152 IBM Content Manager OnDemand Guide
6.7.1  User security and permissions exits 
Content Manager OnDemand provides a user exit so that you can implement your own user 
exit program to identify and authenticate users that log on to the system. If you use only 
Content Manager OnDemand internal security, the security exit is not needed.
Y ou can use the security user exit to authenticate a user’s password. For example, you might 
want to enforce a sort of password uniqueness or allow logons to occur only at specific times 
in the day. Y ou can also build a user proxy mechanism to allow users that are not already in 
the Content Manager OnDemand user database to access the system.
The permissions exit is called during login if the permissions exit is turned on for folder and 
application groups. It is also called during a search when the permissions exit is turned on for 
an SQL query string or document.
Use the user security exit and the permissions exit to augment the security-related 
processing of the following activities or events: 
/SM590000User authentication (checking user security):
– Log on.
– Change a password.
– Add a user ID.
– Delete a user ID.
/SM590000Resource authorization (checking user permissions):
– Access to a Content Manager OnDemand folder.
– Access to a Content Manager OnDemand application group.
– Restrict access to specific documents.
– Control the SQL search criteria that are used for searching folders.
The user-written exit routine (or set of exit routines) can interact with another security system 
to determine whether the activity is allowed or disallowed.
When you set the user security exit, set the following parameters:
/SM590000Set the Maximum Password Age parameter to the value that best matches the main logic 
of the user exit program (permit/deny). The Maximum Password Age parameter is set on 
the System Parameters dialog box, which is accessed by using the Administrator Client.
/SM590000Set the Maximum Password Age parameter to Never Expires so that users are not 
prompted to change their passwords. If you are restricting the change password function 
to a limited number of users, this setting is probably the best overall setting because most 
users are never automatically prompted to change their password.
Important: When you implement your own security user exit program, you bypass the 
logon verification processing that is built into the base Content Manager OnDemand 
product. We advise caution when you bypass the Content Manager OnDemand user and 
password restrictions. The security of the system can easily be subverted by malicious or 
defective code. Only use code that you trust.