Safeguard Reference Manual (G06.29+, H06.08+, J06.03+)

Event-Exit-Process Commands
Safeguard Reference Manual — 520618-030
15 - 31
Processing of Password-Quality Requests
I/O errors can occur when the event-exit process halts before responding to a request,
or when it is enabled but down or restarting and the open is incomplete. In these
instances, all user requests are denied. EMS messages identify these errors.
If the event-exit process is disabled while an authentication request is pending, the
request is allowed to complete, providing it does so within the timeout interval. If a
timeout occurs, the request is denied.
If invalid data is returned in a reply from the event-exit process, the request is denied,
and an EMS message identifies the problem.
Auditing of Authentication Events
If the Safeguard software is configured for auditing of user authentication attempts,
audit records are generated for authentication events.
Processing of Password-Quality Requests
When ENABLE-PASSWORD-EVENT is ON, certain password-change events are
routed to the event-exit process. The password-quality exit allows passwords to be
subjected to custom validation. Rules that supplement the Safeguard password
controls can be applied to password validation. If password rules are disabled in the
Safeguard configuration record, validation by the password-quality exit effectively
replaces Safeguard password controls.
The password-quality exit is separate from the authentication-exit, and it is not invoked
by the Safeguard software during an authentication event. Its sole purpose is password
validation. To make use of the password-quality exit during authentication, the
authentication process must be written so that it calls or incorporates the logic of the
password-quality exit.
The $ZSMP process receives password requests from the PASSWORD program when
a password is created or changed. It also receives these requests from the following
Safeguard commands: ADD USER, ALTER USER, ADD ALIAS, and ALTER ALIAS.
The $ZSMP routes these requests to the event-exit process if ENABLE-PASSWORD-
EVENT is ON. If ENABLE-AUTHENTICATION-EVENT is OFF when ENABLE-
PASSWORD-EVENT is ON, the $ZSMP also sends password changes that occur
during interactive logon dialog.
The event-exit process can only accept or deny the password. It can also send a
message to accompany the acceptance or denial. The event-exit process cannot
return generated passwords and engage in additional dialog for this event.
Timeout Policy for Password-Quality Requests
If the event-exit process does not respond to a request within the configured time
interval, $ZSMP assumes that a problem has occurred and continues processing as
follows.