154 IBM Content Manager OnDemand Guide
With the ARCCSXIT_SECURITY_OKAY_BUT_VALIDATE_IN_OD return code option, a user can act on 
a request and then the option allows Content Manager OnDemand to perform the standard 
security processing. For example, do not allow a new password to match an old password in a 
change-password request; the password must be changed.
Table 6-2 lists the z/OS modules or executable files that ship with Content Manager 
OnDemand.
Table 6-2   Security exit modules
All modules are in the SARSINST library. The sequence of this exit, using the MVS Dynamic 
Exit Facility, is different from the classical interface with exit modules or a security exit in an 
IBM CICS environment. The kernel code was updated to allow external security. The Content 
Manager OnDemand kernel code calls a dynamic link library (DLL) as an interface to the exit. 
Modules ARSUSEC and ARSUPERM are provided as C source code modules and as 
executable files. Y ou do not need to change and recompile them. 
The source is delivered mainly for understanding the entire security system exit. If you want to 
change the modules, they must be recompiled and bound as a C dynamic link library (DLL). 
These modules communicate with the ARSUSECX module, which is an interface to the MVS 
Dynamic Exit Facility. The security exit module ARSUSECZ is the delivered sample that 
shows how to perform security checks with a Security Exit Facility (SAF) interface. RACF is a 
program that uses SAF . ARSUSECH is a C source code module that passes the data 
structure as input for every exit (ARSUSECZ) that is provided. ARSUSEA provides the same 
function in assembler language.
Module Description
ARSUPERM This c-module provides the interface between the Content Manager OnDemand 
system and the ARSUSECX module.
ARSUSEC This c-module provides the interface between the Content Manager OnDemand 
system and the ARSUSECX module.
ARSUSECA The mapping of the data structure that is presented to the exit routine is associated 
with the exit point that is defined by ARSUSEC in assembler.
ARSUSECH The mapping of the data structure that is presented to the exit routine is associated 
with the exit point that is defined by ARSUSEC in C.
ARSUSECJ This sample JCL stream is for assembling and binding ARSUSECX and ARSUSECZ.
ARSUSECX This interface module is for the MVS Dynamic Exit Facility.
ARSUSECZ This module is the Security Exit Module Sample.
Note: More than one security exit can be defined to the MVS Dynamic Exit Facility. For 
example, you can define a different security exit for each instance.
Tip: The only module that you must change is the provided source code ARSUSECZ to 
meet your requirements. It must be assembled and linked into a library that is accessible 
for the MVS Dynamic Exit Facility.