Authority to administer WebSphere MQ

WebSphere MQ administrators have authority to perform the following tasks:

• Use commands (including the commands to grant WebSphere MQ authorities for other users)
• Access the snap-ins on WebSphere MQ for Windows

To be a WebSphere MQ administrator, you must be a member of a special group called the mqm group (or a member of the Administrators group on Windows systems; see below). The mqm group is created automatically when WebSphere MQ is installed; add further users to the group to allow them to perform administration (including the root user on UNIX systems). All members of this group have access to all resources. This access can be revoked only by removing a user from the mqm group.

On UNIX platforms, a special user ID of mqm is also created, for use by the product only. It must never be available to non-privileged users. All WebSphere MQ objects are owned by user ID mqm.

On Windows systems, members of the Administrators group can also administer any queue manager. You can also create a domain mqm group on the domain controller that contains all privileged user IDs active within the domain, and add it to the local mqm group. Some commands, for example crtmqm, manipulate authorities on WebSphere MQ objects and so need authority to work with these objects (as described below). Members of the mqm group have authority to work with all objects, but there might be circumstances on Windows systems when authority is denied if you have a local user and a domain-authenticated user with the same name. This is described in Principals and groups.

You do not need to be a member of the mqm group to do the following:

• Issue commands from an application program that issues PCF commands, or MQSC commands within an Escape PCF command, unless the commands manipulate channels, channel initiators, or channel listeners. (These commands are described in Channel security).
• Issue MQI calls from an application program (unless you want to use the fastpath bindings on the MQCONNX call).
• Use the crtmqcvx command to create a fragment of code that performs data conversion on data type structures.
• Use the dspmqtrc command to display WebSphere MQ formatted trace output.

Managing the mqm group

Security administrators add users who need to administer WebSphere MQ to the mqm group. This includes the root user on UNIX systems. They might also need to remove users who no longer need this authority. These tasks are described in Creating and managing groups.

If your domain controller runs on Windows 2000, your domain administrator might have to set up a special account for WebSphere MQ to use. This is described in the WebSphere MQ for Windows, V5.3 Quick Beginnings.