Safeguard Reference Manual (G06.29+, H06.08+, J06.03+)

Event-Exit-Process Commands
Safeguard Reference Manual — 520618-030
15 - 32
User Database Synchronization
If the password-quality request is from an undeniable user when a timeout occurs, the
request is removed from the outstanding queue, and the attempt is allowed to proceed
with the Safeguard software performing the password-quality check. Super-group
members are considered undeniable users. An EMS message indicates an undeniable
user has timed out, thereby prompting the undeniable user to disable the
malfunctioning event-exit process.
If the password-quality request is from a deniable user when a timeout occurs, the
attempt is denied. An EMS message indicates a deniable user has timed out, thereby
indicating a problem with the event-exit process.
User Database Synchronization
The event-exit process is responsible for synchronization between its own user
database and the Safeguard user database. To maintain consistency between the two
databases, the user files need to be synchronized in these situations:
•
During system startup (The event-exit user files must be initialized from the
Safeguard user files.)
•
When Safeguard user and alias authentication records are added or altered
•
When user records are added or altered in the event-exit database
•
When passwords are changed during authentication dialog with the event-exit
process
•
After the event-exit process has been stopped
General Procedure
Except for reading the Safeguard password field, all of these synchronization efforts
can be handled with the following Safeguard SPI commands: ADD USER/ALIAS,
ALTER USER/ALIAS, and INFO USER/ALIAS. Passwords must be handled in a more
complex manner, described in
Password Synchronization on page 15-33.
The event-exit process is responsible for propagating to the Safeguard database any
changes that occur within its database. This can be accomplished using Safeguard SPI
or a SAFECOM script.
To propagate changes from the Safeguard user database to the event-exit user
database, the event-exit process must load its database using SPI INFO requests. This
provides all information except passwords.
To remain synchronized with the Safeguard database, the event-exit process must poll
the Safeguard database at reasonable intervals. The event-exit process must
determine if new users have been added since the last polling. It also must check the
last modified date in each user record to determine if the record matches that of the
corresponding user in its own database. If a user record has changed, the event-exit
process must collect the new information and mark the user in its own database if the
password has changed.