Skip to main content

Influencing REVOKE/CANCEL/SUSPEND Status and Rejecting Inbound Password Resets - Exit PSNCUX01

The password for a userid can be transparently reset without changing the current active status of the userid. By default, Mainframe Connector ships installation exit PSNCUX01 that leaves the current REVOKE/CANCEL/SUSPEND status of a userid unchanged.

If this default action is not appropriate, the site can provide a customized PSNCUX01 exit. PSNCUX01 is invoked twice for incoming transparent synchronization requests. The pre call occurs just prior to the password reset function in Mainframe Connector . The post call occurs following the password reset function invocation.

PSNCUX01 can also be used to reject an incoming password reset or resetexpire request. This can be useful for sites that want to be able to use their z/OS system as the final arbiter of a proposed new password value.

A sample PSNCUX01 exit is provided in member UX01SAMP of the Mainframe Connector installation library.

Following are the characteristics of the PSNCUX01 user exit:

  • Its name must be PSNCUX01 and it must reside in either the STEPLIB used for the Mainframe Connector started task or the system linklist

  • It should run AMODE(31) RMODE(24)

  • The exit is entered problem state key 8 and should return in this same state otherwise results are unpredictable

  • The exit must be reentrant

  • On entry to the exit, R1 points to the following parameter list:

    UX01STAT DS    XL1    EXIT INVOCATION STATE (PRE OR POST) 
     UX01PRE  EQU   X'80'  PRE INVOCATION 
     UX01POST EQU   X'40'  POST INVOCATION 
     UX01RSRV DS    XL3    RESERVED 
     UX01RSRC DS    F      RESET RETURN CODE (USED FOR POST CALL) 
     UX01UID  DS    CL8    USERID FOR WHICH PASSWORD IS BEING RESET 
     UX01USER DS    F      A WORD FOR THE USER 
     UX01NPWD DS    CL8    REQUESTED NEW PASSWORD VALUE 
     UX01MSGB DS    F      ADDRESS OF 128-BYTE RETURN MESSAGE BUFFER THAT 
     *                     CAN BE USED TO APPEND TO THE DEFAULT MESSAGE 
     *                     THAT IS RETURNED TO THE PWD MANAGER SERVER WHEN 
     *                     A M/F CONNECTOR RESET EVENT IS REJECTED BY 
     *                     THE M/F CONNECTOR PSNCUX01 EXIT.  THE FORMAT OF 
     *                     THIS MESSAGE AREA IS AS FOLLOWS: 
     *                     +0 - TWO BYTE LENGTH OF MESSAGE BEING 
     *                          RETURNED (MAX OF 126) 
     *                     +2 - 126-BYTE MESSAGE BUFFER

    Member PUX01PRM in the INSTLIB dataset contains the DSECT mapping macro for the above parameter list.

  • for the pre exit call, R15 on return contains a return code that will be interpreted as follows:

     R15=0    the current REVOKE/CANCEL/SUSPEND status for 
              the userid will not be changed but the 
              password will be reset to the new value. 
     R15=4    the current REVOKE/CANCEL/SUSPEND status for 
              the userid will be reset and the password 
              will be reset to the new value. 
     R15=8    the reset or resetexpire request should be 
              terminated.  The password value will not be 
              reset to the requested new value.
  • for the post exit call, UX01RSRC contains a return code value from the password revoke/reset request. If UX01RSRC=0 , the requested password reset and revoke update have been successful. Any other value in UX01RSRC indicates that the requested operation did not complete successfully.

  • UX01USER is a word of storage that can be used by the exit routine to maintain state information across the pre and post exit call.

  • UX01NPWD is the requested new password value for the reset or resetexpire request.

TopSecret ASUSPEND

If Mainframe Connector will be running in a TopSecret environment and you do not want a password reset event to reset the ASUSPEND attribute, see TopSecret and REMOVE ASUSPEND to alter this default function.

ACF2 CANCEL

If Mainframe Connector will be running in an ACF2 environment and you do not want a password reset event to reset the CANCEL flag, see ACF2 and Removing the CANCEL Flag to alter this default function.