This blog talks about behavior of ‘dmpmqaut -e’ when there is a profile with authority ‘none’. Recently I had been working on a problem in which I had a query from customer asking about this. Therefore, I thought writing a blog would benefit the folks who want to know about this behavior in detail.
You must be knowing about dmpmqaut command. It is used to dump the authorization for the various MQ objects. If you are new to dmpmqaut, you could refer here.
‘dmpmqaut -e’ displays all profiles used to calculate the cumulative authority that the entity has to the object specified in the profile.
Why “dmpmqaut -e” does not output profile with authority ‘none’
Consider we have a group which has authority ‘none’ on a queue profile APP.REPLY, which means this group doesn’t have any authorities like dsp, crt, etc on queue APP.REPLY.
Running dmpmqaut against the group without ‘-e’ shows the fully qualified queue profile which now has authority ‘none’ as below.
$ dmpmqaut -m QMGRNAME -t q -n APP.REPLY -g groupname
profile: APP.REPLY
object type: queue
entity: groupname
entity type: group
authority: none
Running dmpmqaut against the group with ‘-e’ will show “No matching authority records” for the queue specified as below.
$dmpmqaut -m QMGRNAME -t q -n APP.REPLY -g groupname -e
No matching authority records.
As we know ‘dmpmqaut -e’ displays all profiles used to calculate the cumulative authority that the entity has to the object specified, you may expect that it would output the profile with authority ‘none’.
However, records with an authority of none are not returned by ‘dmpmqaut -e’ as they do not contribute to the total authority the entity has to the object and therefore they do not contribute to the calculation of the cumulative authority as well.