Gems requires that the user supplied in the EMS connection information has administrator permissions.
Administrators are a special class of users that can manage the EMS server. Administrators can create, modify, and delete users, destinations, routes, factories, and other items. In general, administrators should be granted permission to perform administration activities, this can be achieved using the "Set Administrator Permissions" Dialog accessible via the Users menu, or by using the administration command line tool (tibemsadmin).
There is a special, predefined user named admin
that can perform any administrative action. You cannot grant or
revoke any permissions to admin
. This user is created when the server is installed, and it is good practise to
change the password for the admin
user after installation.
There is also a special group named $admin
for system administrator users. When a user becomes a
member of this group, that user receives the same permissions as the admin
user. You cannot grant or revoke
administrator permissions from any user that is a member of the $admin
group. You should only assign the overall
system administrator(s) to the $admin
group.
In general, all Gems users should not be given the admin password since this allow access to potentially harmful operations. A new user name(or user names) should be created and granted selected administrative permissions.
A list of administrative permissions of particular relevance to Gems users is shown in the table below. (Refer to the EMS Users Guide for a complete list.)
To set a user's administrator permissions in Gems select "Set Admin Permissions..." from the Users menu.
Permission | Allows Users To |
all | Perform all administrative commands. |
change-connection | Delete connections. |
create-destination | Create any destination. |
modify-destination | Modify any destination. |
delete-destination | Delete any destination. |
change-durable | Modify server parameters. |
change-user | Create, delete, and modify users. |
purge-destination | Purge destinations. |
purge-durable | Purge durable subscribers. |
view-all | View any item that can be administered (for example, users, groups, topics, and so on). |
Note: If you have created a new user name and assigned administrator permissions and you wish to use the destination monitoring features.
You must also assign this user subscribe permission on the $sys.monitor
topics. You can do this in Gems by using the "Set Topic Permissions" editor
available in the Topics menu,
or alternatively by editing the acl.conf
file. For example, to allow monitoring of all queues that begin with foo.bar
for user GEMSUSR
add the following:
TOPIC=$sys.monitor.Q.*.foo.bar.> USER=GEMSUSR PERM=subscribe
To use the request reply monitor feature when replies are returned on temporary destinations you also need to grant subscribe permission to $TMP$'s, for example:
TOPIC=$sys.monitor.Q.*.$TMP$.> USER=GEMSUSR PERM=subscribe
For the same reason, if you wish to use the Event Monitor feature you must also assign this user subscribe permission to the $sys.monitor
topics configured in the EventMonitor section in the servers.xml
file. For example:
TOPIC=$sys.monitor.limits.*. USER=GEMSUSR PERM=subscribe
TOPIC=$sys.monitor.server.warning USER=GEMSUSR PERM=subscribe
For user's who require view only access the ViewOnlyMode property in the gems.props file may be set to true. When Gems runs in view only mode menu entries and dialogs pertaining to non-view only operations are removed.
Note; if the ViewOnlyMode property is removed from the properties file the default is for view only mode to be enabled.
Gems can be configured to use SSL to connect to any EMS server. Parameters may be set using the SSLParam
element within the ConnectionNode
on the servers.xml
file. Refer to com.tibco.tibjms.TibjmsSSL
in the EMS documentation
for all available SSL parameters. An example is shown below using the server cert distributed with the EMS samples.
<ConnectionNode alias="EMS-SERVER" url="ssl://localhost:7243" user="admin" password="" autoConnect="true">
<SSLParam name="com.tibco.tibjms.ssl.trace" type="boolean" value="true" />
<SSLParam name="com.tibco.tibjms.ssl.trusted_certs" type="string" value="C:\tibco\ems\5.1\samples\certs\server_root.cert.pem" />
<SSLParam name="com.tibco.tibjms.ssl.expected_hostname" type="string" value="server" />
</ConnectionNode>
Note; for encryption only, server certificate verification must be disabled as shown below:
<ConnectionNode alias="EMS-SERVER" url="ssl://localhost:7243" user="admin" password="" autoConnect="true">
<SSLParam name="com.tibco.tibjms.ssl.enable_verify_host" type="boolean" value="false" />
</ConnectionNode>
The following additional jar files must also be added to the CLASSPATH in the rungems.cmd file:
slf4j-api-1.4.2.jar (slf4j-api-1.5.2.jar for EMS 8.3 or higher)
slf4j-simple-1.4.2.jar (slf4j-simple-1.5.2.jar for EMS 8.3 or higher)
Use the Save Configuration dialog from the File menu to store configuration with encrypted server passwords.
For password encryption to be availabe the following jar files must be added to the CLASSPATH in the rungems.cmd file:
tibcrypt.jar
slf4j-api-1.4.2.jar (slf4j-api-1.5.2.jar for EMS 8.3 or higher)
slf4j-simple-1.4.2.jar (slf4j-simple-1.5.2.jar for EMS 8.3 or higher)