Chapter 6. Security 147
Y ou can select the following scopes:
/SM590000View: Lets the user view annotations.
/SM590000Add: Lets the user add annotations to documents.
/SM590000Delete: Lets the user delete annotations.
/SM590000Update: For text annotations, lets the user update the location of an annotation on the 
page (by dragging the annotation marker to a new spot on the page). For graphical 
annotations, this scope lets the user update the various characteristics of an annotation.
/SM590000Copy: For text annotations, lets the user copy the text of an annotation to the clipboard.
6.5.5  Securing access with ARSSTASH and the stash file
Use the stash files and the ARSSTASH command to securely store and pass a password to 
Content Manager OnDemand commands without the passwords appearing in the clear 
(unencrypted text). The ARSSTASH command is used to encrypt the password by using 
Advanced Encryption Standard (AES)-128 encryption and storing it in a file that is called a 
stash file (an encrypted password file). The path to that stash file is then specified with the -p 
parameter to those commands that require a password. The stash file is retrieved and 
decrypted, and the password that is stored in the stash file is used. Therefore, the -p 
parameter that is stored in JCL or other scripts or programs does not need to contain a clear 
text password. 
Special case for z/OS and IBM i
If you are using a z/OS server, consider using the z/OS unified login mechanism instead of 
the stash file. Unified login provides the same functionality as stash files, which means that 
the passwords are not stored unencrypted when at rest (for example, in JCL or scripts) but 
without the additional burden of managing stash files. For example, when a password is 
changed for a user, stash files that contain the encrypted password for that user must also be 
changed.
If you are using an IBM i server, you might not need to use stash files because if you are 
signed on to the IBM i server with a user profile that is defined to Content Manager 
OnDemand and that has enough authority to perform the function you are running, Content 
Manager OnDemand uses the IBM i user profile for that function (such as ARSDOC or ARSLOAD). 
The -u and -p parameters are not required, therefore relieving you of the need to show or 
store a password in clear text.
Accessing the stash file
Access to the stash file must be restricted by using file system permissions and other security 
as appropriate. The stash file that is used by an instance is specified in the ARS.INI file (or in 
the registry on Windows) with the SRVR_OD_STASH parameter, for example:
SRVR_OD_STASH=/opt/IBM/ondemand/V9.5/config/ars.stash
Multiplatforms: Stash files are the method of choice for securely storing passwords on a 
Content Manager OnDemand for Multiplatforms server. Unified login does not work when 
you use a Content Manager OnDemand for Multiplatforms server. Therefore, stash files 
are the only mechanism that is provided to prevent passwords from being specified in 
“clear text” for the various Content Manager OnDemand commands that require 
passwords.