Safeguard Reference Manual (G06.29+, H06.08+, J06.03+)

Event-Exit-Process Commands
Safeguard Reference Manual — 520618-030
15 - 4
ADD EVENT-EXIT-PROCESS Command
Locally authenticated super-group members are treated as undeniable and all
other users are considered as deniable.
ENABLE-AUTHENTICATION-EVENT { ON | OFF }
specifies whether authentication events are to be sent to the event-exit
process. ON indicates that the events are sent to the event-exit process when
it is enabled. For a complete list of events sent when ENABLE-
AUTHENTICATION-EVENT is ON, see Design Considerations on page 15-24.
For more information, see ENABLE-PASSWORD-EVENT { ON | OFF } on
page 15-4.
The default value is OFF. If you omit this attribute, it is set to the default value.
ENABLE-AUTHORIZATION-EVENT { ON | OFF }
specifies whether authorization events are to be sent to the event-exit process.
ON indicates that the events will be sent to the event-exit process when it is
enabled. For a complete list of events that are sent when ENABLE-
AUTHORIZATION-EVENT is ON, see Design Considerations on page 15-24.
The default value is OFF. If you omit this attribute, it is set to the default value.
ENABLE-PASSWORD-EVENT { ON | OFF }
specifies whether password change events are to be sent to the event-exit
process for a password-quality check. ON indicates that the events are sent to
the event-exit process when it is enabled.
If ENABLE-PASSWORD-EVENT is ON and ENABLE-AUTHENTICATION-
EVENT is also ON, password changes that occur during a logon dialog are not
sent to the password-quality exit. In this instance, the password-quality exit is
invoked only for password changes from the PASSWORD program and from
the Safeguard ADD USER, ALTER USER, ADD ALIAS, and ALTER ALIAS
commands.
If ENABLE-PASSWORD-EVENT is ON and ENABLE-AUTHENTICATION-
EVENT is OFF, all password change events are sent to the password-quality
exit for evaluation. For more information, see
Design Considerations on
page 15-24.
The default value is OFF. If you omit this attribute, it is set to the default value.
PROG [prog-filename]
specifies the name of the object program file to be run when the ENABLED
attribute is se
t to ON. It must be a local file name. prog-filename must be
specified before the ENABLED attribute can be set to ON.
Note. The TIMEOUT-ALL-AUTHZREQ attribute is supported only on systems running
H06.26 and later H-series RVUs and J06.15 and later J-series RVUs.