{"id":1004,"date":"2021-10-18T15:09:12","date_gmt":"2021-10-18T14:09:12","guid":{"rendered":"https:\/\/marketaylor.synology.me\/?p=1004"},"modified":"2021-10-18T15:09:14","modified_gmt":"2021-10-18T14:09:14","slug":"controlling-queue-creation","status":"publish","type":"post","link":"https:\/\/marketaylor.synology.me\/?p=1004","title":{"rendered":"Controlling queue creation"},"content":{"rendered":"\n

A recent thread on mqseries.net<\/a> asked about controlling queue creation in MQ. In particular, how to set authorities so that one user can create queues like “ABC…” but not “DEF…”. There are answers given in that thread both on the ability to do it, and the reason why it’s not usually something that’s needed.<\/p>\n\n\n\n

In summary, it’s not possible to control it with setmqaut<\/code> commands. And since queue creation is usually done by administrators, there’s not really any need to restrict it further.<\/p>\n\n\n\n

But the thread did remind me of some code I’d written a few years ago while considering the same question as part of a larger piece of work. And so I thought I’d dredge up that PoC and make it a bit more readable. It shows how you can, in fact, implement that level of control on platforms where you can install extensions to the MQ Authorisation interface.<\/p>\n\n\n\n\n\n\n\n

Normal controls<\/h3>\n\n\n\n

Usually, the control of whether someone can create an object is stored as a “global” permission for the object type as part of a special object called @class<\/code>. There is one @class<\/code> object for each object type – queue, channel, namelist etc. And when you run dmpmqaut<\/code> you can see these permissions:<\/p>\n\n\n\n

$ dmpmqaut -m QM1 -n @class\nprofile:     @class\nobject type: rqmname\nentity:      metaylor\nentity type: group\nauthority:   none\n- - - - - \nprofile:     @class\nobject type: queue\nentity:      metaylor\nentity type: group\nauthority:   crt<\/pre>\n\n\n\n
Extended controls<\/h3>\n\n\n\n
These permissions are applied and checked by MQ’s Object Authority Manager. But that is a pluggable service. If you don’t like what it does, it is possible to augment or replace it by your own implementation. Many years ago I wrote a SupportPac (now on github<\/a>) that logs the authorisation operations made by the queue manager. It was a way of debugging what goes on and documenting how you can write an alternative.<\/p>\n\n\n\n
I used that package while looking into this question to record what happens when a user creates a queue, either explicitly or – by opening a MODEL queue  where you can programmatically define a prefix for the dynamic queue – implicitly. After seeing how the authorisation checks are made, I wrote an extension that gets ahead of the regular OAM and makes its own decision on whether the operation can proceed.<\/p>\n\n\n\n
So when running DEFINE QLOCAL(Z)<\/code>, the logging module showed the queue manager making this call:<\/p>\n\n\n\n
[28966972.2828 @ Wed Oct 13 09:12:40 2021] OACheckAuth\n    Object : \"Z \" [Queue]\n    User : \"metaylor\"\n    Auth : 0x00010000 [crt ]<\/pre>\n\n\n\n
which is very simple to recognise and intercept. Handling dynamic queues has a more complex pattern, involving a sequence of OAM calls, but it is still a pattern that can be recognised. Note that the authorisation check is always based on a username’s permission, regardless of whether you are using a user or group-based authorisation configuration.<\/p>\n\n\n\n
The oamcrt Installable Service<\/h3>\n\n\n\n
The module I wrote sits as a new Installable Service ahead of the regular OAM in a chain of modules. You can find the source as oamcrt<\/a> alongside the oamlog<\/a> module in the MQ Exits Repository that I wrote more about here<\/a>.<\/p>\n\n\n\n
This service is not very intelligent, but it is good enough to demonstrate the principles. The main (admittedly severe) limitation is that it has a hardcoded pattern for rejection of object creation. In any productised version, there would be some kind of external configuration file with pattern matching abilities. I’ve tried to show where reading the file and doing checks against its contents would fit. And I’ve also showed how the process\/thread models within the queue manager would work with essential locking. But the configuration part seemed to be code that was “well understood” whereas I was interested in the MQ Authorisation processing piece of the puzzle.<\/p>\n\n\n\n
This module simply rejects any attempt to create a queue whose name starts with NOTALLOWED<\/code>, even when administrators do it:<\/p>\n\n\n\n
Starting MQSC for queue manager OAMLOG.
1 : DEF QL(NOTALLOWED.1) REPLACE
AMQ8135E: Not authorized.
One valid MQSC command could not be processed.<\/pre>\n\n\n\n
The amqsput <\/em>sample program, which allows you to nominate the prefix of a dynamic queue similarly fails. (The repository has a slightly-modified version of amqsput <\/em>included. It just makes it a bit easier to use default values for some of the arguments, but is otherwise the same as the standard sample.)<\/p>\n\n\n\n
$ bin\/sput SYSTEM.DEFAULT.MODEL.QUEUE OAMLOG -1 -1 _ NOTALLOWED\nSample AMQSPUT0 start\ntarget queue is SYSTEM.DEFAULT.MODEL.QUEUE\ndynamic queue name is NOTALLOWED\nMQOPEN ended with reason code 2035\nunable to open queue for output<\/pre>\n\n\n\n
If this module decides to reject a request, that is the end of that flow – the regular OAM cannot override the decision. If this module permits a request, then the OAM still gets the opportunity to see whether it likes the command.<\/p>\n\n\n\n
Possible enhancements<\/h3>\n\n\n\n
Clearly we could enhance this module to actually process a configuration file. And it could include other object types beyond queues. But hopefully this gives an interesting demonstration of what you can achieve with the extensibility of one of MQ’s lesser-known interfaces.<\/p>\n","protected":false},"excerpt":{"rendered":"
A recent thread on mqseries.net asked about controlling queue creation in MQ. In particular, how to set authorities so that one user can create queues like “ABC…” but not “DEF…”. There are answers given in that thread both on the ability to do it, and the reason why it’s not usually something that’s needed. In … Continue reading “Controlling queue creation”<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":1007,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[5],"tags":[77,35,20,105,104],"class_list":["post-1004","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-mq","tag-authorisation","tag-ibmmq","tag-mqseries","tag-oam","tag-security"],"yoast_head":"\nControlling queue creation - Mark Taylor's Blog<\/title>\n<meta name=\"description\" content=\"IBM MQ's rules on object creation are usually ok, but maybe you'd like granular control of names. This OAM add-on shows how it is possible.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/marketaylor.synology.me\/?p=1004\" \/>\n<meta property=\"og:locale\" content=\"en_GB\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Controlling queue creation - Mark Taylor's Blog\" \/>\n<meta property=\"og:description\" content=\"IBM MQ's rules on object creation are usually ok, but maybe you'd like granular control of names. This OAM add-on shows how it is possible.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/marketaylor.synology.me\/?p=1004\" \/>\n<meta property=\"og:site_name\" content=\"Mark Taylor's Blog\" \/>\n<meta property=\"article:published_time\" content=\"2021-10-18T14:09:12+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2021-10-18T14:09:14+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/marketaylor.synology.me\/wp-content\/uploads\/2021\/10\/padlock-small.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"282\" \/>\n\t<meta property=\"og:image:height\" content=\"188\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Mark\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@marketaylor\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Mark\" \/>\n\t<meta name=\"twitter:label2\" content=\"Estimated reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/marketaylor.synology.me\\\/?p=1004#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/marketaylor.synology.me\\\/?p=1004\"},\"author\":{\"name\":\"Mark\",\"@id\":\"https:\\\/\\\/marketaylor.synology.me\\\/#\\\/schema\\\/person\\\/2d6f4113ff54187023e20c20186bbb3c\"},\"headline\":\"Controlling queue creation\",\"datePublished\":\"2021-10-18T14:09:12+00:00\",\"dateModified\":\"2021-10-18T14:09:14+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/marketaylor.synology.me\\\/?p=1004\"},\"wordCount\":743,\"commentCount\":0,\"image\":{\"@id\":\"https:\\\/\\\/marketaylor.synology.me\\\/?p=1004#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/marketaylor.synology.me\\\/wp-content\\\/uploads\\\/2021\\\/10\\\/padlock-small.jpg\",\"keywords\":[\"authorisation\",\"ibmmq\",\"mqseries\",\"OAM\",\"security\"],\"articleSection\":[\"IBM MQ\"],\"inLanguage\":\"en-GB\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/marketaylor.synology.me\\\/?p=1004#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/marketaylor.synology.me\\\/?p=1004\",\"url\":\"https:\\\/\\\/marketaylor.synology.me\\\/?p=1004\",\"name\":\"Controlling queue creation - Mark Taylor's Blog\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/marketaylor.synology.me\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/marketaylor.synology.me\\\/?p=1004#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/marketaylor.synology.me\\\/?p=1004#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/marketaylor.synology.me\\\/wp-content\\\/uploads\\\/2021\\\/10\\\/padlock-small.jpg\",\"datePublished\":\"2021-10-18T14:09:12+00:00\",\"dateModified\":\"2021-10-18T14:09:14+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/marketaylor.synology.me\\\/#\\\/schema\\\/person\\\/2d6f4113ff54187023e20c20186bbb3c\"},\"description\":\"IBM MQ's rules on object creation are usually ok, but maybe you'd like granular control of names. This OAM add-on shows how it is possible.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/marketaylor.synology.me\\\/?p=1004#breadcrumb\"},\"inLanguage\":\"en-GB\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/marketaylor.synology.me\\\/?p=1004\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"https:\\\/\\\/marketaylor.synology.me\\\/?p=1004#primaryimage\",\"url\":\"https:\\\/\\\/marketaylor.synology.me\\\/wp-content\\\/uploads\\\/2021\\\/10\\\/padlock-small.jpg\",\"contentUrl\":\"https:\\\/\\\/marketaylor.synology.me\\\/wp-content\\\/uploads\\\/2021\\\/10\\\/padlock-small.jpg\",\"width\":282,\"height\":188,\"caption\":\"padlock\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/marketaylor.synology.me\\\/?p=1004#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/marketaylor.synology.me\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Controlling queue creation\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/marketaylor.synology.me\\\/#website\",\"url\":\"https:\\\/\\\/marketaylor.synology.me\\\/\",\"name\":\"Mark Taylor's Blog\",\"description\":\"Messaging, Music and Moving Around\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/marketaylor.synology.me\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-GB\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/marketaylor.synology.me\\\/#\\\/schema\\\/person\\\/2d6f4113ff54187023e20c20186bbb3c\",\"name\":\"Mark\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/9a5ae091c43730194cba7cabb5d65c1dc3f48d05caaddec6ff2319a1ce66376f?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/9a5ae091c43730194cba7cabb5d65c1dc3f48d05caaddec6ff2319a1ce66376f?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/9a5ae091c43730194cba7cabb5d65c1dc3f48d05caaddec6ff2319a1ce66376f?s=96&d=mm&r=g\",\"caption\":\"Mark\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/marketaylor\"],\"url\":\"https:\\\/\\\/marketaylor.synology.me\\\/?author=1\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Controlling queue creation - Mark Taylor's Blog","description":"IBM MQ's rules on object creation are usually ok, but maybe you'd like granular control of names. This OAM add-on shows how it is possible.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/marketaylor.synology.me\/?p=1004","og_locale":"en_GB","og_type":"article","og_title":"Controlling queue creation - Mark Taylor's Blog","og_description":"IBM MQ's rules on object creation are usually ok, but maybe you'd like granular control of names. This OAM add-on shows how it is possible.","og_url":"https:\/\/marketaylor.synology.me\/?p=1004","og_site_name":"Mark Taylor's Blog","article_published_time":"2021-10-18T14:09:12+00:00","article_modified_time":"2021-10-18T14:09:14+00:00","og_image":[{"width":282,"height":188,"url":"https:\/\/marketaylor.synology.me\/wp-content\/uploads\/2021\/10\/padlock-small.jpg","type":"image\/jpeg"}],"author":"Mark","twitter_card":"summary_large_image","twitter_creator":"@marketaylor","twitter_misc":{"Written by":"Mark","Estimated reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/marketaylor.synology.me\/?p=1004#article","isPartOf":{"@id":"https:\/\/marketaylor.synology.me\/?p=1004"},"author":{"name":"Mark","@id":"https:\/\/marketaylor.synology.me\/#\/schema\/person\/2d6f4113ff54187023e20c20186bbb3c"},"headline":"Controlling queue creation","datePublished":"2021-10-18T14:09:12+00:00","dateModified":"2021-10-18T14:09:14+00:00","mainEntityOfPage":{"@id":"https:\/\/marketaylor.synology.me\/?p=1004"},"wordCount":743,"commentCount":0,"image":{"@id":"https:\/\/marketaylor.synology.me\/?p=1004#primaryimage"},"thumbnailUrl":"https:\/\/marketaylor.synology.me\/wp-content\/uploads\/2021\/10\/padlock-small.jpg","keywords":["authorisation","ibmmq","mqseries","OAM","security"],"articleSection":["IBM MQ"],"inLanguage":"en-GB","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/marketaylor.synology.me\/?p=1004#respond"]}]},{"@type":"WebPage","@id":"https:\/\/marketaylor.synology.me\/?p=1004","url":"https:\/\/marketaylor.synology.me\/?p=1004","name":"Controlling queue creation - Mark Taylor's Blog","isPartOf":{"@id":"https:\/\/marketaylor.synology.me\/#website"},"primaryImageOfPage":{"@id":"https:\/\/marketaylor.synology.me\/?p=1004#primaryimage"},"image":{"@id":"https:\/\/marketaylor.synology.me\/?p=1004#primaryimage"},"thumbnailUrl":"https:\/\/marketaylor.synology.me\/wp-content\/uploads\/2021\/10\/padlock-small.jpg","datePublished":"2021-10-18T14:09:12+00:00","dateModified":"2021-10-18T14:09:14+00:00","author":{"@id":"https:\/\/marketaylor.synology.me\/#\/schema\/person\/2d6f4113ff54187023e20c20186bbb3c"},"description":"IBM MQ's rules on object creation are usually ok, but maybe you'd like granular control of names. This OAM add-on shows how it is possible.","breadcrumb":{"@id":"https:\/\/marketaylor.synology.me\/?p=1004#breadcrumb"},"inLanguage":"en-GB","potentialAction":[{"@type":"ReadAction","target":["https:\/\/marketaylor.synology.me\/?p=1004"]}]},{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/marketaylor.synology.me\/?p=1004#primaryimage","url":"https:\/\/marketaylor.synology.me\/wp-content\/uploads\/2021\/10\/padlock-small.jpg","contentUrl":"https:\/\/marketaylor.synology.me\/wp-content\/uploads\/2021\/10\/padlock-small.jpg","width":282,"height":188,"caption":"padlock"},{"@type":"BreadcrumbList","@id":"https:\/\/marketaylor.synology.me\/?p=1004#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/marketaylor.synology.me\/"},{"@type":"ListItem","position":2,"name":"Controlling queue creation"}]},{"@type":"WebSite","@id":"https:\/\/marketaylor.synology.me\/#website","url":"https:\/\/marketaylor.synology.me\/","name":"Mark Taylor's Blog","description":"Messaging, Music and Moving Around","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/marketaylor.synology.me\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-GB"},{"@type":"Person","@id":"https:\/\/marketaylor.synology.me\/#\/schema\/person\/2d6f4113ff54187023e20c20186bbb3c","name":"Mark","image":{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/secure.gravatar.com\/avatar\/9a5ae091c43730194cba7cabb5d65c1dc3f48d05caaddec6ff2319a1ce66376f?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/9a5ae091c43730194cba7cabb5d65c1dc3f48d05caaddec6ff2319a1ce66376f?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/9a5ae091c43730194cba7cabb5d65c1dc3f48d05caaddec6ff2319a1ce66376f?s=96&d=mm&r=g","caption":"Mark"},"sameAs":["https:\/\/x.com\/marketaylor"],"url":"https:\/\/marketaylor.synology.me\/?author=1"}]}},"jetpack_featured_media_url":"https:\/\/marketaylor.synology.me\/wp-content\/uploads\/2021\/10\/padlock-small.jpg","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/marketaylor.synology.me\/index.php?rest_route=\/wp\/v2\/posts\/1004","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/marketaylor.synology.me\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/marketaylor.synology.me\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/marketaylor.synology.me\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/marketaylor.synology.me\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1004"}],"version-history":[{"count":5,"href":"https:\/\/marketaylor.synology.me\/index.php?rest_route=\/wp\/v2\/posts\/1004\/revisions"}],"predecessor-version":[{"id":1011,"href":"https:\/\/marketaylor.synology.me\/index.php?rest_route=\/wp\/v2\/posts\/1004\/revisions\/1011"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/marketaylor.synology.me\/index.php?rest_route=\/wp\/v2\/media\/1007"}],"wp:attachment":[{"href":"https:\/\/marketaylor.synology.me\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1004"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/marketaylor.synology.me\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1004"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/marketaylor.synology.me\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1004"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}