Setting Up Security

Permissioning

Gems requires that the user supplied in the EMS connection information has administrator permissions.

Administrators are a special class of users that can manage the EMS server. Administrators can create, modify, and delete users, destinations, routes, factories, and other items. In general, administrators should be granted permission to perform administration activities, this can be achieved using the "Set Administrator Permissions" Dialog accessible via the Users menu, or by using the administration command line tool (tibemsadmin).

There is a special, predefined user named admin that can perform any administrative action. You cannot grant or revoke any permissions to admin. This user is created when the server is installed, and it is good practise to change the password for the admin user after installation.

There is also a special group named $admin for system administrator users. When a user becomes a member of this group, that user receives the same permissions as the admin user. You cannot grant or revoke administrator permissions from any user that is a member of the $admin group. You should only assign the overall system administrator(s) to the $admin group.

In general, all Gems users should not be given the admin password since this allow access to potentially harmful operations. A new user name(or user names) should be created and granted selected administrative permissions.

A list of administrative permissions of particular relevance to Gems users is shown in the table below. (Refer to the EMS Users Guide for a complete list.)

To set a user's administrator permissions in Gems select "Set Admin Permissions..." from the Users menu.


Permission Allows Users To
all Perform all administrative commands.
change-connection Delete connections.
create-destination Create any destination.
modify-destination Modify any destination.
delete-destination Delete any destination.
change-durable Modify server parameters.
change-user Create, delete, and modify users.
purge-destination Purge destinations.
purge-durable Purge durable subscribers.
view-all View any item that can be administered (for example, users, groups, topics, and so on).

Note: If you have created a new user name and assigned administrator permissions and you wish to use the destination monitoring features. You must also assign this user subscribe permission on the $sys.monitor topics. You can do this in Gems by using the "Set Topic Permissions" editor available in the Topics menu, or alternatively by editing the acl.conf file. For example, to allow monitoring of all queues that begin with foo.bar for user GEMSUSR add the following:

TOPIC=$sys.monitor.Q.*.foo.bar.> USER=GEMSUSR PERM=subscribe

To use the request reply monitor feature when replies are returned on temporary destinations you also need to grant subscribe permission to $TMP$'s, for example:

TOPIC=$sys.monitor.Q.*.$TMP$.> USER=GEMSUSR PERM=subscribe

For the same reason, if you wish to use the Event Monitor feature you must also assign this user subscribe permission to the $sys.monitor topics configured in the EventMonitor section in the servers.xml file. For example:

TOPIC=$sys.monitor.limits.*. USER=GEMSUSR PERM=subscribe
TOPIC=$sys.monitor.server.warning USER=GEMSUSR PERM=subscribe

View Only Mode

For user's who require view only access the ViewOnlyMode property in the gems.props file may be set to true. When Gems runs in view only mode menu entries and dialogs pertaining to non-view only operations are removed.

Note; if the ViewOnlyMode property is removed from the properties file the default is for view only mode to be enabled.

SSL

Gems can be configured to use SSL to connect to any EMS server. Parameters may be set using the SSLParam element within the ConnectionNode on the servers.xml file. Refer to com.tibco.tibjms.TibjmsSSL in the EMS documentation for all available SSL parameters. An example is shown below using the server cert distributed with the EMS samples.

<ConnectionNode alias="EMS-SERVER" url="ssl://localhost:7243" user="admin" password="" autoConnect="true">
    <SSLParam name="com.tibco.tibjms.ssl.trace" type="boolean" value="true" />
    <SSLParam name="com.tibco.tibjms.ssl.trusted_certs" type="string" value="C:\tibco\ems\5.1\samples\certs\server_root.cert.pem" />
    <SSLParam name="com.tibco.tibjms.ssl.expected_hostname" type="string" value="server" />
</ConnectionNode>

Note; for encryption only, server certificate verification must be disabled as shown below:

<ConnectionNode alias="EMS-SERVER" url="ssl://localhost:7243" user="admin" password="" autoConnect="true">
    <SSLParam name="com.tibco.tibjms.ssl.enable_verify_host" type="boolean" value="false" />
</ConnectionNode>

The following additional jar files must also be added to the CLASSPATH in the rungems.cmd file:

  slf4j-api-1.4.2.jar (slf4j-api-1.5.2.jar for EMS 8.3 or higher)
  slf4j-simple-1.4.2.jar (slf4j-simple-1.5.2.jar for EMS 8.3 or higher)

Encrypting Server Passwords

Use the Save Configuration dialog from the File menu to store configuration with encrypted server passwords.

For password encryption to be availabe the following jar files must be added to the CLASSPATH in the rungems.cmd file:

  tibcrypt.jar
  slf4j-api-1.4.2.jar (slf4j-api-1.5.2.jar for EMS 8.3 or higher)
  slf4j-simple-1.4.2.jar (slf4j-simple-1.5.2.jar for EMS 8.3 or higher)