OSI/FTAM Configuration and Management Manual

Planning, Installing, and Configuring Tandem FTAM
OSI/FTAM Configuration and Management Manual—421944-001
3-20
Logon Access
If you configure the DEFUSER attribute with a user ID but omit the password,
associations with the responder succeed only if the specified user ID has no associated
Guardian password.
If you do not configure the DEFUSER attribute, all applications attempting to use the
responder process must first specify a valid Guardian user ID and password (as the
initiator identity and filestore password in the F-INITIALIZE request) before access is
allowed. This provides a security feature that allows you to control which remote users
can have access to which files on your system.
Table 3-1
shows the interaction between the user ID and password (initiator identity and
filestore password) in the F-INITIALIZE indication and the user ID and password in the
DEFUSER attribute. The table gives an example of each combination. Note that some
combinations cause the request to be rejected immediately—for example, if the
F-INITIALIZE indication provides a filestore password but no initiator identity. The
user ID can be either a pair of numbers (for example, 33, 17) or a Guardian username
(such as OSI.USER). For readability, the table shows the sample user IDs in username
form.
For those instances in which a user ID and password appears in the Responder Uses
column, the responder submits that user ID and password to the operating system (or to
the Safeguard security software, if used) for verification. The user ID must follow the
rules for a Guardian user ID or username, and the password must be a valid Guardian
password, as described in the Guardian User’s Guide; otherwise, the request is rejected.
The request is also rejected if the user ID is not known on the local system, or if the
given password does not match the password associated with that user on the local
system.
If the request is rejected for any of the reasons given above, the responder generates an
EMS event message indicating that an invalid initiator ID or password was sent in an
F-INITIALIZE request. The event message identifies the responder, the VFS profile, the
user ID specified, and the address of the initiator that sent the request.
If the request is successful, the operating system uses the user ID given in the Responder
Uses column for all file-access requests on that association.
Table 3-1. User ID and Password Used by the Tandem Responder
F-INITIALIZE Indication
User ID Password DEFUSER Responder Uses
Not set Not set Not set Request rejected
NEWYORK.USER Not set Not set NEWYORK.USER, (blank)
Not set “foo” Not set Request rejected
NEWYORK.USER “foo” Not set NEWYORK.USER, “foo”
Not set Not set LONDON.RESP, “x” LONDON.RESP, “x”
NEWYORK.USER Not set LONDON.RESP, “x” NEWYORK.USER, (blank)
Not set “foo” LONDON.RESP, “x” Request rejected
NEWYORK.USER “foo” LONDON.RESP, “x” NEWYORK.USER, “foo”