Chapter 6. Security 153
Content Manager OnDemand for Multiplatforms
The security user exit runs the ARSUSEC program when a user attempts to log on to the 
system. A sample C program is provided in the EXITS directory. To implement your own 
security user exit program, add your specific code to the sample that is provided (for example, 
you can call another program from the ARSUSEC program). For more information about 
functions, parameters, and return codes, see the ARSCSXIT.H file. Then, compile the ARSUSEC 
program and move or copy the executable program to the BIN directory. Then, restart the 
library server to use the security user exit program.
The arsuperm (permissions exit) can be modified in the same way and needs to be placed in 
the /opt/IBM/ondemand/V9.5/exits directory.
Content Manager OnDemand for i server
By default, the Content Manager OnDemand for i server activates the security exit and uses 
IBM i security. If the security exit is not enabled, the Content Manager OnDemand user ID 
and password have no relationship to the IBM i user ID and password, and all of the Content 
Manager OnDemand system parameter settings are honored. Y ou can enable or disable this 
exit at an individual instance level.
User Security Exit (ARSUSEC on z/OS only)
On z/OS, the ARSUSEC exit invokes the ARSUSECZ security exit module. The security exit allows 
the communication with an external security manager, such as RACF , which then determines 
whether the specific activity is allowed. 
When you enable the exits to implement the required level or type of security, the user ID 
must be defined for both TSO and Content Manager OnDemand. 
Figure 6-12 is an overview of the security system exits interface.
Figure 6-12   Security exits interface
ARSUSECX
exter nal exit r outine driv er - Ass embler
MVS Dynamic Exit Facility  
ARSUSECZ
Se cur i ty  exit modu le
ass embler
Option a lly 
modi fi ed 
AR SU SEC A and A RS US ECH  
(o r AR SU SE CB ) pr ovi d e 
mapp ings  of th e d ata  s tr uc tur es  
pr ese nte d as inpu t par ameters  
to exit routines (ex. 
AR SU SEC Z)  ass ociated w ith 
the exi t point defined by  
AR SU SEC X.
AR SU SE CJ sam ple  J CL 
s tr eam used  to as semble  an d 
bind AR SU SEC X and 
AR SU SEC Z.
Ar supe rm (dll)
exp or te d e ntry  po int of  PERM EXIT .
AR SU PE RM . C (C  s ample)
AR SU SE CH   (C  h eade r) 
AR SC SX I T .h
or
exported  en tr y point of  
PE RM EXI T.
AR SU PE RC  ( Cob ol s ample)
AR SC SX I C (Co bol cop ybo ok)
AR SU PE RJ  ( compile JC L)
initialize s t he  AR SU SE CAstru cture an d c all
Lo gica l  ex it poin t name 
AR S.S EC UR ITY
Setpr og ex it…. .A RSU SE CZ
CMOD S ystem
Us er  Authent icati on
u ser  log in, ad d, dele te  or  up date Re so u r ce  A ut h or iz at io n
g rant acc es s to  folde rs, applic atio n 
g roup s, d ocu me nts, a nd quer y SQL
ra c r o ut e SAF RACF, ACF2, Top  
Secret
Ars usec (dll)
ex po rte d en try  po i nt  of  SECUR IT Y.
AR SU SE C. C(C  s a mp le)
AR SU SE CH   ( C head er)
AR SC SX IT.h
or
ex po rte d en try  po i nt  of  SECUR IT C.
AR SU SE CC  (Co bol sample)
AR SU SE CB  (Co bol cop ybo ok)
AR SC SX IC  (C obol co pyb ook)
AR SU SE JJ  ( comp ile  J CL)
A se t of e xit ro utines
SRVR_F LAGS_FOLDER_APPLGRP_EXIT= 1
SRVR_F LAGS_DOCUMENT_EXI T =1
SRVR_ FL AG S_SQ L_Q UER Y_EXIT = 1SRVR_FLAGS_SECU RITY_EXI T =1
AR SZU XF
AR SZU XP L s t ruct ure
exit  rout in e drive r
1
2
3
4
5
6
 7
8
Security database