Safeguard Reference Manual (G06.29+, H06.08+, J06.03+)

Event-Exit-Process Commands
Safeguard Reference Manual — 520618-030
15 - 30
Processing of Authentication Requests
The event-exit process is responsible for prompting the user for verification of a new
password and for storing passwords in its own database. If a new password is
collected by the event-exit process, it can inform the Safeguard subsystem of this
change after authentication is complete. For more information, see User Database
Synchronization on page 15-32.
Processing of Programmatic Authentication
In programmatic logon attempts, a process provides the logon input and authentication
request in a call to VERIFYUSER or USER_AUTHENTICATE_. This input is forwarded
to the Safeguard $ZSMP process, which in turn routes it to the event-exit process for
evaluation.
Programmatic logon attempts handled by VERIFYUSER do not support an
authentication dialog or password generation. When the Safeguard software passes
this request to the event-exit process, it includes an indicator noting that this attempt is
incapable of engaging in a dialog. The event-exit process can only grant or deny the
authentication request.
Logon^Abort Processing
A Logon^Abort can occur during the processing of either an interactive or
programmatic authentication attempt. The $ZSMP process sends a Logon^Abort
message to the event-exit process if either of these events occurs:
•
At a Safeguard terminal, the user presses the BREAK key, or an I/O error occurs
during the logon dialog.
•
During a logon attempt processed by USER_AUTHENTICATE_, the logon dialog
times out because it takes longer than two minutes to complete. (The user takes
too long to supply input.)
Logon^Abort is indicated by the Event_Type field in the Header_Data message sent
from $ZSMP. The event-exit process checks the Message_Tag field in this message to
determine which logon session aborted. The purpose of this message is to allow the
event-exit process to deallocate the resources it allocated to process the authentication
attempt.
Timeout Policy for Authentication
If the event-exit process does not respond to a request within the configured time
interval, $ZSMP denies the authentication request. An EMS message indicates a user
has timed out, thereby indicating a problem with the event-exit process.
Other Error Handling for Authentication
Other problems that cause timeout behavior are I/O errors, disabling of the event exit,
and invalid data received from the event-exit process.