Online Interceptor Logic

The Connector Online Interceptor detects, in real-time, ACF2 administration events that occur on the platform, and records them so that they can be reported to IdentityIQ. To accomplish this, the SMF record exit (IEFU83) is used to intercept every ACF2 command issued in the system, and transfer information regarding the commands to the Online Interceptor.

If password synchronization support is required, the Online Interceptor notifies IdentityIQ of password change events made by ACF2 accounts. To intercept password change events, ACF2 postinit exit ICHRIX02 and ACF2 new password exit ICHPWX01 are used. Both exits must be installed to intercept all password change events in the system.

When a system exit intercepts an event, it notifies the Online Interceptor started task via cross-memory services that the event has been intercepted. The Online Interceptor records the event in Connector for ACF2 datasets. The data are then reported to IdentityIQ by the Connector Notification Server (CD), via CTSGATE.

As long as the Online Interceptor is active in the system, ACF2 events and changes are recorded, even if the Connector for ACF2 is inactive. When Connector for ACF2 is restarted, the recorded data are transmitted to IdentityIQ.

The processing flow of the Connector Online Interceptor is illustrated in the following figure:

The Connector Online Interceptor detects ACF2 events in one of the following manners:

  • When a ACF2 user changes his/her password during the logon process or by an ACF2 command, ACF2 calls exit NEWPXIT [1A].

  • When ACF2 administrators issue an ACF2 command, ACF2 writes an SMF record to log the command. The system calls SMF exit IEFU83 as part of the SMF record process [1C].

  • When an ACF2 administrator issues an ACF2 command that changes a user’s password, ACF2 calls exit NEWPXIT [1B] and writes an SMF record to log the command. When the SMF record is written, the system call SMF exit IEFU83 [1C]. In this case, two events reach the Online Interceptor.

In any of these situations, the exit that intercepts the event passes the event to the Connector Online Interceptor via cross-memory services [2]. The Online Interceptor then writes the event to the Connector QUEUE dataset [3]. The Connector Notification Server (CD) reads an event from the QUEUE dataset [4]. If SMF event it reads the updated account from ACF2 database [5]. In any event, SMF exit or Password exit it transfers the event to the Connector for ACF2 Gateway (CTSGATE) [6] which transfers the event to the Connector Gateway [7] which passes it to SailPoint [8].