Flagging messages as "Not Visible"

Question

Hi All,
When monitoring JMS destinations, you can see messsages waiting for delivery. You can even take a look at the message content. In the "WebLogic Advanced Admin" course, they say "Developer can flag sensitive messages as not visible". Can you please provide a little code sample explaining how it's done?
Thanks

Answer 1

I think all you may need to do is setup general "browse" restrictions on the queue itself. It may also be possible to set restrictive security permissions on the specific mbean calls that the console uses to view the messages. I've appended some notes that might help. While these notes are focused more on reducing restrictions rather than increasing them, I assume the general steps apply either way.
HTH,
Tom
JMX (mbean/console) Security
Limiting Access to Monitoring Beans
Message Management (JMSDestinationRuntimeMBean and JMSDurableSubscriberRuntimeMBean)
By default, only an administrator can view messages and their contents on the console (because the console uses mbean invocation APIs to view the messages, which require admin privileges).
The security settings of a protected destination (one with a role requirement for browse, send, or receive) also apply. This means that one would need both the admin role, plus the role configured for the destination. The following is a list of operations that extra security checking is performed at the JMS layer besides necessary MBean level security checking.
getMessage/getMessages: Browse permission
moveMessages (from one destination to another): Browse and Receive permission
deleteMessages: Receive permission
ImportMessages: Send permission
If you need finer grained security for queue message management (but not topics), then one option is use a tool that uses standard javax.jms API calls to view messages instead of mbean APIs -- in which case security checks are based on the arbitrary required roles that you've (optionally) configured on the destinations. One such tool might be "HermesJMS".
Another option is to lower the security requirements on the JMSDestinationRuntime mbean. Be careful, because the message management functions can not only simply view the messages, they also may be able to delete or move messages. Steps:
1. In the left pane, select Security Realm.
2. Select myrealm.
3. In Configuration tab, check Use Authorization Providers to Protect JMX Access, click save and then activate changes.
4. Restart the server.
5. In the left pane, select Security Realm.
6. Select myrealm.
7. Go to Users and Groups.
8. In users, create a new user say queueuser, add it to group Monitors
9. Adding it to group Monitors:
a. Select myrealm.
b. Select Users and Groups.
c. Click on user name, in right pane select Groups.
d. From Parent Groups, select monitors, click arrow pointing right side.
10. Go to Roles and Policies - > Realm Policies
11. In Policy table, select JMX Policy Editor.
12. Select Global Scope, click next.
13. From MBean Types, select weblogic.management.runtime
14. Select JMSDestinationRuntimeMBean click next.
15. In Attributes and Operations, select Operations: Permission to Invoke.
16. Click on Create Policy button and save
17. Click on Add Condition, Select Group in Predicate List, click next, type Monitors, say add. Click Finish.