View JMS messages wls 10.3

Question

Hello
I m trying to view/delete jms messages in a queue in WLS 10.3. As Administrator user I m able to view/delete the messages but when logged as an user of Monitors group I m not even able to view the messages.
Is there any other user group apart from Administrator which can view messages in WLS 10.3. Please help
Thanks
Kranthi

Answer 1

Tom,
You are correct, I m able to view messages as Monitors group ID even from Hermes.
To check from console I had to update the weblogic.management.runtime.JMSDestinationRuntimeMBean security.
Here the steps I got from support to enable operations on JMSDestinationruntime mbean:
1.     In the left pane, select Security Realm.
2.     Select “myrealm”.
3.     In “Configuration” tab, check “Use Authorization Providers to Protect JMX Access”, click save and then activate changes.
4.     Restart the server.
5.     In the left pane, select Security Realm.
6.     Select “myrealm”.
7.     Go to “Users and Groups”.
8.     In users, create a new user say “queueuser”, add it to group “Monitors”
9.     Adding it to group “Monitors”:
a.     Select “myrealm”.
b.     Select “Users and Groups”.
c.     Click on user name, in right pane select “Groups”.
d.     From Parent Groups, select monitors, click arrow pointing right side.
10.     Go to “Roles and Policies” - > Realm Policies
11.     In Policy table, select “JMX Policy Editor”.
12.     Select “Global Scope”, click next.
13.     From MBean Types, select “weblogic.management.runtime”
14.     Select “JMSDestinationRuntimeMBean”, click next.
15.     In Attributes and Operations, select “Operations: Permission to Invoke”.
16.     Click on “Create Policy” button and save
17.     Click on “Add Condition”, Select “Group” in “Predicate List”, click next, type Monitors, say add. Click “Finish”.