Chapter 6. Security 155
6.7.2  Security systems other than SAF (z/OS only)
The sample that is provided with the Content Manager OnDemand installation is an SAF 
sample. However, other installations use their own security system or use their security 
system as an enhancement together with the SAF environment. These systems can be 
accessed if they provide a correct assembler callable interface. The security exit sample code 
contains an example for every function. These functions can be changed or updated in the 
sample code. 
For example, if your folder permissions are stored in an external security system without any 
SAF interface, this part must be updated to call this external security system. 
Content Manager OnDemand SAF resource classes
Y ou must define SAF resource classes ARS1FLDR and ARS1APGP for the folders and 
application group. For more information about the resource classes, see the section, 
“OnDemand SAF resource classes”, in the IBM Content Manager OnDemand for z/OS - 
Configuration Guide, SC19-3363. 
Activating the security and permission exits (ARS.INI)
Activation of the security exit is controlled by settings in the ARS.INI file. The settings and their 
corresponding events are listed in Table 6-3.
Table 6-3   ARS settings and the corresponding enabled events
Implementing the security exit in a z/OS environment
The module ARSUSECX interfaces with the MVS Dynamic Exit Facility:
/SM590000It defines the logical exit point name, ARS.SECURITY.
/SM590000It routes the control to a set of associated exit routines and processes the results of their 
execution.
Important: Even if the security exit can check the user ID and password against SAF or 
other security systems, every user must be defined in Content Manager OnDemand in 
every instance. Y ou can use the ARSXML program to create users in batch mode, and use it 
as a command from the UNIX System Services command line and use a file as input.
ARS.INI statement Enabled event
SRVR_FLAGS_SECURITY_EXIT=1
(This setting is the default for Content Manager 
OnDemand for i. If you do not want to use IBM i 
security for the new instance, change the security 
setting to 0.)
Logon.
Changing the password.
Adding or deleting a user ID through the Content 
Manager OnDemand administrator interface.
SRVR_FLAGS_FOLDER_APPLGRP_EXIT=1 Activates the folder or the application group 
permission.
SRVR_FLAGS_SQL_QUERY_EXIT=1 Activates the SQL query exit.
SRVR_FLAGS_DOCUMENT_EXIT=1 Activates the document permission exit.
Note: The sample processes the feedback of the exit one at a time, even if you are 
running more than one exit.