Allowlisting in WebSphere Application Server

How you use IBM® MQ classes for JMS allowlisting in WebSphere® Application Server.

Important:

Wherever possible, the term allowlist has replaced the term whitelist. [MQ 9.2.1 Dec 2020] For IBM MQ 9.0 and later releases, this includes the Java system property names mentioned in this topic (com.ibm.mq.jms.*). You do not have to change any existing configuration. The previous system property names also continue to work.

You must ensure that your WebSphere Application Server installation includes a version of the IBM MQ resource adapter that supports allowlisting.

See Using IBM MQ and WebSphere Application Server together for further information on using the two products.

IBM MQ 9.0.0 Fix Pack 1 onwards include the appropriate functionality.

Once the application server has been updated, you can use the Java system properties:

-Dcom.ibm.mq.jms.allowlist
-Dcom.ibm.mq.jms.allowlist.discover

described in Setting up and using a JMS allowlist.

Note: You need to set the Java system properties as generic JVM arguments, on the Java virtual machine used to run the application server, and the application server restarted for the changes to take effect.

See the section on Generic JVM arguments in Java virtual machine settings for more information.

To set the properties, go to the Java virtual machine window in Process definitions and enter the appropriate argument.

The following setting:

-Dcom.ibm.mq.jms.allowlist=<youruserId>_MyObject

causes the application server to use the allowlist youruserId_MyObject. Only objects of the type are processed by the application server.

The following settings:

-Dcom.ibm.mq.jms.allowlist.discover=true
-Dcom.ibm.mq.jms.allowlist=file:C/:allowlist.txt

configure the application server to use Discover mode, and record details of the JMS ObjectMessages, that the application server processes, to the file C:\allowlist.txt

The following setting:

-Dcom.ibm.mq.jms.allowlist=file:C/:allowlist.txt

causes the application server to load the file C:/allowlist.txt, and use the information in that file to determine the allowlist.