Safeguard Reference Manual (G06.29+, H06.08+, J06.03+)

Event-Exit-Process Commands
Safeguard Reference Manual — 520618-030
15 - 29
Processing of Authentication Requests
If the event-exit process responds NO to an access attempt, the failure is not audited in
Safeguard because the event exit and SMON auditing are not integrated. If the event-
exit process responds YES or NORECORD, the Safeguard subsystem rules on the
request, and auditing is performed as specified for the object.
Therefore, the basic concept in auditing is that if Safeguard is involved in the ruling,
auditing is applied as specified. If Safeguard is not involved in the ruling, no auditing is
performed.
Processing of Authentication Requests
When ENABLE-AUTHENTICATION-EVENT is ON, authentication requests are routed
to the event-exit process. Both interactive and programmatic logon authentication
requests are sent to the event-exit process. Unlike authorization events, the rulings on
these events are the sole responsibility of the event-exit process. The Safeguard
software does not participate in authentication rulings.
However, if the Safeguard subsystem is configured to communicate with the $CMON
process, it sends a prelogon message to $CMON and awaits a reply before routing the
authentication request to the event-exit process. $CMON has the option of denying the
logon attempt prior to authentication by the event-exit process. Similarly, if Safeguard
is configured to do so, it sends a logon message to $CMON after authentication
occurs. $CMON again has the option of denying the logon attempt even after the user
has been authenticated.
Processing of Interactive Authentication
For interactive logon attempts, a process such as TACL provides the logon input and
authentication request in a call to USER_AUTHENTICATE_. This input is forwarded by
USER_AUTHENTICATE_ to the Safeguard $ZSMP process, which in turn routes it to
the event-exit process for evaluation. If the interactive logon attempt occurs at a
Safeguard terminal, the Safeguard software captures the input directly, and $ZSMP
routes it to the event-exit process. USER_AUTHENTICATE_ is not involved when the
logon attempt occurs at a Safeguard terminal.
The event-exit process can approve or deny the logon request, or it can engage in a
challenge/response dialog before approving or denying
the request. Additionally, the
event-exit process can return a generated password as part of a password change
dialog. The Safeguard software does not check passwords or otherwise participate in
the authentication. It only routes messages between the event-exit process and
USER_AUTHENTICATE_. When the authentication is complete, the Safeguard
software updates the last logon time and logon failure count in the user’s record in the
Safeguard database. It also files the new password if a password change occurred and
the event-exit process requested filing of the password.
The password-quality exit is separate from the authentication exit, and it is not invoked
by the Safeguard software during an authentication event. For more information, see
Processing of Password-Quality Requests on page 15-31.