How to programmatically set Permission settings on private MSMQ queue for remote access?

2
votes

As part of an application I'm developing, Im trying to make use of Microsoft Message Queueing functionality and im having trouble with permission settings.

I want to create a queue and send messages to it on a server computer and access it from a client computer over the local network. Both computers (both Windows 7 Home Premium) are on the same LAN network and are able to ping to each other. I will know the exact path of the created queue, so I guess private queues are ok.

Im basing my code on this example and use IronPython to access the MessageQueue class from the System.Messaging namespace. The send & receive setup from the example works to create a queue and send it a message in one console:

>>> localQueue = MessageQueue.Create('.\\private$\\testQueue')
>>> localQueue.FormatName
'DIRECT=OS:<clientMachineName>\\private$\\testQueue'
>>> localQueue.Send('hello from other console')

and then access the queue and peek at it in another console by the following code:

>>> SemiRemoteQueue = MessageQueue('FormatName:Direct=OS:<clientMachineName>\\private$\\testQueue')
>>> SemiRemoteQueue.Peek()
<System.Messaging.Message object at 0x000000000000002F [System.Messaging.Message
]>

When I create a new queue on the server computer, I seem to be able to establish a connection from the client computer, but fail to get any message data from it. Peeking from client to queue created at server, gives the following 'Access denied' error message:

>>> ReallyRemoteQueue = MessageQueue('FormatName:Direct=OS:<serverMachineName>\\private$\\remoteTestQueue')
>>> ReallyRemoteQueue.Peek()
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
EnvironmentError: System.Messaging.MessageQueueException (0x80004005): Access to
 Message Queuing system is denied.
   at System.Messaging.MessageQueue.MQCacheableInfo.get_ReadHandle()
   at System.Messaging.MessageQueue.StaleSafeReceiveMessage(UInt32 timeout, Int3
2 action, MQPROPS properties, NativeOverlapped* overlapped, ReceiveCallback rece
iveCallback, CursorHandle cursorHandle, IntPtr transaction)
   at System.Messaging.MessageQueue.ReceiveCurrent(TimeSpan timeout, Int32 actio
n, CursorHandle cursor, MessagePropertyFilter filter, MessageQueueTransaction in
ternalTransaction, MessageQueueTransactionType transactionType)
   at System.Messaging.MessageQueue.Peek()
   at Microsoft.Scripting.Interpreter.FuncCallInstruction`2.Run(InterpretedFrame
 frame)
   at Microsoft.Scripting.Interpreter.Interpreter.Run(InterpretedFrame frame)
   at Microsoft.Scripting.Interpreter.LightLambda.Run3[T0,T1,T2,TRet](T0 arg0, T
1 arg1, T2 arg2)
   at IronPython.Compiler.Ast.CallExpression.Invoke0Instruction.Run(InterpretedF
rame frame)
   at Microsoft.Scripting.Interpreter.Interpreter.Run(InterpretedFrame frame)
   at Microsoft.Scripting.Interpreter.LightLambda.Run2[T0,T1,TRet](T0 arg0, T1 a
rg1)
   at IronPython.Compiler.PythonScriptCode.RunWorker(CodeContext ctx)
   at IronPython.Compiler.PythonScriptCode.Run(Scope scope)
   at IronPython.Hosting.PythonCommandLine.<>c__DisplayClass1.<RunOneInteraction
>b__0()

I've found that accessing remote private MSMQ queues should be possible, but can't figure out how to set the right permissions. I have allowed MSMQ in Firewall settings and even tried with firewall turned off. Found some discussion about applying permission settings to queue files but this doesn't help as I dont have queue files that have the security settings working for them. I haven't gotten round trying the option of given full access to 'Anonymous Logon' as has been suggested, but would eventually like to set permissions programmatically (in code), not in files' context menus. Should I use the SetPermissions method in the MessageQueing Class (http://msdn.microsoft.com/en-us/library/dd48yz36(v=vs.80))? How do I specify its parameters?

Thanks for any suggestions!

2
.netironpythonmsmqmessage-queue

2 Answers

3
votes

localQueue.SetPermissions("Everyone", MessageQueueAccessRights.FullControl, AccessControlEntryType.Allow);

"Everyone" could be any domain account e.g "Domain\MyUserName"

1
votes

You will need in the first instance to give the 'Anonymous Logon' the rights to receive messages from the queue.

I use this (C#) code for setting permissions which I found here:

AccessControlList acl = new AccessControlList();
Trustee owner = new Trustee(WindowsIdentity.GetCurrent().Name, Environment.MachineName, TrusteeType.User);
MessageQueueAccessControlEntry aceOwner = new MessageQueueAccessControlEntry(owner, MessageQueueAccessRights.FullControl);
acl.Add(aceOwner);
messageQueue.SetPermissions(acl);