Safeguard Reference Manual (G06.29+, H06.08+, J06.03+)

Event-Exit-Process Commands
Safeguard Reference Manual — 520618-030
15 - 33
Event-Exit Design, Management, and Operation
Similarly, if the event-exit was disabled while the Safeguard subsystem was running,
the event-exit process must poll the Safeguard database for changes.
Password Synchronization
The basic premise for database synchronization is that the event-exit process is
responsible for keeping passwords synchronized in the two user databases.
Safeguard passwords are stored in an encrypted form, and HP does not export its
encryption algorithm. The USER_AUTHENTICATE_ procedure is available to allow the
caller to validate a password against the Safeguard user database.
For the Safeguard subsystem to accept passwords from the event exit, it must be
configured in a manner consistent with the event exit’s password management. For
example, if the event-exit process is not applying the Safeguard password rules, the
password rules in the Safeguard configuration must be disabled. Otherwise,
passwords that are valid for the event exit are rejected when an attempt is made to file
them in the Safeguard database.
One way to synchronize passwords is to require that all users change passwords at
initial logon. The event-exit process can authenticate these users the first time through
the database by calling the USER_AUTHENTICATE_ procedure in Authenticate Only
mode at authentication time. Once a user is authenticated, the event-exit process can
either store the entered password or force a password change. Turn off the
AUTHENTICATE-FAIL-FREEZE and AUTHENTICATE-FAIL-TIMEOUT Safeguard
configuration attributes during this authentication. Because USER_AUTHENTICATE_
checks these attributes, they might interfere with updates during password
synchronization.
If the event-exit process collects a new password during a logon dialog, it can send the
new password in a message response to the Safeguard database when authentication
is complete. This allows the user databases to remain synchronized. If the password is
not propagated to the Safeguard database, the user cannot log on if the event-exit
process becomes disabled and authentication is performed by the Safeguard software.
You can force all password changes to be processed by the
event-exit process. To do
this, set ENABLE-PASSWORD-EVENT to ON to force all password change attempts
through the password-quality exit. Then design the password-quality exit so that it
rejects all attempts. This approach forces users to change their passwords during
authentication. If the event-exit process handles authentication, it can capture all
password changes, assuming the Safeguard software is running.
Event-Exit Design, Management, and Operation
The design of an event-exit process must adhere to these general requirements:
•
The event-exit process must be multithreaded (able to handle multiple concurrent
requests).