -n NEW.QUEUE*.** -m PETERQM -o 1line -t queue
******************************************************************************************

Again with only 1 asterisk:

dmpmqcfg -x authrec -a -n "NEW.QUEUE*" -m PETERQM -o 1line -t queue
******************************************************************************************
* Script generated on 2013-10-25 at 08.34.45
* Script generated by user 'mqm' on host 'myServer'
* Queue manager name: PETERQM
* Queue manager platform: UNIX
* Queue manager command level: (750/750)
* Command issued: dmpmqcfg -x authrec -a -n NEW.QUEUE* -m PETERQM -o 1line -t queue
******************************************************************************************
* No matching queue objects



Notice that while both attempts with dmpmqcfg fail to get a hit, the second command where I use only one asterisk produces one extra line of output.


Now I'll create one queue that matches this profile name.



runmqsc PETERQM
5724-H72 (C) Copyright IBM Corp. 1994, 2011. ALL RIGHTS RESERVED.
Starting MQSC for queue manager PETERQM.


DEF QL (NEW.QUEUE.ONE)
1 : DEF QL (NEW.QUEUE.ONE)
AMQ8006: WebSphere MQ queue created.
end
2 : end
One MQSC command read.
No commands have a syntax error.
All valid MQSC commands were processed.


dmpmqcfg -x authrec -a -n "NEW.QUEUE*.**" -m PETERQM -o 1line -t queue
******************************************************************************************
* Script generated on 2013-10-25 at 08.37.21
* Script generated by user 'mqm' on host 'myServer'
* Queue manager name: PETERQM
* Queue manager platform: UNIX
* Queue manager command level: (750/750)
* Command issued: dmpmqcfg -x authrec -a -n NEW.QUEUE*.** -m PETERQM -o 1line -t queue
******************************************************************************************

With multiple asterisks still no joy.



dmpmqcfg -x authrec -a -n "NEW.QUEUE*" -m PETERQM -o 1line -t queue
******************************************************************************************
* Script generated on 2013-10-25 at 08.37.25
* Script generated by user 'mqm' on host 'myServer'
* Queue manager name: PETERQM
* Queue manager platform: UNIX
* Queue manager command level: (750/750)
* Command issued: dmpmqcfg -x authrec -a -n NEW.QUEUE* -m PETERQM -o 1line -t queue
******************************************************************************************
SET AUTHREC PROFILE('NEW.QUEUE.ONE') GROUP('mqm') OBJTYPE(QUEUE) AUTHADD(BROWSE,CHG,CLR,DLT,DSP,GET,INQ,PUT,PASSALL,PASSID,SET,SETALL,SETID)
SET AUTHREC PROFILE('NEW.QUEUE*.**') GROUP('mygrp01') OBJTYPE(QUEUE) AUTHADD(INQ)


Hello!



I'll copy and paste this email into a PMR now.
And rely on dmpmqaut or dspmqaut in the meantime to get an accurate list of authority records for a Queue Manager.






Peter Potkay

From: MQSeries List [mailto:MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org] On Behalf Of Tim Zielke
Sent: Friday, October 25, 2013 8:19 AM
To: MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org<mailto:MQSERIES-0lvw86wZMd9k/***@public.gmane.orgAC.AT>
Subject: Re: SET AUTHREC versus setmqaut

Hi Grant,

I could be misinterpreting, but I think the part "the object/profile name may contain a single asterisk" is saying that "-n *" is valid. That is how I also interpret the "-n [* | ObjectName]". You can have either "-n *" or "-n ObjectName". And then there is also the restriction that if you use an asterisk on the ObjectName, it must come at the end. Regardless, the text is somewhat ambiguous.

I did try the following:

dmpmqcfg -x authrec -a -n SYSTEM.* -m xxxxxxxx -o 1line -t queue

and that returned results.

However, the following:

dmpmqcfg -x authrec -a -n SYSTEM.** -m xxxxxxxx -o 1line -t queue

did not.

There does seem to be something wrong with the -n filtering of the dmpmqcfg command, when you end with multiple asterisks.

Thanks,
Tim

From: MQSeries List [mailto:MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org] On Behalf Of Ward Able, Grant
Sent: Friday, October 25, 2013 4:33 AM
To: MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org<mailto:MQSERIES-0lvw86wZMd9k/***@public.gmane.orgAC.AT>
Subject: Re: SET AUTHREC versus setmqaut

Peter,
I was just trawling through the InfoCentre (oh how I miss the PDFs!!!) and I saw that you may only have a single "*" and that can only be at the end. Perhaps your uses of *.** is confusing the poor utility?

-n [ * | ObjectName ]
Filter the definitions produced by object or profile name, the object/profile name may contain a single asterisk. The * option can be placed only at the end of the entered filter string.



Regards - Grant.
Telephone Internal: 201496 (London)
Telephone External: +44 (0)207 650 1496

From: MQSeries List [mailto:MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org] On Behalf Of Potkay, Peter M (CTO Architecture + Engineering)
Sent: 24 October 2013 20:11
To: MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org<mailto:MQSERIES-0lvw86wZMd9k/***@public.gmane.orgAC.AT>
Subject: Re: SET AUTHREC versus setmqaut

Single or double quotes didn't make a diff. But check it out, DISPLAY AUTHREC in a runmqsc session does see it like dspmqaut and dmpmqaut does.

Seems like dmpmqcfg is the only thing that can't see this profile.



dmpmqcfg -x authrec -a -n MY.QUEUE*.** -m PETERQM -o 1line -t queue
******************************************************************************************
* Script generated on 2013-10-24 at 14.48.04
* Script generated by user 'mqm' on host 'myServer'
* Queue manager name: PETERQM
* Queue manager platform: UNIX
* Queue manager command level: (750/750)
* Command issued: dmpmqcfg -x authrec -a -n MY.QUEUE*.** -m PETERQM -o 1line -t queue
******************************************************************************************


dmpmqcfg -x authrec -a -n 'MY.QUEUE*.**' -m PETERQM -o 1line -t queue
******************************************************************************************
* Script generated on 2013-10-24 at 14.48.17
* Script generated by user 'mqm' on host 'myServer'
* Queue manager name: PETERQM
* Queue manager platform: UNIX
* Queue manager command level: (750/750)
* Command issued: dmpmqcfg -x authrec -a -n MY.QUEUE*.** -m PETERQM -o 1line -t queue
******************************************************************************************


dmpmqcfg -x authrec -a -n "MY.QUEUE*.**" -m PETERQM -o 1line -t queue
******************************************************************************************
* Script generated on 2013-10-24 at 14.49.04
* Script generated by user 'mqm' on host 'myServer'
* Queue manager name: PETERQM
* Queue manager platform: UNIX
* Queue manager command level: (750/750)
* Command issued: dmpmqcfg -x authrec -a -n MY.QUEUE*.** -m PETERQM -o 1line -t queue
******************************************************************************************


runmqsc PETERQM
5724-H72 (C) Copyright IBM Corp. 1994, 2011. ALL RIGHTS RESERVED.
Starting MQSC for queue manager PETERQM.


DISPLAY AUTHREC PROFILE(MY.QUEUE*.**)
1 : DISPLAY AUTHREC PROFILE(MY.QUEUE*.**)
AMQ8864: Display authority record details.
PROFILE(MY.QUEUE*.**) ENTITY(mygrp01)
ENTTYPE(GROUP) OBJTYPE(QUEUE)
AUTHLIST(BROWSE,GET,INQ,PUT)
end
2 : end
One MQSC command read.
No commands have a syntax error.
All valid MQSC commands were processed.



Peter Potkay
From: MQSeries List [mailto:MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org] On Behalf Of Jefferson Lowrey
Sent: Thursday, October 24, 2013 2:29 PM
To: MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org<mailto:MQSERIES-0lvw86wZMd9k/***@public.gmane.orgAC.AT>
Subject: Re: SET AUTHREC versus setmqaut

Try putting the *'s inside quotes to make sure the shell isn't interpreting them?


Thank you,

Jeff Lowrey



From: "Potkay, Peter M (CTO Architecture + Engineering)" <Peter.Potkay-***@public.gmane.org<mailto:Peter.Potkay-***@public.gmane.org>>
To: MQSERIES-JX7+OpRa80QeFbOYke1v4oOpTq8/***@public.gmane.org<mailto:MQSERIES-JX7+OpRa80Ties2YCUG/***@public.gmane.orgniwien.ac.at>,
Date: 10/24/2013 12:52 PM
Subject: Re: [MQSERIES] SET AUTHREC versus setmqaut
Sent by: MQSeries List <MQSERIES-JX7+OpRa80QeFbOYke1v4oOpTq8/***@public.gmane.org<mailto:MQSERIES-JX7+OpRa80QeFbOYke1v4oOpTq8/***@public.gmane.org>>
________________________________



I noticed some random things missing from my dmpmqcfg that I explicitly set in my setmqaut. I think I should have seen everything because I used this command:
"Command issued: dmpmqcfg -m PETERQM -x authrec -a -o mqsc"


So I did a little test:

setmqaut -m PETERQM -n MY.QUEUE*.** -t queue -g mygrp01 -all +get +browse +put +inq
The setmqaut command completed successfully.

dspmqaut -m PETERQM -n MY.QUEUE*.** -t queue -g mygrp01
Entity mygrp01 has the following authorizations for object MY.QUEUE*.**:
get
browse
put
inq

dmpmqaut -m PETERQM -t queue -n MY.QUEUE*.**
profile: MY.QUEUE*.**
object type: queue
entity: mygrp01
entity type: group
authority: get browse put inq


Old school methods are consistent. Now let's see what dmpmqcfg shows.



dmpmqcfg -x authrec -a -n CHANNEL.CHECKER*.** -m PETERQM -o 1line -t queue
******************************************************************************************
* Script generated on 2013-10-24 at 12.34.42
* Script generated by user 'mqm' on host 'MyServer'
* Queue manager name: PETERQM
* Queue manager platform: UNIX
* Queue manager command level: (750/750)
* Command issued: dmpmqcfg -x authrec -a -n MY.QUEUE*.** -m PETERQM -o 1line -t queue
******************************************************************************************

No other output for this command!
I drop the -t queue flag and run it again.

dmpmqcfg -x authrec -a -n MY.QUEUE*.** -m PETERQM -o 1line
******************************************************************************************
* Script generated on 2013-10-24 at 12.35.50
* Script generated by user 'mqm' on host 'MyServer'
* Queue manager name: PETERQM
* Queue manager platform: UNIX
* Queue manager command level: (750/750)
* Command issued: dmpmqcfg -x authrec -a -n MY.QUEUE*.** -m PETERQM -o 1line
******************************************************************************************
SET AUTHREC PROFILE('self') GROUP('mqm') OBJTYPE(QMGR) AUTHADD(ALTUSR,CHG,CONNECT,DLT,DSP,INQ,SET,SETALL,SETID,CTRL,SYSTEM)
SET AUTHREC PROFILE('self') GROUP('mygrp01') OBJTYPE(QMGR) AUTHADD(CONNECT,INQ)
SET AUTHREC PROFILE('@class') GROUP('mqm') OBJTYPE(QMGR) AUTHADD(CRT)
SET AUTHREC PROFILE('@class') GROUP('mygrp01') OBJTYPE(QMGR) AUTHADD(NONE)


OK, that output is confusing, they don't match the -n MY.QUEUE*.** that I used in the command, so why do they show up this output


There are no queues yet defined on this QM that begin with the name MY.QUEUE.

I'm concerned that dmpmqcfg is not picking up things I set with setmqaut and can see with dspmqaut and MO71. I don't trust this as a method to produce a replacement runmqsc script for my setmqaut script. There are multiple examples like this that did not get picked up from my main setmqaut script. Actually, I don't trust this to backup the authorities of a QM just for backup purposes - it seems I would need to fall back to my setmqaut script to be sure I have everything. :-?


Peter Potkay


From: MQSeries List [mailto:MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org] On Behalf Of Potkay, Peter M (CTO Architecture + Engineering)
Sent: Thursday, October 24, 2013 12:02 PM
To: MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org<mailto:MQSERIES-0lvw86wZMd9k/***@public.gmane.orgAC.AT>
Subject: Re: SET AUTHREC versus setmqaut

Good idea T.Rob, playing with it now.

Hmmm, while I can tell dmpmqcfg to only grab Authrority Records and spit them out in a runmqsc format, there doesn't appear to be a way to tell it to only do that for Auth Records for a particular User ID. Or at the very least, to at least exclude the records for the mqm ID.

Peter Potkay

From: MQSeries List [mailto:MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org] On Behalf Of T.Rob
Sent: Wednesday, October 23, 2013 10:38 AM
To: MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org<mailto:MQSERIES-0lvw86wZMd9k/***@public.gmane.orgAC.AT>
Subject: Re: SET AUTHREC versus setmqaut

For what it's worth the conversion is pretty easy. Run your setmqaut scripts, then run dmpmqcfg to spit out the SET AUTHREC equivalents.

Personally, it's worth the trouble to me to convert. The setmqaut commands need to be run from the command line locally and in many shops end up in different change control systems, sitting on the local filesystem, etc. I like it much better that I can define an object and then define the ACLs for that object immediately adjacent to it in the script, that it's one script, that it can be run remotely, etc.

But then I script everything so YMMV.

-- T.Rob


From: MQSeries List [mailto:MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org] On Behalf Of Potkay, Peter M (CTO Architecture + Engineering)
Sent: Wednesday, October 23, 2013 10:08 AM
To: MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org<mailto:MQSERIES-0lvw86wZMd9k/***@public.gmane.orgAC.AT>
Subject: SET AUTHREC versus setmqaut

Is there any reason to take the time and effort of rewriting my setmqaut scripts into SET AUTHREC commands?

So far the only reason I came up with is that then my standard runmqsc script I use for new QMs could also take care of the security stuff, versus having to run a second script specific to setmqaut.


Are AUTHREC just another way of doing the same thing?
Is setmqaut on the Endangered Species List, so sooner or later I'm gonna have to switch anyway?
Does AUTHREC provide or remove capability compared to setmqaut?

Google doesn't know.....
The new AUTHREC isn't addressed in the Info Center in the "Changed behavior between v6.0 and V7.5" section.


Peter Potkay




************************************************************
This communication, including attachments, is for the exclusive use of addressee and may contain proprietary, confidential and/or privileged information. If you are not the intended recipient, any use, copying, disclosure, dissemination or distribution is strictly prohibited. If you are not the intended recipient, please notify the sender immediately by return e-mail, delete this communication and destroy all copies.
************************************************************


________________________________

List Archive<http://listserv.meduniwien.ac.at/archives/mqser-l.html> - Manage Your List Settings<http://listserv.meduniwien.ac.at/cgi-bin/wa?SUBED1=mqser-l&A=1> - Unsubscribe<mailto:LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org?subject=Unsubscribe&BODY=signoff%20mqseries>

Instructions for managing your mailing list subscription are provided in the Listserv General Users Guide available at http://www.lsoft.com<http://www.lsoft.com/resources/manuals.asp>


________________________________

List Archive<http://listserv.meduniwien.ac.at/archives/mqser-l.html> - Manage Your List Settings<http://listserv.meduniwien.ac.at/cgi-bin/wa?SUBED1=mqser-l&A=1> - Unsubscribe<mailto:LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org?subject=Unsubscribe&BODY=signoff%20mqseries>

Instructions for managing your mailing list subscription are provided in the Listserv General Users Guide available at http://www.lsoft.com<http://www.lsoft.com/resources/manuals.asp>

************************************************************
This communication, including attachments, is for the exclusive use of addressee and may contain proprietary, confidential and/or privileged information. If you are not the intended recipient, any use, copying, disclosure, dissemination or distribution is strictly prohibited. If you are not the intended recipient, please notify the sender immediately by return e-mail, delete this communication and destroy all copies.
************************************************************


________________________________

List Archive<http://listserv.meduniwien.ac.at/archives/mqser-l.html> - Manage Your List Settings<http://listserv.meduniwien.ac.at/cgi-bin/wa?SUBED1=mqser-l&A=1> - Unsubscribe<mailto:LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org?subject=Unsubscribe&BODY=signoff%20mqseries>

Instructions for managing your mailing list subscription are provided in the Listserv General Users Guide available at http://www.lsoft.com<http://www.lsoft.com/resources/manuals.asp>

************************************************************
This communication, including attachments, is for the exclusive use of addressee and may contain proprietary, confidential and/or privileged information. If you are not the intended recipient, any use, copying, disclosure, dissemination or distribution is strictly prohibited. If you are not the intended recipient, please notify the sender immediately by return e-mail, delete this communication and destroy all copies.
************************************************************



________________________________
List Archive<http://listserv.meduniwien.ac.at/archives/mqser-l.html> - Manage Your List Settings<http://listserv.meduniwien.ac.at/cgi-bin/wa?SUBED1=mqser-l&A=1> - Unsubscribe<mailto:LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org?subject=Unsubscribe&BODY=signoff%20mqseries>

Instructions for managing your mailing list subscription are provided in the Listserv General Users Guide available at http://www.lsoft.com<http://www.lsoft.com/resources/manuals.asp>

________________________________
List Archive<http://listserv.meduniwien.ac.at/archives/mqser-l.html> - Manage Your List Settings<http://listserv.meduniwien.ac.at/cgi-bin/wa?SUBED1=mqser-l&A=1> - Unsubscribe<mailto:LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org?subject=Unsubscribe&BODY=signoff%20mqseries>

Instructions for managing your mailing list subscription are provided in the Listserv General Users Guide available at http://www.lsoft.com<http://www.lsoft.com/resources/manuals.asp>

************************************************************
This communication, including attachments, is for the exclusive use of addressee and may contain proprietary, confidential and/or privileged information. If you are not the intended recipient, any use, copying, disclosure, dissemination or distribution is strictly prohibited. If you are not the intended recipient, please notify the sender immediately by return e-mail, delete this communication and destroy all copies.
************************************************************

________________________________
List Archive<http://listserv.meduniwien.ac.at/archives/mqser-l.html> - Manage Your List Settings<http://listserv.meduniwien.ac.at/cgi-bin/wa?SUBED1=mqser-l&A=1> - Unsubscribe<mailto:LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org?subject=Unsubscribe&BODY=signoff%20mqseries>

Instructions for managing your mailing list subscription are provided in the Listserv General Users Guide available at http://www.lsoft.com<http://www.lsoft.com/resources/manuals.asp>

_____________________________________________________________
DTCC DISCLAIMER: This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error, please notify us immediately and delete the email and any attachments from your system. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email.
________________________________
List Archive<http://listserv.meduniwien.ac.at/archives/mqser-l.html> - Manage Your List Settings<http://listserv.meduniwien.ac.at/cgi-bin/wa?SUBED1=mqser-l&A=1> - Unsubscribe<mailto:LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org?subject=Unsubscribe&BODY=signoff%20mqseries>

Instructions for managing your mailing list subscription are provided in the Listserv General Users Guide available at http://www.lsoft.com<http://www.lsoft.com/resources/manuals.asp>

________________________________
List Archive<http://listserv.meduniwien.ac.at/archives/mqser-l.html> - Manage Your List Settings<http://listserv.meduniwien.ac.at/cgi-bin/wa?SUBED1=mqser-l&A=1> - Unsubscribe<mailto:LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org?subject=Unsubscribe&BODY=signoff%20mqseries>

Instructions for managing your mailing list subscription are provided in the Listserv General Users Guide available at http://www.lsoft.com<http://www.lsoft.com/resources/manuals.asp>

************************************************************
This communication, including attachments, is for the exclusive use of addressee and may contain proprietary, confidential and/or privileged information. If you are not the intended recipient, any use, copying, disclosure, dissemination or distribution is strictly prohibited. If you are not the intended recipient, please notify the sender immediately by return e-mail, delete this communication and destroy all copies.
************************************************************

________________________________
List Archive<http://listserv.meduniwien.ac.at/archives/mqser-l.html> - Manage Your List Settings<http://listserv.meduniwien.ac.at/cgi-bin/wa?SUBED1=mqser-l&A=1> - Unsubscribe<mailto:LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org?subject=Unsubscribe&BODY=signoff%20mqseries>

Instructions for managing your mailing list subscription are provided in the Listserv General Users Guide available at http://www.lsoft.com<http://www.lsoft.com/resources/manuals.asp>
************************************************************
This communication, including attachments, is for the exclusive use of addressee and may contain proprietary, confidential and/or privileged information. If you are not the intended recipient, any use, copying, disclosure, dissemination or distribution is strictly prohibited. If you are not the intended recipient, please notify the sender immediately by return e-mail, delete this communication and destroy all copies.
************************************************************

To unsubscribe, write to LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org and,
in the message body (not the subject), write: SIGNOFF MQSERIES
Instructions for managing your mailing list subscription are provided in
the Listserv General Users Guide available at http://www.lsoft.com
Archive: http://listserv.meduniwien.ac.at/archives/mqser-l.html
Potkay, Peter M (CTO Architecture + Engineering)
2013-10-30 16:34:51 UTC
Permalink
The PMR concluded that dmpmqcfg is working as designed and that I should open an RFE.

Here is the link to vote for the RFE to update dmpmqcfg to capture authority records for profiles for names of queues that don't exist yet.
http://www.ibm.com/developerworks/rfe/execute?use_case=viewRfe&CR_ID=41015


We'll have to run MS03 and dmpmqcfg in parallel for now. The dmpmqcfg command will capture the MQ 7.1/7.5 specific things like CHLAUTH records that MS03 does not. MS03 will insure we get all authority records.



Peter Potkay


From: MQSeries List [mailto:MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org] On Behalf Of Potkay, Peter M (CTO Architecture + Engineering)
Sent: Tuesday, October 29, 2013 8:49 PM
To: MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org
Subject: Re: SET AUTHREC versus setmqaut

This is a problem with dmpmqcfg that goes beyond generic profiles. Consider the following example for a profile I created that has no wild characters in it. The runmqsc command to display authority records shows it, yet dmpmqcfg does not.

setmqaut -m PETERQM -t q -n THIS.QUEUE.DOES.NOT.EXITS.YET -g mygrp01 +inq
The setmqaut command completed successfully.

dspmqaut -m PETERQM -t q -g mygrp01 -n THIS.QUEUE.DOES.NOT.EXITS.YET
Entity mqappgrp01 has the following authorizations for object THIS.QUEUE.DOES.NOT.EXITS.YET:
inq

runmqsc PETERQM
5724-H72 (C) Copyright IBM Corp. 1994, 2011. ALL RIGHTS RESERVED.
Starting MQSC for queue manager PETERQM.

DISPLAY AUTHREC

AMQ8864: Display authority record details.
PROFILE(THIS.QUEUE.DOES.NOT.EXITS.YET)
ENTITY(mygrp01) ENTTYPE(GROUP)
OBJTYPE(QUEUE) AUTHLIST(INQ)


dmpmqcfg -x authrec -a -m PETERQM -o 1line -t queue -n THIS.QUEUE.DOES.NOT.EXITS.YET
******************************************************************************************
* Script generated on 2013-10-29 at 20.18.26
* Script generated by user 'mqm' on host 'myServer'
* Queue manager name: PETERQM
* Queue manager platform: UNIX
* Queue manager command level: (750/750)
* Command issued: dmpmqcfg -x authrec -a -m PETERQM -o 1line -t queue -n THIS.QUEUE.DOES.NOT.EXITS.YET
******************************************************************************************
* No matching queue objects



I have a PMR open.

The dspmqaut, dmpmqaut, amqoamd and runmqsc methods of reporting on what a QM knows about these type of profiles do report them. The dmpmqcfg command does not.

Be careful if you replaced MS03 with dmpmqcfg when it comes to authority records - you may not be getting 100% of what you think you are if you have profiles defined for future queues yet to be defined.

Peter Potkay

From: MQSeries List [mailto:MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org] On Behalf Of Potkay, Peter M (CTO Architecture + Engineering)
Sent: Friday, October 25, 2013 8:48 AM
To: MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org<mailto:MQSERIES-0lvw86wZMd9k/***@public.gmane.orgAC.AT>
Subject: Re: SET AUTHREC versus setmqaut

I think you're on to something with the multiple asterisks. And, it also seems to be impacted on whether there is an object that already exists or not that matches the profile.

I do not have any queues that start with NEW.QUEUE at this point.


setmqaut -m PETERQM -t q -n NEW.QUEUE*.** -g mygrp01 +inq
The setmqaut command completed successfully.

dspmqaut -m PETERQM -t q -n NEW.QUEUE*.** -g mygrp01
Entity mygrp01 has the following authorizations for object NEW.QUEUE*.**:
inq

dmpmqaut -m PETERQM -t q -n NEW.QUEUE*.**
profile: NEW.QUEUE*.**
object type: queue
entity: mygrp01
entity type: group
authority: inq



No problems for dspmqaut or dmpmqaut to recognize this new profile. Now let's try dmpmqcfg



dmpmqcfg -x authrec -a -n "NEW.QUEUE*.**" -m PETERQM -o 1line -t queue
******************************************************************************************
* Script generated on 2013-10-25 at 08.34.28
* Script generated by user 'mqm' on host 'myServer'
* Queue manager name: PETERQM
* Queue manager platform: UNIX
* Queue manager command level: (750/750)
* Command issued: dmpmqcfg -x authrec -a -n NEW.QUEUE*.** -m PETERQM -o 1line -t queue
******************************************************************************************

Again with only 1 asterisk:

dmpmqcfg -x authrec -a -n "NEW.QUEUE*" -m PETERQM -o 1line -t queue
******************************************************************************************
* Script generated on 2013-10-25 at 08.34.45
* Script generated by user 'mqm' on host 'myServer'
* Queue manager name: PETERQM
* Queue manager platform: UNIX
* Queue manager command level: (750/750)
* Command issued: dmpmqcfg -x authrec -a -n NEW.QUEUE* -m PETERQM -o 1line -t queue
******************************************************************************************
* No matching queue objects



Notice that while both attempts with dmpmqcfg fail to get a hit, the second command where I use only one asterisk produces one extra line of output.


Now I'll create one queue that matches this profile name.



runmqsc PETERQM
5724-H72 (C) Copyright IBM Corp. 1994, 2011. ALL RIGHTS RESERVED.
Starting MQSC for queue manager PETERQM.


DEF QL (NEW.QUEUE.ONE)
1 : DEF QL (NEW.QUEUE.ONE)
AMQ8006: WebSphere MQ queue created.
end
2 : end
One MQSC command read.
No commands have a syntax error.
All valid MQSC commands were processed.


dmpmqcfg -x authrec -a -n "NEW.QUEUE*.**" -m PETERQM -o 1line -t queue
******************************************************************************************
* Script generated on 2013-10-25 at 08.37.21
* Script generated by user 'mqm' on host 'myServer'
* Queue manager name: PETERQM
* Queue manager platform: UNIX
* Queue manager command level: (750/750)
* Command issued: dmpmqcfg -x authrec -a -n NEW.QUEUE*.** -m PETERQM -o 1line -t queue
******************************************************************************************

With multiple asterisks still no joy.



dmpmqcfg -x authrec -a -n "NEW.QUEUE*" -m PETERQM -o 1line -t queue
******************************************************************************************
* Script generated on 2013-10-25 at 08.37.25
* Script generated by user 'mqm' on host 'myServer'
* Queue manager name: PETERQM
* Queue manager platform: UNIX
* Queue manager command level: (750/750)
* Command issued: dmpmqcfg -x authrec -a -n NEW.QUEUE* -m PETERQM -o 1line -t queue
******************************************************************************************
SET AUTHREC PROFILE('NEW.QUEUE.ONE') GROUP('mqm') OBJTYPE(QUEUE) AUTHADD(BROWSE,CHG,CLR,DLT,DSP,GET,INQ,PUT,PASSALL,PASSID,SET,SETALL,SETID)
SET AUTHREC PROFILE('NEW.QUEUE*.**') GROUP('mygrp01') OBJTYPE(QUEUE) AUTHADD(INQ)


Hello!



I'll copy and paste this email into a PMR now.
And rely on dmpmqaut or dspmqaut in the meantime to get an accurate list of authority records for a Queue Manager.






Peter Potkay

From: MQSeries List [mailto:MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org] On Behalf Of Tim Zielke
Sent: Friday, October 25, 2013 8:19 AM
To: MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org<mailto:MQSERIES-0lvw86wZMd9k/***@public.gmane.orgAC.AT>
Subject: Re: SET AUTHREC versus setmqaut

Hi Grant,

I could be misinterpreting, but I think the part "the object/profile name may contain a single asterisk" is saying that "-n *" is valid. That is how I also interpret the "-n [* | ObjectName]". You can have either "-n *" or "-n ObjectName". And then there is also the restriction that if you use an asterisk on the ObjectName, it must come at the end. Regardless, the text is somewhat ambiguous.

I did try the following:

dmpmqcfg -x authrec -a -n SYSTEM.* -m xxxxxxxx -o 1line -t queue

and that returned results.

However, the following:

dmpmqcfg -x authrec -a -n SYSTEM.** -m xxxxxxxx -o 1line -t queue

did not.

There does seem to be something wrong with the -n filtering of the dmpmqcfg command, when you end with multiple asterisks.

Thanks,
Tim

From: MQSeries List [mailto:MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org] On Behalf Of Ward Able, Grant
Sent: Friday, October 25, 2013 4:33 AM
To: MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org<mailto:MQSERIES-0lvw86wZMd9k/***@public.gmane.orgAC.AT>
Subject: Re: SET AUTHREC versus setmqaut

Peter,
I was just trawling through the InfoCentre (oh how I miss the PDFs!!!) and I saw that you may only have a single "*" and that can only be at the end. Perhaps your uses of *.** is confusing the poor utility?

-n [ * | ObjectName ]
Filter the definitions produced by object or profile name, the object/profile name may contain a single asterisk. The * option can be placed only at the end of the entered filter string.



Regards - Grant.
Telephone Internal: 201496 (London)
Telephone External: +44 (0)207 650 1496

From: MQSeries List [mailto:MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org] On Behalf Of Potkay, Peter M (CTO Architecture + Engineering)
Sent: 24 October 2013 20:11
To: MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org<mailto:MQSERIES-0lvw86wZMd9k/***@public.gmane.orgAC.AT>
Subject: Re: SET AUTHREC versus setmqaut

Single or double quotes didn't make a diff. But check it out, DISPLAY AUTHREC in a runmqsc session does see it like dspmqaut and dmpmqaut does.

Seems like dmpmqcfg is the only thing that can't see this profile.



dmpmqcfg -x authrec -a -n MY.QUEUE*.** -m PETERQM -o 1line -t queue
******************************************************************************************
* Script generated on 2013-10-24 at 14.48.04
* Script generated by user 'mqm' on host 'myServer'
* Queue manager name: PETERQM
* Queue manager platform: UNIX
* Queue manager command level: (750/750)
* Command issued: dmpmqcfg -x authrec -a -n MY.QUEUE*.** -m PETERQM -o 1line -t queue
******************************************************************************************


dmpmqcfg -x authrec -a -n 'MY.QUEUE*.**' -m PETERQM -o 1line -t queue
******************************************************************************************
* Script generated on 2013-10-24 at 14.48.17
* Script generated by user 'mqm' on host 'myServer'
* Queue manager name: PETERQM
* Queue manager platform: UNIX
* Queue manager command level: (750/750)
* Command issued: dmpmqcfg -x authrec -a -n MY.QUEUE*.** -m PETERQM -o 1line -t queue
******************************************************************************************


dmpmqcfg -x authrec -a -n "MY.QUEUE*.**" -m PETERQM -o 1line -t queue
******************************************************************************************
* Script generated on 2013-10-24 at 14.49.04
* Script generated by user 'mqm' on host 'myServer'
* Queue manager name: PETERQM
* Queue manager platform: UNIX
* Queue manager command level: (750/750)
* Command issued: dmpmqcfg -x authrec -a -n MY.QUEUE*.** -m PETERQM -o 1line -t queue
******************************************************************************************


runmqsc PETERQM
5724-H72 (C) Copyright IBM Corp. 1994, 2011. ALL RIGHTS RESERVED.
Starting MQSC for queue manager PETERQM.


DISPLAY AUTHREC PROFILE(MY.QUEUE*.**)
1 : DISPLAY AUTHREC PROFILE(MY.QUEUE*.**)
AMQ8864: Display authority record details.
PROFILE(MY.QUEUE*.**) ENTITY(mygrp01)
ENTTYPE(GROUP) OBJTYPE(QUEUE)
AUTHLIST(BROWSE,GET,INQ,PUT)
end
2 : end
One MQSC command read.
No commands have a syntax error.
All valid MQSC commands were processed.



Peter Potkay
From: MQSeries List [mailto:MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org] On Behalf Of Jefferson Lowrey
Sent: Thursday, October 24, 2013 2:29 PM
To: MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org<mailto:MQSERIES-0lvw86wZMd9k/***@public.gmane.orgAC.AT>
Subject: Re: SET AUTHREC versus setmqaut

Try putting the *'s inside quotes to make sure the shell isn't interpreting them?


Thank you,

Jeff Lowrey



From: "Potkay, Peter M (CTO Architecture + Engineering)" <Peter.Potkay-***@public.gmane.org<mailto:Peter.Potkay-***@public.gmane.org>>
To: MQSERIES-JX7+OpRa80QeFbOYke1v4oOpTq8/***@public.gmane.org<mailto:MQSERIES-JX7+OpRa80Ties2YCUG/***@public.gmane.orgniwien.ac.at>,
Date: 10/24/2013 12:52 PM
Subject: Re: [MQSERIES] SET AUTHREC versus setmqaut
Sent by: MQSeries List <MQSERIES-JX7+OpRa80QeFbOYke1v4oOpTq8/***@public.gmane.org<mailto:MQSERIES-JX7+OpRa80QeFbOYke1v4oOpTq8/***@public.gmane.org>>
________________________________



I noticed some random things missing from my dmpmqcfg that I explicitly set in my setmqaut. I think I should have seen everything because I used this command:
"Command issued: dmpmqcfg -m PETERQM -x authrec -a -o mqsc"


So I did a little test:

setmqaut -m PETERQM -n MY.QUEUE*.** -t queue -g mygrp01 -all +get +browse +put +inq
The setmqaut command completed successfully.

dspmqaut -m PETERQM -n MY.QUEUE*.** -t queue -g mygrp01
Entity mygrp01 has the following authorizations for object MY.QUEUE*.**:
get
browse
put
inq

dmpmqaut -m PETERQM -t queue -n MY.QUEUE*.**
profile: MY.QUEUE*.**
object type: queue
entity: mygrp01
entity type: group
authority: get browse put inq


Old school methods are consistent. Now let's see what dmpmqcfg shows.



dmpmqcfg -x authrec -a -n CHANNEL.CHECKER*.** -m PETERQM -o 1line -t queue
******************************************************************************************
* Script generated on 2013-10-24 at 12.34.42
* Script generated by user 'mqm' on host 'MyServer'
* Queue manager name: PETERQM
* Queue manager platform: UNIX
* Queue manager command level: (750/750)
* Command issued: dmpmqcfg -x authrec -a -n MY.QUEUE*.** -m PETERQM -o 1line -t queue
******************************************************************************************

No other output for this command!
I drop the -t queue flag and run it again.

dmpmqcfg -x authrec -a -n MY.QUEUE*.** -m PETERQM -o 1line
******************************************************************************************
* Script generated on 2013-10-24 at 12.35.50
* Script generated by user 'mqm' on host 'MyServer'
* Queue manager name: PETERQM
* Queue manager platform: UNIX
* Queue manager command level: (750/750)
* Command issued: dmpmqcfg -x authrec -a -n MY.QUEUE*.** -m PETERQM -o 1line
******************************************************************************************
SET AUTHREC PROFILE('self') GROUP('mqm') OBJTYPE(QMGR) AUTHADD(ALTUSR,CHG,CONNECT,DLT,DSP,INQ,SET,SETALL,SETID,CTRL,SYSTEM)
SET AUTHREC PROFILE('self') GROUP('mygrp01') OBJTYPE(QMGR) AUTHADD(CONNECT,INQ)
SET AUTHREC PROFILE('@class') GROUP('mqm') OBJTYPE(QMGR) AUTHADD(CRT)
SET AUTHREC PROFILE('@class') GROUP('mygrp01') OBJTYPE(QMGR) AUTHADD(NONE)


OK, that output is confusing, they don't match the -n MY.QUEUE*.** that I used in the command, so why do they show up this output


There are no queues yet defined on this QM that begin with the name MY.QUEUE.

I'm concerned that dmpmqcfg is not picking up things I set with setmqaut and can see with dspmqaut and MO71. I don't trust this as a method to produce a replacement runmqsc script for my setmqaut script. There are multiple examples like this that did not get picked up from my main setmqaut script. Actually, I don't trust this to backup the authorities of a QM just for backup purposes - it seems I would need to fall back to my setmqaut script to be sure I have everything. :-?


Peter Potkay


From: MQSeries List [mailto:MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org] On Behalf Of Potkay, Peter M (CTO Architecture + Engineering)
Sent: Thursday, October 24, 2013 12:02 PM
To: MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org<mailto:MQSERIES-0lvw86wZMd9k/***@public.gmane.orgAC.AT>
Subject: Re: SET AUTHREC versus setmqaut

Good idea T.Rob, playing with it now.

Hmmm, while I can tell dmpmqcfg to only grab Authrority Records and spit them out in a runmqsc format, there doesn't appear to be a way to tell it to only do that for Auth Records for a particular User ID. Or at the very least, to at least exclude the records for the mqm ID.

Peter Potkay

From: MQSeries List [mailto:MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org] On Behalf Of T.Rob
Sent: Wednesday, October 23, 2013 10:38 AM
To: MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org<mailto:MQSERIES-0lvw86wZMd9k/***@public.gmane.orgAC.AT>
Subject: Re: SET AUTHREC versus setmqaut

For what it's worth the conversion is pretty easy. Run your setmqaut scripts, then run dmpmqcfg to spit out the SET AUTHREC equivalents.

Personally, it's worth the trouble to me to convert. The setmqaut commands need to be run from the command line locally and in many shops end up in different change control systems, sitting on the local filesystem, etc. I like it much better that I can define an object and then define the ACLs for that object immediately adjacent to it in the script, that it's one script, that it can be run remotely, etc.

But then I script everything so YMMV.

-- T.Rob


From: MQSeries List [mailto:MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org] On Behalf Of Potkay, Peter M (CTO Architecture + Engineering)
Sent: Wednesday, October 23, 2013 10:08 AM
To: MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org<mailto:MQSERIES-0lvw86wZMd9k/***@public.gmane.orgAC.AT>
Subject: SET AUTHREC versus setmqaut

Is there any reason to take the time and effort of rewriting my setmqaut scripts into SET AUTHREC commands?

So far the only reason I came up with is that then my standard runmqsc script I use for new QMs could also take care of the security stuff, versus having to run a second script specific to setmqaut.


Are AUTHREC just another way of doing the same thing?
Is setmqaut on the Endangered Species List, so sooner or later I'm gonna have to switch anyway?
Does AUTHREC provide or remove capability compared to setmqaut?

Google doesn't know.....
The new AUTHREC isn't addressed in the Info Center in the "Changed behavior between v6.0 and V7.5" section.


Peter Potkay




************************************************************
This communication, including attachments, is for the exclusive use of addressee and may contain proprietary, confidential and/or privileged information. If you are not the intended recipient, any use, copying, disclosure, dissemination or distribution is strictly prohibited. If you are not the intended recipient, please notify the sender immediately by return e-mail, delete this communication and destroy all copies.
************************************************************


________________________________

List Archive<http://listserv.meduniwien.ac.at/archives/mqser-l.html> - Manage Your List Settings<http://listserv.meduniwien.ac.at/cgi-bin/wa?SUBED1=mqser-l&A=1> - Unsubscribe<mailto:LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org?subject=Unsubscribe&BODY=signoff%20mqseries>

Instructions for managing your mailing list subscription are provided in the Listserv General Users Guide available at http://www.lsoft.com<http://www.lsoft.com/resources/manuals.asp>


________________________________

List Archive<http://listserv.meduniwien.ac.at/archives/mqser-l.html> - Manage Your List Settings<http://listserv.meduniwien.ac.at/cgi-bin/wa?SUBED1=mqser-l&A=1> - Unsubscribe<mailto:LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org?subject=Unsubscribe&BODY=signoff%20mqseries>

Instructions for managing your mailing list subscription are provided in the Listserv General Users Guide available at http://www.lsoft.com<http://www.lsoft.com/resources/manuals.asp>

************************************************************
This communication, including attachments, is for the exclusive use of addressee and may contain proprietary, confidential and/or privileged information. If you are not the intended recipient, any use, copying, disclosure, dissemination or distribution is strictly prohibited. If you are not the intended recipient, please notify the sender immediately by return e-mail, delete this communication and destroy all copies.
************************************************************


________________________________

List Archive<http://listserv.meduniwien.ac.at/archives/mqser-l.html> - Manage Your List Settings<http://listserv.meduniwien.ac.at/cgi-bin/wa?SUBED1=mqser-l&A=1> - Unsubscribe<mailto:LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org?subject=Unsubscribe&BODY=signoff%20mqseries>

Instructions for managing your mailing list subscription are provided in the Listserv General Users Guide available at http://www.lsoft.com<http://www.lsoft.com/resources/manuals.asp>

************************************************************
This communication, including attachments, is for the exclusive use of addressee and may contain proprietary, confidential and/or privileged information. If you are not the intended recipient, any use, copying, disclosure, dissemination or distribution is strictly prohibited. If you are not the intended recipient, please notify the sender immediately by return e-mail, delete this communication and destroy all copies.
************************************************************



________________________________
List Archive<http://listserv.meduniwien.ac.at/archives/mqser-l.html> - Manage Your List Settings<http://listserv.meduniwien.ac.at/cgi-bin/wa?SUBED1=mqser-l&A=1> - Unsubscribe<mailto:LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org?subject=Unsubscribe&BODY=signoff%20mqseries>

Instructions for managing your mailing list subscription are provided in the Listserv General Users Guide available at http://www.lsoft.com<http://www.lsoft.com/resources/manuals.asp>

________________________________
List Archive<http://listserv.meduniwien.ac.at/archives/mqser-l.html> - Manage Your List Settings<http://listserv.meduniwien.ac.at/cgi-bin/wa?SUBED1=mqser-l&A=1> - Unsubscribe<mailto:LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org?subject=Unsubscribe&BODY=signoff%20mqseries>

Instructions for managing your mailing list subscription are provided in the Listserv General Users Guide available at http://www.lsoft.com<http://www.lsoft.com/resources/manuals.asp>

************************************************************
This communication, including attachments, is for the exclusive use of addressee and may contain proprietary, confidential and/or privileged information. If you are not the intended recipient, any use, copying, disclosure, dissemination or distribution is strictly prohibited. If you are not the intended recipient, please notify the sender immediately by return e-mail, delete this communication and destroy all copies.
************************************************************

________________________________
List Archive<http://listserv.meduniwien.ac.at/archives/mqser-l.html> - Manage Your List Settings<http://listserv.meduniwien.ac.at/cgi-bin/wa?SUBED1=mqser-l&A=1> - Unsubscribe<mailto:LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org?subject=Unsubscribe&BODY=signoff%20mqseries>

Instructions for managing your mailing list subscription are provided in the Listserv General Users Guide available at http://www.lsoft.com<http://www.lsoft.com/resources/manuals.asp>

_____________________________________________________________
DTCC DISCLAIMER: This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error, please notify us immediately and delete the email and any attachments from your system. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email.
________________________________
List Archive<http://listserv.meduniwien.ac.at/archives/mqser-l.html> - Manage Your List Settings<http://listserv.meduniwien.ac.at/cgi-bin/wa?SUBED1=mqser-l&A=1> - Unsubscribe<mailto:LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org?subject=Unsubscribe&BODY=signoff%20mqseries>

Instructions for managing your mailing list subscription are provided in the Listserv General Users Guide available at http://www.lsoft.com<http://www.lsoft.com/resources/manuals.asp>

________________________________
List Archive<http://listserv.meduniwien.ac.at/archives/mqser-l.html> - Manage Your List Settings<http://listserv.meduniwien.ac.at/cgi-bin/wa?SUBED1=mqser-l&A=1> - Unsubscribe<mailto:LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org?subject=Unsubscribe&BODY=signoff%20mqseries>

Instructions for managing your mailing list subscription are provided in the Listserv General Users Guide available at http://www.lsoft.com<http://www.lsoft.com/resources/manuals.asp>

************************************************************
This communication, including attachments, is for the exclusive use of addressee and may contain proprietary, confidential and/or privileged information. If you are not the intended recipient, any use, copying, disclosure, dissemination or distribution is strictly prohibited. If you are not the intended recipient, please notify the sender immediately by return e-mail, delete this communication and destroy all copies.
************************************************************

________________________________
List Archive<http://listserv.meduniwien.ac.at/archives/mqser-l.html> - Manage Your List Settings<http://listserv.meduniwien.ac.at/cgi-bin/wa?SUBED1=mqser-l&A=1> - Unsubscribe<mailto:LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org?subject=Unsubscribe&BODY=signoff%20mqseries>

Instructions for managing your mailing list subscription are provided in the Listserv General Users Guide available at http://www.lsoft.com<http://www.lsoft.com/resources/manuals.asp>

************************************************************
This communication, including attachments, is for the exclusive use of addressee and may contain proprietary, confidential and/or privileged information. If you are not the intended recipient, any use, copying, disclosure, dissemination or distribution is strictly prohibited. If you are not the intended recipient, please notify the sender immediately by return e-mail, delete this communication and destroy all copies.
************************************************************

________________________________
List Archive<http://listserv.meduniwien.ac.at/archives/mqser-l.html> - Manage Your List Settings<http://listserv.meduniwien.ac.at/cgi-bin/wa?SUBED1=mqser-l&A=1> - Unsubscribe<mailto:LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org?subject=Unsubscribe&BODY=signoff%20mqseries>

Instructions for managing your mailing list subscription are provided in the Listserv General Users Guide available at http://www.lsoft.com<http://www.lsoft.com/resources/manuals.asp>
************************************************************
This communication, including attachments, is for the exclusive use of addressee and may contain proprietary, confidential and/or privileged information. If you are not the intended recipient, any use, copying, disclosure, dissemination or distribution is strictly prohibited. If you are not the intended recipient, please notify the sender immediately by return e-mail, delete this communication and destroy all copies.
************************************************************

To unsubscribe, write to LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org and,
in the message body (not the subject), write: SIGNOFF MQSERIES
Instructions for managing your mailing list subscription are provided in
the Listserv General Users Guide available at http://www.lsoft.com
Archive: http://listserv.meduniwien.ac.at/archives/mqser-l.html
T.Rob
2013-10-30 17:32:14 UTC
Permalink
Was there a commitment to update the docs to make the actual behavior clear?



Thanks for running this down, Peter. I'll be sure to mention it at the two
upcoming events where I'm presenting - a Prolifics webinar Nov 20 and the
NY/NJ MQ User Group in December. Probably worth a blog post or two. Sigh.



-- T.Rob





From: MQSeries List [mailto:MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org] On Behalf Of
Potkay, Peter M (CTO Architecture + Engineering)
Sent: Wednesday, October 30, 2013 12:35 PM
To: MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org
Subject: Re: SET AUTHREC versus setmqaut



The PMR concluded that dmpmqcfg is working as designed and that I should
open an RFE.



Here is the link to vote for the RFE to update dmpmqcfg to capture authority
records for profiles for names of queues that don't exist yet.


<http://www.ibm.com/developerworks/rfe/execute?use_case=viewRfe&CR_ID=41015>
http://www.ibm.com/developerworks/rfe/execute?use_case=viewRfe&CR_ID=41015





We'll have to run MS03 and dmpmqcfg in parallel for now. The dmpmqcfg
command will capture the MQ 7.1/7.5 specific things like CHLAUTH records
that MS03 does not. MS03 will insure we get all authority records.







Peter Potkay



From: MQSeries List [mailto:MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org] On Behalf Of
Potkay, Peter M (CTO Architecture + Engineering)
Sent: Tuesday, October 29, 2013 8:49 PM
To: MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org
Subject: Re: SET AUTHREC versus setmqaut



This is a problem with dmpmqcfg that goes beyond generic profiles. Consider
the following example for a profile I created that has no wild characters in
it. The runmqsc command to display authority records shows it, yet dmpmqcfg
does not.



setmqaut -m PETERQM -t q -n THIS.QUEUE.DOES.NOT.EXITS.YET -g mygrp01 +inq

The setmqaut command completed successfully.



dspmqaut -m PETERQM -t q -g mygrp01 -n THIS.QUEUE.DOES.NOT.EXITS.YET

Entity mqappgrp01 has the following authorizations for object
THIS.QUEUE.DOES.NOT.EXITS.YET:

inq



runmqsc PETERQM

5724-H72 (C) Copyright IBM Corp. 1994, 2011. ALL RIGHTS RESERVED.

Starting MQSC for queue manager PETERQM.



DISPLAY AUTHREC



AMQ8864: Display authority record details.

PROFILE(THIS.QUEUE.DOES.NOT.EXITS.YET)

ENTITY(mygrp01) ENTTYPE(GROUP)

OBJTYPE(QUEUE) AUTHLIST(INQ)





dmpmqcfg -x authrec -a -m PETERQM -o 1line -t queue -n
THIS.QUEUE.DOES.NOT.EXITS.YET

****************************************************************************
**************

* Script generated on 2013-10-29 at 20.18.26

* Script generated by user 'mqm' on host 'myServer'

* Queue manager name: PETERQM

* Queue manager platform: UNIX

* Queue manager command level: (750/750)

* Command issued: dmpmqcfg -x authrec -a -m PETERQM -o 1line -t queue -n
THIS.QUEUE.DOES.NOT.EXITS.YET

****************************************************************************
**************

* No matching queue objects







I have a PMR open.



The dspmqaut, dmpmqaut, amqoamd and runmqsc methods of reporting on what a
QM knows about these type of profiles do report them. The dmpmqcfg command
does not.



Be careful if you replaced MS03 with dmpmqcfg when it comes to authority
records - you may not be getting 100% of what you think you are if you have
profiles defined for future queues yet to be defined.



Peter Potkay



From: MQSeries List [mailto:MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org] On Behalf Of
Potkay, Peter M (CTO Architecture + Engineering)
Sent: Friday, October 25, 2013 8:48 AM
To: MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org
Subject: Re: SET AUTHREC versus setmqaut



I think you're on to something with the multiple asterisks. And, it also
seems to be impacted on whether there is an object that already exists or
not that matches the profile.



I do not have any queues that start with NEW.QUEUE at this point.





setmqaut -m PETERQM -t q -n NEW.QUEUE*.** -g mygrp01 +inq

The setmqaut command completed successfully.



dspmqaut -m PETERQM -t q -n NEW.QUEUE*.** -g mygrp01

Entity mygrp01 has the following authorizations for object NEW.QUEUE*.**:

inq



dmpmqaut -m PETERQM -t q -n NEW.QUEUE*.**

profile: NEW.QUEUE*.**

object type: queue

entity: mygrp01

entity type: group

authority: inq







No problems for dspmqaut or dmpmqaut to recognize this new profile. Now
let's try dmpmqcfg







dmpmqcfg -x authrec -a -n "NEW.QUEUE*.**" -m PETERQM -o 1line -t queue

****************************************************************************
**************

* Script generated on 2013-10-25 at 08.34.28

* Script generated by user 'mqm' on host 'myServer'

* Queue manager name: PETERQM

* Queue manager platform: UNIX

* Queue manager command level: (750/750)

* Command issued: dmpmqcfg -x authrec -a -n NEW.QUEUE*.** -m PETERQM -o
1line -t queue

****************************************************************************
**************



Again with only 1 asterisk:



dmpmqcfg -x authrec -a -n "NEW.QUEUE*" -m PETERQM -o 1line -t queue

****************************************************************************
**************

* Script generated on 2013-10-25 at 08.34.45

* Script generated by user 'mqm' on host 'myServer'

* Queue manager name: PETERQM

* Queue manager platform: UNIX

* Queue manager command level: (750/750)

* Command issued: dmpmqcfg -x authrec -a -n NEW.QUEUE* -m PETERQM -o 1line
-t queue

****************************************************************************
**************

* No matching queue objects







Notice that while both attempts with dmpmqcfg fail to get a hit, the second
command where I use only one asterisk produces one extra line of output.





Now I'll create one queue that matches this profile name.







runmqsc PETERQM

5724-H72 (C) Copyright IBM Corp. 1994, 2011. ALL RIGHTS RESERVED.

Starting MQSC for queue manager PETERQM.





DEF QL (NEW.QUEUE.ONE)

1 : DEF QL (NEW.QUEUE.ONE)

AMQ8006: WebSphere MQ queue created.

end

2 : end

One MQSC command read.

No commands have a syntax error.

All valid MQSC commands were processed.





dmpmqcfg -x authrec -a -n "NEW.QUEUE*.**" -m PETERQM -o 1line -t queue

****************************************************************************
**************

* Script generated on 2013-10-25 at 08.37.21

* Script generated by user 'mqm' on host 'myServer'

* Queue manager name: PETERQM

* Queue manager platform: UNIX

* Queue manager command level: (750/750)

* Command issued: dmpmqcfg -x authrec -a -n NEW.QUEUE*.** -m PETERQM -o
1line -t queue

****************************************************************************
**************



With multiple asterisks still no joy.







dmpmqcfg -x authrec -a -n "NEW.QUEUE*" -m PETERQM -o 1line -t queue

****************************************************************************
**************

* Script generated on 2013-10-25 at 08.37.25

* Script generated by user 'mqm' on host 'myServer'

* Queue manager name: PETERQM

* Queue manager platform: UNIX

* Queue manager command level: (750/750)

* Command issued: dmpmqcfg -x authrec -a -n NEW.QUEUE* -m PETERQM -o 1line
-t queue

****************************************************************************
**************

SET AUTHREC PROFILE('NEW.QUEUE.ONE') GROUP('mqm') OBJTYPE(QUEUE)
AUTHADD(BROWSE,CHG,CLR,DLT,DSP,GET,INQ,PUT,PASSALL,PASSID,SET,SETALL,SETID)

SET AUTHREC PROFILE('NEW.QUEUE*.**') GROUP('mygrp01') OBJTYPE(QUEUE)
AUTHADD(INQ)





Hello!







I'll copy and paste this email into a PMR now.

And rely on dmpmqaut or dspmqaut in the meantime to get an accurate list of
authority records for a Queue Manager.













Peter Potkay



From: MQSeries List [mailto:MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org] On Behalf Of
Tim Zielke
Sent: Friday, October 25, 2013 8:19 AM
To: MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org
Subject: Re: SET AUTHREC versus setmqaut



Hi Grant,



I could be misinterpreting, but I think the part "the object/profile name
may contain a single asterisk" is saying that "-n *" is valid. That is how
I also interpret the "-n [* | ObjectName]". You can have either "-n *" or
"-n ObjectName". And then there is also the restriction that if you use an
asterisk on the ObjectName, it must come at the end. Regardless, the text
is somewhat ambiguous.



I did try the following:



dmpmqcfg -x authrec -a -n SYSTEM.* -m xxxxxxxx -o 1line -t queue



and that returned results.



However, the following:



dmpmqcfg -x authrec -a -n SYSTEM.** -m xxxxxxxx -o 1line -t queue



did not.



There does seem to be something wrong with the -n filtering of the dmpmqcfg
command, when you end with multiple asterisks.



Thanks,

Tim



From: MQSeries List [mailto:MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org] On Behalf Of
Ward Able, Grant
Sent: Friday, October 25, 2013 4:33 AM
To: MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org
Subject: Re: SET AUTHREC versus setmqaut



Peter,

I was just trawling through the InfoCentre (oh how I miss the PDFs!!!) and I
saw that you may only have a single "*" and that can only be at the end.
Perhaps your uses of *.** is confusing the poor utility?



-n [ * | ObjectName ]

Filter the definitions produced by object or profile name, the
object/profile name may contain a single asterisk. The * option can be
placed only at the end of the entered filter string.







Regards - Grant.

Telephone Internal: 201496 (London)

Telephone External: +44 (0)207 650 1496



From: MQSeries List [mailto:MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org] On Behalf Of
Potkay, Peter M (CTO Architecture + Engineering)
Sent: 24 October 2013 20:11
To: MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org
Subject: Re: SET AUTHREC versus setmqaut



Single or double quotes didn't make a diff. But check it out, DISPLAY
AUTHREC in a runmqsc session does see it like dspmqaut and dmpmqaut does.



Seems like dmpmqcfg is the only thing that can't see this profile.







dmpmqcfg -x authrec -a -n MY.QUEUE*.** -m PETERQM -o 1line -t queue

****************************************************************************
**************

* Script generated on 2013-10-24 at 14.48.04

* Script generated by user 'mqm' on host 'myServer'

* Queue manager name: PETERQM

* Queue manager platform: UNIX

* Queue manager command level: (750/750)

* Command issued: dmpmqcfg -x authrec -a -n MY.QUEUE*.** -m PETERQM -o 1line
-t queue

****************************************************************************
**************





dmpmqcfg -x authrec -a -n 'MY.QUEUE*.**' -m PETERQM -o 1line -t queue

****************************************************************************
**************

* Script generated on 2013-10-24 at 14.48.17

* Script generated by user 'mqm' on host 'myServer'

* Queue manager name: PETERQM

* Queue manager platform: UNIX

* Queue manager command level: (750/750)

* Command issued: dmpmqcfg -x authrec -a -n MY.QUEUE*.** -m PETERQM -o 1line
-t queue

****************************************************************************
**************





dmpmqcfg -x authrec -a -n "MY.QUEUE*.**" -m PETERQM -o 1line -t queue

****************************************************************************
**************

* Script generated on 2013-10-24 at 14.49.04

* Script generated by user 'mqm' on host 'myServer'

* Queue manager name: PETERQM

* Queue manager platform: UNIX

* Queue manager command level: (750/750)

* Command issued: dmpmqcfg -x authrec -a -n MY.QUEUE*.** -m PETERQM -o 1line
-t queue

****************************************************************************
**************





runmqsc PETERQM

5724-H72 (C) Copyright IBM Corp. 1994, 2011. ALL RIGHTS RESERVED.

Starting MQSC for queue manager PETERQM.





DISPLAY AUTHREC PROFILE(MY.QUEUE*.**)

1 : DISPLAY AUTHREC PROFILE(MY.QUEUE*.**)

AMQ8864: Display authority record details.

PROFILE(MY.QUEUE*.**) ENTITY(mygrp01)

ENTTYPE(GROUP) OBJTYPE(QUEUE)

AUTHLIST(BROWSE,GET,INQ,PUT)

end

2 : end

One MQSC command read.

No commands have a syntax error.

All valid MQSC commands were processed.







Peter Potkay

From: MQSeries List [mailto:MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org] On Behalf Of
Jefferson Lowrey
Sent: Thursday, October 24, 2013 2:29 PM
To: MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org
Subject: Re: SET AUTHREC versus setmqaut



Try putting the *'s inside quotes to make sure the shell isn't interpreting
them?


Thank you,

Jeff Lowrey



From: "Potkay, Peter M (CTO Architecture + Engineering)"
<Peter.Potkay-***@public.gmane.org>
To: MQSERIES-JX7+OpRa80QeFbOYke1v4oOpTq8/***@public.gmane.org,
Date: 10/24/2013 12:52 PM
Subject: Re: [MQSERIES] SET AUTHREC versus setmqaut
Sent by: MQSeries List <MQSERIES-JX7+OpRa80QeFbOYke1v4oOpTq8/***@public.gmane.org>

_____




I noticed some random things missing from my dmpmqcfg that I explicitly set
in my setmqaut. I think I should have seen everything because I used this
command:
"Command issued: dmpmqcfg -m PETERQM -x authrec -a -o mqsc"


So I did a little test:

setmqaut -m PETERQM -n MY.QUEUE*.** -t queue -g mygrp01 -all +get +browse
+put +inq
The setmqaut command completed successfully.

dspmqaut -m PETERQM -n MY.QUEUE*.** -t queue -g mygrp01
Entity mygrp01 has the following authorizations for object MY.QUEUE*.**:
get
browse
put
inq

dmpmqaut -m PETERQM -t queue -n MY.QUEUE*.**
profile: MY.QUEUE*.**
object type: queue
entity: mygrp01
entity type: group
authority: get browse put inq


Old school methods are consistent. Now let's see what dmpmqcfg shows.



dmpmqcfg -x authrec -a -n CHANNEL.CHECKER*.** -m PETERQM -o 1line -t queue
****************************************************************************
**************
* Script generated on 2013-10-24 at 12.34.42
* Script generated by user 'mqm' on host 'MyServer'
* Queue manager name: PETERQM
* Queue manager platform: UNIX
* Queue manager command level: (750/750)
* Command issued: dmpmqcfg -x authrec -a -n MY.QUEUE*.** -m PETERQM -o 1line
-t queue
****************************************************************************
**************

No other output for this command!
I drop the -t queue flag and run it again.

dmpmqcfg -x authrec -a -n MY.QUEUE*.** -m PETERQM -o 1line
****************************************************************************
**************
* Script generated on 2013-10-24 at 12.35.50
* Script generated by user 'mqm' on host 'MyServer'
* Queue manager name: PETERQM
* Queue manager platform: UNIX
* Queue manager command level: (750/750)
* Command issued: dmpmqcfg -x authrec -a -n MY.QUEUE*.** -m PETERQM -o 1line

****************************************************************************
**************
SET AUTHREC PROFILE('self') GROUP('mqm') OBJTYPE(QMGR)
AUTHADD(ALTUSR,CHG,CONNECT,DLT,DSP,INQ,SET,SETALL,SETID,CTRL,SYSTEM)
SET AUTHREC PROFILE('self') GROUP('mygrp01') OBJTYPE(QMGR)
AUTHADD(CONNECT,INQ)
SET AUTHREC PROFILE('@class') GROUP('mqm') OBJTYPE(QMGR) AUTHADD(CRT)
SET AUTHREC PROFILE('@class') GROUP('mygrp01') OBJTYPE(QMGR) AUTHADD(NONE)


OK, that output is confusing, they don't match the -n MY.QUEUE*.** that I
used in the command, so why do they show up this output


There are no queues yet defined on this QM that begin with the name
MY.QUEUE.

I'm concerned that dmpmqcfg is not picking up things I set with setmqaut and
can see with dspmqaut and MO71. I don't trust this as a method to produce a
replacement runmqsc script for my setmqaut script. There are multiple
examples like this that did not get picked up from my main setmqaut script.
Actually, I don't trust this to backup the authorities of a QM just for
backup purposes - it seems I would need to fall back to my setmqaut script
to be sure I have everything. :-?


Peter Potkay


From: MQSeries List [ <mailto:MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org>
mailto:MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org] On Behalf Of Potkay, Peter M (CTO
Architecture + Engineering)
Sent: Thursday, October 24, 2013 12:02 PM
To: MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org
Subject: Re: SET AUTHREC versus setmqaut

Good idea T.Rob, playing with it now.

Hmmm, while I can tell dmpmqcfg to only grab Authrority Records and spit
them out in a runmqsc format, there doesn't appear to be a way to tell it to
only do that for Auth Records for a particular User ID. Or at the very
least, to at least exclude the records for the mqm ID.

Peter Potkay

From: MQSeries List [ <mailto:MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org>
mailto:MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org] On Behalf Of T.Rob
Sent: Wednesday, October 23, 2013 10:38 AM
To: <mailto:MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org>
MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org
Subject: Re: SET AUTHREC versus setmqaut

For what it's worth the conversion is pretty easy. Run your setmqaut
scripts, then run dmpmqcfg to spit out the SET AUTHREC equivalents.

Personally, it's worth the trouble to me to convert. The setmqaut commands
need to be run from the command line locally and in many shops end up in
different change control systems, sitting on the local filesystem, etc. I
like it much better that I can define an object and then define the ACLs for
that object immediately adjacent to it in the script, that it's one script,
that it can be run remotely, etc.

But then I script everything so YMMV.

-- T.Rob


From: MQSeries List [ <mailto:MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org>
mailto:MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org] On Behalf Of Potkay, Peter M (CTO
Architecture + Engineering)
Sent: Wednesday, October 23, 2013 10:08 AM
To: <mailto:MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org>
MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org
Subject: SET AUTHREC versus setmqaut

Is there any reason to take the time and effort of rewriting my setmqaut
scripts into SET AUTHREC commands?

So far the only reason I came up with is that then my standard runmqsc
script I use for new QMs could also take care of the security stuff, versus
having to run a second script specific to setmqaut.


Are AUTHREC just another way of doing the same thing?
Is setmqaut on the Endangered Species List, so sooner or later I'm gonna
have to switch anyway?
Does AUTHREC provide or remove capability compared to setmqaut?

Google doesn't know...
The new AUTHREC isn't addressed in the Info Center in the "Changed behavior
between v6.0 and V7.5" section.


Peter Potkay




************************************************************
This communication, including attachments, is for the exclusive use of
addressee and may contain proprietary, confidential and/or privileged
information. If you are not the intended recipient, any use, copying,
disclosure, dissemination or distribution is strictly prohibited. If you
are not the intended recipient, please notify the sender immediately by
return e-mail, delete this communication and destroy all copies.
************************************************************


_____


<http://listserv.meduniwien.ac.at/archives/mqser-l.html> List Archive -
<http://listserv.meduniwien.ac.at/cgi-bin/wa?SUBED1=mqser-l&A=1> Manage Your
List Settings -
<mailto:LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org?subject=Unsubscribe&BODY=signoff%
20mqseries> Unsubscribe

Instructions for managing your mailing list subscription are provided in the
Listserv General Users Guide available at
<http://www.lsoft.com/resources/manuals.asp> http://www.lsoft.com




_____


<http://listserv.meduniwien.ac.at/archives/mqser-l.html> List Archive -
<http://listserv.meduniwien.ac.at/cgi-bin/wa?SUBED1=mqser-l&A=1> Manage Your
List Settings -
<mailto:LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org?subject=Unsubscribe&BODY=signoff%
20mqseries> Unsubscribe

Instructions for managing your mailing list subscription are provided in the
Listserv General Users Guide available at http://www.lsoft.com
<http://www.lsoft.com/resources/manuals.asp>

************************************************************
This communication, including attachments, is for the exclusive use of
addressee and may contain proprietary, confidential and/or privileged
information. If you are not the intended recipient, any use, copying,
disclosure, dissemination or distribution is strictly prohibited. If you
are not the intended recipient, please notify the sender immediately by
return e-mail, delete this communication and destroy all copies.
************************************************************


_____


<http://listserv.meduniwien.ac.at/archives/mqser-l.html> List Archive -
<http://listserv.meduniwien.ac.at/cgi-bin/wa?SUBED1=mqser-l&A=1> Manage Your
List Settings -
<mailto:LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org?subject=Unsubscribe&BODY=signoff%
20mqseries> Unsubscribe

Instructions for managing your mailing list subscription are provided in the
Listserv General Users Guide available at http://www.lsoft.com
<http://www.lsoft.com/resources/manuals.asp>

************************************************************
This communication, including attachments, is for the exclusive use of
addressee and may contain proprietary, confidential and/or privileged
information. If you are not the intended recipient, any use, copying,
disclosure, dissemination or distribution is strictly prohibited. If you
are not the intended recipient, please notify the sender immediately by
return e-mail, delete this communication and destroy all copies.
************************************************************



_____

<http://listserv.meduniwien.ac.at/archives/mqser-l.html> List Archive -
<http://listserv.meduniwien.ac.at/cgi-bin/wa?SUBED1=mqser-l&A=1> Manage Your
List Settings -
<mailto:LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org?subject=Unsubscribe&BODY=signoff%
20mqseries> Unsubscribe

Instructions for managing your mailing list subscription are provided in the
Listserv General Users Guide available at http://www.lsoft.com
<http://www.lsoft.com/resources/manuals.asp>



_____

List Archive <http://listserv.meduniwien.ac.at/archives/mqser-l.html> -
Manage Your List Settings
<http://listserv.meduniwien.ac.at/cgi-bin/wa?SUBED1=mqser-l&A=1> -
Unsubscribe
<mailto:LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org?subject=Unsubscribe&BODY=signoff%
20mqseries>

Instructions for managing your mailing list subscription are provided in the
Listserv General Users Guide available at http://www.lsoft.com
<http://www.lsoft.com/resources/manuals.asp>

************************************************************
This communication, including attachments, is for the exclusive use of
addressee and may contain proprietary, confidential and/or privileged
information. If you are not the intended recipient, any use, copying,
disclosure, dissemination or distribution is strictly prohibited. If you
are not the intended recipient, please notify the sender immediately by
return e-mail, delete this communication and destroy all copies.
************************************************************



_____

List Archive <http://listserv.meduniwien.ac.at/archives/mqser-l.html> -
Manage Your List Settings
<http://listserv.meduniwien.ac.at/cgi-bin/wa?SUBED1=mqser-l&A=1> -
Unsubscribe
<mailto:LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org?subject=Unsubscribe&BODY=signoff%
20mqseries>

Instructions for managing your mailing list subscription are provided in the
Listserv General Users Guide available at http://www.lsoft.com
<http://www.lsoft.com/resources/manuals.asp>


_____________________________________________________________
DTCC DISCLAIMER: This email and any files transmitted with it are
confidential and intended solely for the use of the individual or entity to
whom they are addressed. If you have received this email in error, please
notify us immediately and delete the email and any attachments from your
system. The recipient should check this email and any attachments for the
presence of viruses. The company accepts no liability for any damage caused
by any virus transmitted by this email.

_____

List Archive <http://listserv.meduniwien.ac.at/archives/mqser-l.html> -
Manage Your List Settings
<http://listserv.meduniwien.ac.at/cgi-bin/wa?SUBED1=mqser-l&A=1> -
Unsubscribe
<mailto:LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org?subject=Unsubscribe&BODY=signoff%
20mqseries>

Instructions for managing your mailing list subscription are provided in the
Listserv General Users Guide available at http://www.lsoft.com
<http://www.lsoft.com/resources/manuals.asp>



_____

List Archive <http://listserv.meduniwien.ac.at/archives/mqser-l.html> -
Manage Your List Settings
<http://listserv.meduniwien.ac.at/cgi-bin/wa?SUBED1=mqser-l&A=1> -
Unsubscribe
<mailto:LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org?subject=Unsubscribe&BODY=signoff%
20mqseries>

Instructions for managing your mailing list subscription are provided in the
Listserv General Users Guide available at http://www.lsoft.com
<http://www.lsoft.com/resources/manuals.asp>

************************************************************
This communication, including attachments, is for the exclusive use of
addressee and may contain proprietary, confidential and/or privileged
information. If you are not the intended recipient, any use, copying,
disclosure, dissemination or distribution is strictly prohibited. If you
are not the intended recipient, please notify the sender immediately by
return e-mail, delete this communication and destroy all copies.
************************************************************



_____

List Archive <http://listserv.meduniwien.ac.at/archives/mqser-l.html> -
Manage Your List Settings
<http://listserv.meduniwien.ac.at/cgi-bin/wa?SUBED1=mqser-l&A=1> -
Unsubscribe
<mailto:LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org?subject=Unsubscribe&BODY=signoff%
20mqseries>

Instructions for managing your mailing list subscription are provided in the
Listserv General Users Guide available at http://www.lsoft.com
<http://www.lsoft.com/resources/manuals.asp>

************************************************************
This communication, including attachments, is for the exclusive use of
addressee and may contain proprietary, confidential and/or privileged
information. If you are not the intended recipient, any use, copying,
disclosure, dissemination or distribution is strictly prohibited. If you
are not the intended recipient, please notify the sender immediately by
return e-mail, delete this communication and destroy all copies.
************************************************************



_____

List Archive <http://listserv.meduniwien.ac.at/archives/mqser-l.html> -
Manage Your List Settings
<http://listserv.meduniwien.ac.at/cgi-bin/wa?SUBED1=mqser-l&A=1> -
Unsubscribe
<mailto:LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org?subject=Unsubscribe&BODY=signoff%
20mqseries>

Instructions for managing your mailing list subscription are provided in the
Listserv General Users Guide available at http://www.lsoft.com
<http://www.lsoft.com/resources/manuals.asp>

************************************************************
This communication, including attachments, is for the exclusive use of
addressee and may contain proprietary, confidential and/or privileged
information. If you are not the intended recipient, any use, copying,
disclosure, dissemination or distribution is strictly prohibited. If you
are not the intended recipient, please notify the sender immediately by
return e-mail, delete this communication and destroy all copies.
************************************************************



_____

List Archive <http://listserv.meduniwien.ac.at/archives/mqser-l.html> -
Manage Your List Settings
<http://listserv.meduniwien.ac.at/cgi-bin/wa?SUBED1=mqser-l&A=1> -
Unsubscribe
<mailto:LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org?subject=Unsubscribe&BODY=signoff%
20mqseries>

Instructions for managing your mailing list subscription are provided in the
Listserv General Users Guide available at http://www.lsoft.com
<http://www.lsoft.com/resources/manuals.asp>


To unsubscribe, write to LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org and,
in the message body (not the subject), write: SIGNOFF MQSERIES
Instructions for managing your mailing list subscription are provided in
the Listserv General Users Guide available at http://www.lsoft.com
Archive: http://listserv.meduniwien.ac.at/archives/mqser-l.html
Michael Dag
2013-10-31 09:47:09 UTC
Permalink
Peter,

I am still a little bit baffled by the fact that was stated that: dmpmqcfg
(which IMHO stands for dump mq config) works as designed

when it clearly does not dump the entire mq config.

Unless AUTHREC's are not seen as config information, but as rules. :o

but then NONE of the rule information should be in dmpmqcfg but in
'dmpmqrul' .



Michael



From: MQSeries List [mailto:MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org] On Behalf Of
Potkay, Peter M (CTO Architecture + Engineering)
Sent: woensdag 30 oktober 2013 17:35
To: MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org
Subject: Re: SET AUTHREC versus setmqaut



The PMR concluded that dmpmqcfg is working as designed and that I should
open an RFE.



Here is the link to vote for the RFE to update dmpmqcfg to capture authority
records for profiles for names of queues that don't exist yet.


<http://www.ibm.com/developerworks/rfe/execute?use_case=viewRfe&CR_ID=41015>
http://www.ibm.com/developerworks/rfe/execute?use_case=viewRfe&CR_ID=41015





We'll have to run MS03 and dmpmqcfg in parallel for now. The dmpmqcfg
command will capture the MQ 7.1/7.5 specific things like CHLAUTH records
that MS03 does not. MS03 will insure we get all authority records.







Peter Potkay



From: MQSeries List [mailto:MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org] On Behalf Of
Potkay, Peter M (CTO Architecture + Engineering)
Sent: Tuesday, October 29, 2013 8:49 PM
To: MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org
Subject: Re: SET AUTHREC versus setmqaut



This is a problem with dmpmqcfg that goes beyond generic profiles. Consider
the following example for a profile I created that has no wild characters in
it. The runmqsc command to display authority records shows it, yet dmpmqcfg
does not.



setmqaut -m PETERQM -t q -n THIS.QUEUE.DOES.NOT.EXITS.YET -g mygrp01 +inq

The setmqaut command completed successfully.



dspmqaut -m PETERQM -t q -g mygrp01 -n THIS.QUEUE.DOES.NOT.EXITS.YET

Entity mqappgrp01 has the following authorizations for object
THIS.QUEUE.DOES.NOT.EXITS.YET:

inq



runmqsc PETERQM

5724-H72 (C) Copyright IBM Corp. 1994, 2011. ALL RIGHTS RESERVED.

Starting MQSC for queue manager PETERQM.



DISPLAY AUTHREC



AMQ8864: Display authority record details.

PROFILE(THIS.QUEUE.DOES.NOT.EXITS.YET)

ENTITY(mygrp01) ENTTYPE(GROUP)

OBJTYPE(QUEUE) AUTHLIST(INQ)





dmpmqcfg -x authrec -a -m PETERQM -o 1line -t queue -n
THIS.QUEUE.DOES.NOT.EXITS.YET

****************************************************************************
**************

* Script generated on 2013-10-29 at 20.18.26

* Script generated by user 'mqm' on host 'myServer'

* Queue manager name: PETERQM

* Queue manager platform: UNIX

* Queue manager command level: (750/750)

* Command issued: dmpmqcfg -x authrec -a -m PETERQM -o 1line -t queue -n
THIS.QUEUE.DOES.NOT.EXITS.YET

****************************************************************************
**************

* No matching queue objects







I have a PMR open.



The dspmqaut, dmpmqaut, amqoamd and runmqsc methods of reporting on what a
QM knows about these type of profiles do report them. The dmpmqcfg command
does not.



Be careful if you replaced MS03 with dmpmqcfg when it comes to authority
records - you may not be getting 100% of what you think you are if you have
profiles defined for future queues yet to be defined.



Peter Potkay



From: MQSeries List [mailto:MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org] On Behalf Of
Potkay, Peter M (CTO Architecture + Engineering)
Sent: Friday, October 25, 2013 8:48 AM
To: MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org
Subject: Re: SET AUTHREC versus setmqaut



I think you're on to something with the multiple asterisks. And, it also
seems to be impacted on whether there is an object that already exists or
not that matches the profile.



I do not have any queues that start with NEW.QUEUE at this point.





setmqaut -m PETERQM -t q -n NEW.QUEUE*.** -g mygrp01 +inq

The setmqaut command completed successfully.



dspmqaut -m PETERQM -t q -n NEW.QUEUE*.** -g mygrp01

Entity mygrp01 has the following authorizations for object NEW.QUEUE*.**:

inq



dmpmqaut -m PETERQM -t q -n NEW.QUEUE*.**

profile: NEW.QUEUE*.**

object type: queue

entity: mygrp01

entity type: group

authority: inq







No problems for dspmqaut or dmpmqaut to recognize this new profile. Now
let's try dmpmqcfg







dmpmqcfg -x authrec -a -n "NEW.QUEUE*.**" -m PETERQM -o 1line -t queue

****************************************************************************
**************

* Script generated on 2013-10-25 at 08.34.28

* Script generated by user 'mqm' on host 'myServer'

* Queue manager name: PETERQM

* Queue manager platform: UNIX

* Queue manager command level: (750/750)

* Command issued: dmpmqcfg -x authrec -a -n NEW.QUEUE*.** -m PETERQM -o
1line -t queue

****************************************************************************
**************



Again with only 1 asterisk:



dmpmqcfg -x authrec -a -n "NEW.QUEUE*" -m PETERQM -o 1line -t queue

****************************************************************************
**************

* Script generated on 2013-10-25 at 08.34.45

* Script generated by user 'mqm' on host 'myServer'

* Queue manager name: PETERQM

* Queue manager platform: UNIX

* Queue manager command level: (750/750)

* Command issued: dmpmqcfg -x authrec -a -n NEW.QUEUE* -m PETERQM -o 1line
-t queue

****************************************************************************
**************

* No matching queue objects







Notice that while both attempts with dmpmqcfg fail to get a hit, the second
command where I use only one asterisk produces one extra line of output.





Now I'll create one queue that matches this profile name.







runmqsc PETERQM

5724-H72 (C) Copyright IBM Corp. 1994, 2011. ALL RIGHTS RESERVED.

Starting MQSC for queue manager PETERQM.





DEF QL (NEW.QUEUE.ONE)

1 : DEF QL (NEW.QUEUE.ONE)

AMQ8006: WebSphere MQ queue created.

end

2 : end

One MQSC command read.

No commands have a syntax error.

All valid MQSC commands were processed.





dmpmqcfg -x authrec -a -n "NEW.QUEUE*.**" -m PETERQM -o 1line -t queue

****************************************************************************
**************

* Script generated on 2013-10-25 at 08.37.21

* Script generated by user 'mqm' on host 'myServer'

* Queue manager name: PETERQM

* Queue manager platform: UNIX

* Queue manager command level: (750/750)

* Command issued: dmpmqcfg -x authrec -a -n NEW.QUEUE*.** -m PETERQM -o
1line -t queue

****************************************************************************
**************



With multiple asterisks still no joy.







dmpmqcfg -x authrec -a -n "NEW.QUEUE*" -m PETERQM -o 1line -t queue

****************************************************************************
**************

* Script generated on 2013-10-25 at 08.37.25

* Script generated by user 'mqm' on host 'myServer'

* Queue manager name: PETERQM

* Queue manager platform: UNIX

* Queue manager command level: (750/750)

* Command issued: dmpmqcfg -x authrec -a -n NEW.QUEUE* -m PETERQM -o 1line
-t queue

****************************************************************************
**************

SET AUTHREC PROFILE('NEW.QUEUE.ONE') GROUP('mqm') OBJTYPE(QUEUE)
AUTHADD(BROWSE,CHG,CLR,DLT,DSP,GET,INQ,PUT,PASSALL,PASSID,SET,SETALL,SETID)

SET AUTHREC PROFILE('NEW.QUEUE*.**') GROUP('mygrp01') OBJTYPE(QUEUE)
AUTHADD(INQ)





Hello!







I'll copy and paste this email into a PMR now.

And rely on dmpmqaut or dspmqaut in the meantime to get an accurate list of
authority records for a Queue Manager.













Peter Potkay



From: MQSeries List [mailto:MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org] On Behalf Of
Tim Zielke
Sent: Friday, October 25, 2013 8:19 AM
To: MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org
Subject: Re: SET AUTHREC versus setmqaut



Hi Grant,



I could be misinterpreting, but I think the part "the object/profile name
may contain a single asterisk" is saying that "-n *" is valid. That is how
I also interpret the "-n [* | ObjectName]". You can have either "-n *" or
"-n ObjectName". And then there is also the restriction that if you use an
asterisk on the ObjectName, it must come at the end. Regardless, the text
is somewhat ambiguous.



I did try the following:



dmpmqcfg -x authrec -a -n SYSTEM.* -m xxxxxxxx -o 1line -t queue



and that returned results.



However, the following:



dmpmqcfg -x authrec -a -n SYSTEM.** -m xxxxxxxx -o 1line -t queue



did not.



There does seem to be something wrong with the -n filtering of the dmpmqcfg
command, when you end with multiple asterisks.



Thanks,

Tim



From: MQSeries List [mailto:MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org] On Behalf Of
Ward Able, Grant
Sent: Friday, October 25, 2013 4:33 AM
To: MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org
Subject: Re: SET AUTHREC versus setmqaut



Peter,

I was just trawling through the InfoCentre (oh how I miss the PDFs!!!) and I
saw that you may only have a single "*" and that can only be at the end.
Perhaps your uses of *.** is confusing the poor utility?



-n [ * | ObjectName ]

Filter the definitions produced by object or profile name, the
object/profile name may contain a single asterisk. The * option can be
placed only at the end of the entered filter string.







Regards - Grant.

Telephone Internal: 201496 (London)

Telephone External: +44 (0)207 650 1496



From: MQSeries List [mailto:MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org] On Behalf Of
Potkay, Peter M (CTO Architecture + Engineering)
Sent: 24 October 2013 20:11
To: MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org
Subject: Re: SET AUTHREC versus setmqaut



Single or double quotes didn't make a diff. But check it out, DISPLAY
AUTHREC in a runmqsc session does see it like dspmqaut and dmpmqaut does.



Seems like dmpmqcfg is the only thing that can't see this profile.







dmpmqcfg -x authrec -a -n MY.QUEUE*.** -m PETERQM -o 1line -t queue

****************************************************************************
**************

* Script generated on 2013-10-24 at 14.48.04

* Script generated by user 'mqm' on host 'myServer'

* Queue manager name: PETERQM

* Queue manager platform: UNIX

* Queue manager command level: (750/750)

* Command issued: dmpmqcfg -x authrec -a -n MY.QUEUE*.** -m PETERQM -o 1line
-t queue

****************************************************************************
**************





dmpmqcfg -x authrec -a -n 'MY.QUEUE*.**' -m PETERQM -o 1line -t queue

****************************************************************************
**************

* Script generated on 2013-10-24 at 14.48.17

* Script generated by user 'mqm' on host 'myServer'

* Queue manager name: PETERQM

* Queue manager platform: UNIX

* Queue manager command level: (750/750)

* Command issued: dmpmqcfg -x authrec -a -n MY.QUEUE*.** -m PETERQM -o 1line
-t queue

****************************************************************************
**************





dmpmqcfg -x authrec -a -n "MY.QUEUE*.**" -m PETERQM -o 1line -t queue

****************************************************************************
**************

* Script generated on 2013-10-24 at 14.49.04

* Script generated by user 'mqm' on host 'myServer'

* Queue manager name: PETERQM

* Queue manager platform: UNIX

* Queue manager command level: (750/750)

* Command issued: dmpmqcfg -x authrec -a -n MY.QUEUE*.** -m PETERQM -o 1line
-t queue

****************************************************************************
**************





runmqsc PETERQM

5724-H72 (C) Copyright IBM Corp. 1994, 2011. ALL RIGHTS RESERVED.

Starting MQSC for queue manager PETERQM.





DISPLAY AUTHREC PROFILE(MY.QUEUE*.**)

1 : DISPLAY AUTHREC PROFILE(MY.QUEUE*.**)

AMQ8864: Display authority record details.

PROFILE(MY.QUEUE*.**) ENTITY(mygrp01)

ENTTYPE(GROUP) OBJTYPE(QUEUE)

AUTHLIST(BROWSE,GET,INQ,PUT)

end

2 : end

One MQSC command read.

No commands have a syntax error.

All valid MQSC commands were processed.







Peter Potkay

From: MQSeries List [mailto:MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org] On Behalf Of
Jefferson Lowrey
Sent: Thursday, October 24, 2013 2:29 PM
To: MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org
Subject: Re: SET AUTHREC versus setmqaut



Try putting the *'s inside quotes to make sure the shell isn't interpreting
them?


Thank you,

Jeff Lowrey



From: "Potkay, Peter M (CTO Architecture + Engineering)"
<Peter.Potkay-***@public.gmane.org>
To: MQSERIES-JX7+OpRa80QeFbOYke1v4oOpTq8/***@public.gmane.org,
Date: 10/24/2013 12:52 PM
Subject: Re: [MQSERIES] SET AUTHREC versus setmqaut
Sent by: MQSeries List <MQSERIES-JX7+OpRa80QeFbOYke1v4oOpTq8/***@public.gmane.org>

_____




I noticed some random things missing from my dmpmqcfg that I explicitly set
in my setmqaut. I think I should have seen everything because I used this
command:
"Command issued: dmpmqcfg -m PETERQM -x authrec -a -o mqsc"


So I did a little test:

setmqaut -m PETERQM -n MY.QUEUE*.** -t queue -g mygrp01 -all +get +browse
+put +inq
The setmqaut command completed successfully.

dspmqaut -m PETERQM -n MY.QUEUE*.** -t queue -g mygrp01
Entity mygrp01 has the following authorizations for object MY.QUEUE*.**:
get
browse
put
inq

dmpmqaut -m PETERQM -t queue -n MY.QUEUE*.**
profile: MY.QUEUE*.**
object type: queue
entity: mygrp01
entity type: group
authority: get browse put inq


Old school methods are consistent. Now let's see what dmpmqcfg shows.



dmpmqcfg -x authrec -a -n CHANNEL.CHECKER*.** -m PETERQM -o 1line -t queue
****************************************************************************
**************
* Script generated on 2013-10-24 at 12.34.42
* Script generated by user 'mqm' on host 'MyServer'
* Queue manager name: PETERQM
* Queue manager platform: UNIX
* Queue manager command level: (750/750)
* Command issued: dmpmqcfg -x authrec -a -n MY.QUEUE*.** -m PETERQM -o 1line
-t queue
****************************************************************************
**************

No other output for this command!
I drop the -t queue flag and run it again.

dmpmqcfg -x authrec -a -n MY.QUEUE*.** -m PETERQM -o 1line
****************************************************************************
**************
* Script generated on 2013-10-24 at 12.35.50
* Script generated by user 'mqm' on host 'MyServer'
* Queue manager name: PETERQM
* Queue manager platform: UNIX
* Queue manager command level: (750/750)
* Command issued: dmpmqcfg -x authrec -a -n MY.QUEUE*.** -m PETERQM -o 1line

****************************************************************************
**************
SET AUTHREC PROFILE('self') GROUP('mqm') OBJTYPE(QMGR)
AUTHADD(ALTUSR,CHG,CONNECT,DLT,DSP,INQ,SET,SETALL,SETID,CTRL,SYSTEM)
SET AUTHREC PROFILE('self') GROUP('mygrp01') OBJTYPE(QMGR)
AUTHADD(CONNECT,INQ)
SET AUTHREC PROFILE('@class') GROUP('mqm') OBJTYPE(QMGR) AUTHADD(CRT)
SET AUTHREC PROFILE('@class') GROUP('mygrp01') OBJTYPE(QMGR) AUTHADD(NONE)


OK, that output is confusing, they don't match the -n MY.QUEUE*.** that I
used in the command, so why do they show up this output


There are no queues yet defined on this QM that begin with the name
MY.QUEUE.

I'm concerned that dmpmqcfg is not picking up things I set with setmqaut and
can see with dspmqaut and MO71. I don't trust this as a method to produce a
replacement runmqsc script for my setmqaut script. There are multiple
examples like this that did not get picked up from my main setmqaut script.
Actually, I don't trust this to backup the authorities of a QM just for
backup purposes - it seems I would need to fall back to my setmqaut script
to be sure I have everything. :-?


Peter Potkay


From: MQSeries List [ <mailto:MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org>
mailto:MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org] On Behalf Of Potkay, Peter M (CTO
Architecture + Engineering)
Sent: Thursday, October 24, 2013 12:02 PM
To: MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org
Subject: Re: SET AUTHREC versus setmqaut

Good idea T.Rob, playing with it now.

Hmmm, while I can tell dmpmqcfg to only grab Authrority Records and spit
them out in a runmqsc format, there doesn't appear to be a way to tell it to
only do that for Auth Records for a particular User ID. Or at the very
least, to at least exclude the records for the mqm ID.

Peter Potkay

From: MQSeries List [ <mailto:MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org>
mailto:MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org] On Behalf Of T.Rob
Sent: Wednesday, October 23, 2013 10:38 AM
To: <mailto:MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org>
MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org
Subject: Re: SET AUTHREC versus setmqaut

For what it's worth the conversion is pretty easy. Run your setmqaut
scripts, then run dmpmqcfg to spit out the SET AUTHREC equivalents.

Personally, it's worth the trouble to me to convert. The setmqaut commands
need to be run from the command line locally and in many shops end up in
different change control systems, sitting on the local filesystem, etc. I
like it much better that I can define an object and then define the ACLs for
that object immediately adjacent to it in the script, that it's one script,
that it can be run remotely, etc.

But then I script everything so YMMV.

-- T.Rob


From: MQSeries List [ <mailto:MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org>
mailto:MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org] On Behalf Of Potkay, Peter M (CTO
Architecture + Engineering)
Sent: Wednesday, October 23, 2013 10:08 AM
To: <mailto:MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org>
MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org
Subject: SET AUTHREC versus setmqaut

Is there any reason to take the time and effort of rewriting my setmqaut
scripts into SET AUTHREC commands?

So far the only reason I came up with is that then my standard runmqsc
script I use for new QMs could also take care of the security stuff, versus
having to run a second script specific to setmqaut.


Are AUTHREC just another way of doing the same thing?
Is setmqaut on the Endangered Species List, so sooner or later I'm gonna
have to switch anyway?
Does AUTHREC provide or remove capability compared to setmqaut?

Google doesn't know...
The new AUTHREC isn't addressed in the Info Center in the "Changed behavior
between v6.0 and V7.5" section.


Peter Potkay




************************************************************
This communication, including attachments, is for the exclusive use of
addressee and may contain proprietary, confidential and/or privileged
information. If you are not the intended recipient, any use, copying,
disclosure, dissemination or distribution is strictly prohibited. If you
are not the intended recipient, please notify the sender immediately by
return e-mail, delete this communication and destroy all copies.
************************************************************


_____


<http://listserv.meduniwien.ac.at/archives/mqser-l.html> List Archive -
<http://listserv.meduniwien.ac.at/cgi-bin/wa?SUBED1=mqser-l&A=1> Manage Your
List Settings -
<mailto:LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org?subject=Unsubscribe&BODY=signoff%
20mqseries> Unsubscribe

Instructions for managing your mailing list subscription are provided in the
Listserv General Users Guide available at
<http://www.lsoft.com/resources/manuals.asp> http://www.lsoft.com




_____


<http://listserv.meduniwien.ac.at/archives/mqser-l.html> List Archive -
<http://listserv.meduniwien.ac.at/cgi-bin/wa?SUBED1=mqser-l&A=1> Manage Your
List Settings -
<mailto:LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org?subject=Unsubscribe&BODY=signoff%
20mqseries> Unsubscribe

Instructions for managing your mailing list subscription are provided in the
Listserv General Users Guide available at http://www.lsoft.com
<http://www.lsoft.com/resources/manuals.asp>

************************************************************
This communication, including attachments, is for the exclusive use of
addressee and may contain proprietary, confidential and/or privileged
information. If you are not the intended recipient, any use, copying,
disclosure, dissemination or distribution is strictly prohibited. If you
are not the intended recipient, please notify the sender immediately by
return e-mail, delete this communication and destroy all copies.
************************************************************


_____


<http://listserv.meduniwien.ac.at/archives/mqser-l.html> List Archive -
<http://listserv.meduniwien.ac.at/cgi-bin/wa?SUBED1=mqser-l&A=1> Manage Your
List Settings -
<mailto:LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org?subject=Unsubscribe&BODY=signoff%
20mqseries> Unsubscribe

Instructions for managing your mailing list subscription are provided in the
Listserv General Users Guide available at http://www.lsoft.com
<http://www.lsoft.com/resources/manuals.asp>

************************************************************
This communication, including attachments, is for the exclusive use of
addressee and may contain proprietary, confidential and/or privileged
information. If you are not the intended recipient, any use, copying,
disclosure, dissemination or distribution is strictly prohibited. If you
are not the intended recipient, please notify the sender immediately by
return e-mail, delete this communication and destroy all copies.
************************************************************



_____

<http://listserv.meduniwien.ac.at/archives/mqser-l.html> List Archive -
<http://listserv.meduniwien.ac.at/cgi-bin/wa?SUBED1=mqser-l&A=1> Manage Your
List Settings -
<mailto:LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org?subject=Unsubscribe&BODY=signoff%
20mqseries> Unsubscribe

Instructions for managing your mailing list subscription are provided in the
Listserv General Users Guide available at http://www.lsoft.com
<http://www.lsoft.com/resources/manuals.asp>



_____

List Archive <http://listserv.meduniwien.ac.at/archives/mqser-l.html> -
Manage Your List Settings
<http://listserv.meduniwien.ac.at/cgi-bin/wa?SUBED1=mqser-l&A=1> -
Unsubscribe
<mailto:LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org?subject=Unsubscribe&BODY=signoff%
20mqseries>

Instructions for managing your mailing list subscription are provided in the
Listserv General Users Guide available at http://www.lsoft.com
<http://www.lsoft.com/resources/manuals.asp>

************************************************************
This communication, including attachments, is for the exclusive use of
addressee and may contain proprietary, confidential and/or privileged
information. If you are not the intended recipient, any use, copying,
disclosure, dissemination or distribution is strictly prohibited. If you
are not the intended recipient, please notify the sender immediately by
return e-mail, delete this communication and destroy all copies.
************************************************************



_____

List Archive <http://listserv.meduniwien.ac.at/archives/mqser-l.html> -
Manage Your List Settings
<http://listserv.meduniwien.ac.at/cgi-bin/wa?SUBED1=mqser-l&A=1> -
Unsubscribe
<mailto:LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org?subject=Unsubscribe&BODY=signoff%
20mqseries>

Instructions for managing your mailing list subscription are provided in the
Listserv General Users Guide available at http://www.lsoft.com
<http://www.lsoft.com/resources/manuals.asp>


_____________________________________________________________
DTCC DISCLAIMER: This email and any files transmitted with it are
confidential and intended solely for the use of the individual or entity to
whom they are addressed. If you have received this email in error, please
notify us immediately and delete the email and any attachments from your
system. The recipient should check this email and any attachments for the
presence of viruses. The company accepts no liability for any damage caused
by any virus transmitted by this email.

_____

List Archive <http://listserv.meduniwien.ac.at/archives/mqser-l.html> -
Manage Your List Settings
<http://listserv.meduniwien.ac.at/cgi-bin/wa?SUBED1=mqser-l&A=1> -
Unsubscribe
<mailto:LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org?subject=Unsubscribe&BODY=signoff%
20mqseries>

Instructions for managing your mailing list subscription are provided in the
Listserv General Users Guide available at http://www.lsoft.com
<http://www.lsoft.com/resources/manuals.asp>



_____

List Archive <http://listserv.meduniwien.ac.at/archives/mqser-l.html> -
Manage Your List Settings
<http://listserv.meduniwien.ac.at/cgi-bin/wa?SUBED1=mqser-l&A=1> -
Unsubscribe
<mailto:LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org?subject=Unsubscribe&BODY=signoff%
20mqseries>

Instructions for managing your mailing list subscription are provided in the
Listserv General Users Guide available at http://www.lsoft.com
<http://www.lsoft.com/resources/manuals.asp>

************************************************************
This communication, including attachments, is for the exclusive use of
addressee and may contain proprietary, confidential and/or privileged
information. If you are not the intended recipient, any use, copying,
disclosure, dissemination or distribution is strictly prohibited. If you
are not the intended recipient, please notify the sender immediately by
return e-mail, delete this communication and destroy all copies.
************************************************************



_____

List Archive <http://listserv.meduniwien.ac.at/archives/mqser-l.html> -
Manage Your List Settings
<http://listserv.meduniwien.ac.at/cgi-bin/wa?SUBED1=mqser-l&A=1> -
Unsubscribe
<mailto:LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org?subject=Unsubscribe&BODY=signoff%
20mqseries>

Instructions for managing your mailing list subscription are provided in the
Listserv General Users Guide available at http://www.lsoft.com
<http://www.lsoft.com/resources/manuals.asp>

************************************************************
This communication, including attachments, is for the exclusive use of
addressee and may contain proprietary, confidential and/or privileged
information. If you are not the intended recipient, any use, copying,
disclosure, dissemination or distribution is strictly prohibited. If you
are not the intended recipient, please notify the sender immediately by
return e-mail, delete this communication and destroy all copies.
************************************************************



_____

List Archive <http://listserv.meduniwien.ac.at/archives/mqser-l.html> -
Manage Your List Settings
<http://listserv.meduniwien.ac.at/cgi-bin/wa?SUBED1=mqser-l&A=1> -
Unsubscribe
<mailto:LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org?subject=Unsubscribe&BODY=signoff%
20mqseries>

Instructions for managing your mailing list subscription are provided in the
Listserv General Users Guide available at http://www.lsoft.com
<http://www.lsoft.com/resources/manuals.asp>

************************************************************
This communication, including attachments, is for the exclusive use of
addressee and may contain proprietary, confidential and/or privileged
information. If you are not the intended recipient, any use, copying,
disclosure, dissemination or distribution is strictly prohibited. If you
are not the intended recipient, please notify the sender immediately by
return e-mail, delete this communication and destroy all copies.
************************************************************



_____

List Archive <http://listserv.meduniwien.ac.at/archives/mqser-l.html> -
Manage Your List Settings
<http://listserv.meduniwien.ac.at/cgi-bin/wa?SUBED1=mqser-l&A=1> -
Unsubscribe
<mailto:LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org?subject=Unsubscribe&BODY=signoff%
20mqseries>

Instructions for managing your mailing list subscription are provided in the
Listserv General Users Guide available at http://www.lsoft.com
<http://www.lsoft.com/resources/manuals.asp>


To unsubscribe, write to LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org and,
in the message body (not the subject), write: SIGNOFF MQSERIES
Instructions for managing your mailing list subscription are provided in
the Listserv General Users Guide available at http://www.lsoft.com
Archive: http://listserv.meduniwien.ac.at/archives/mqser-l.html
Loading...