Programming Guides › Programming Guide for C › Common Data Types and Structure

Common Data Types and Structure

This section contains the following topics:

Exported Enumerations

Common Structure

Exported Enumerations

The following enumerations in SmApi.h are used by more than one SiteMinder API:

• Sm_Api_DisabledReason_t
• Sm_Api_Reason_t
• Sm_PolicyResolution_t

Sm_Api_DisabledReason_t

Enumerates the reasons that a user account can be disabled.

The following APIs use Sm_Api_DisabledReason_t:

• Policy Management API
• Directory API

Note: A user account can be disabled for multiple reasons. For example, if the User must change password at next login checkbox is checked and the administrator clicks Disable, an nDisabledReason parameter holds both the Sm_Api_Disabled_PWMustChange bit and the Sm_Api_Disabled_AdminDisabled bit.

For examples of using Sm_Api_DisabledReason_t, see the examples under Sm_PolicyApi_SetDisabledUserState().

The following table shows the bits that can be set for disabled reason. A brief explanation of each reason, organized by reason type, follows the table.

Disabled Mask

• Sm_Api_Disabled_DisabledMask

  The disable bits mask is used to distinguish between two cases:

  • When disabled bits are set, the resulting hexadecimal value begins 0x00.
  • When users are forced to change their passwords, the resulting hexadecimal value begins 0x01.
• Sm_Api_Disabled_Enabled

  When a user account is enabled, the value is 0, as opposed to the other cases that have non-zero values.

Disabled Bits

A user account can be disabled for one or more of the following reasons:

• Sm_Api_Disabled_AdminDisabled

  Disabled by administrator.

• Sm_Api_Disabled_MaxLoginFail

  Disabled for maximum login failures.

• Sm_Api_Disabled_Inactivity

  Disabled for inactivity over a period of time.

• Sm_Api_Disabled_PWExpired

  Disabled for password expiration.

• Sm_Api_Disabled_DirNativeDisabled

  Disabled by the user repository and cannot be enabled in SiteMinder. For example, SiteMinder returns this disabled reason if an Active Directory user object expires because its accountExpires time elapsed.

Qualifier

• Sm_Api_Disabled_PWMustChange

  Forces a user to change his or her password during the next login. When users are forced to change their passwords, the resulting hexadecimal value begins 0x01, as opposed to 0x00.

Sm_Api_Reason_t

Enumerates the reasons for an access event, such as an authentication failure or session logout.

When an authentication scheme fails to authenticate, it may send back a reason status code. The status code returned from the authentication function is constructed using the SM_MAKEAUTH_STATUSVALUE macro (see Returns on page 10).

The Policy server sends the reason to the agent. The SiteMinder Web Agent exposes the reason so that Web applications can use it in their logic.

The following APIs use Sm_Api_Reason_t:

• Authentication API
• Event API
• Directory API

The following table shows the bits that can be set for access events.

Note: Values 0 through 31999 are reserved for use by SiteMinder. Values 32000 through 32767 are available for user-defined reasons.

Sm_PolicyResolution_t

Sm_PolicyResolution_t, defined in SmApi.h, enumerates values that describe how one policy object, such as a user, is related to another policy object, such as a group.

The following APIs use the enumeration Sm_PolicyResolution_t:

• Policy Management API
• Directory API

The following table lists the supported policy resolutions. A brief description of each resolution follows the table.

Note: Another policy resolution, Sm_PolicyResolution_Max, is for internal use only.

• Sm_PolicyResolution_Unknown. The policy object is unknown.
• Sm_PolicyResolution_User. The policy object is the specified user object.
• Sm_PolicyResolution_UserGroup. The policy object is a member (directly, or indirectly through another group) of the specified user group object.
• Sm_PolicyResolution_UserProp. The policy object matches the specified filter (user scope).
• Sm_PolicyResolution_UserRole. The policy object is the occupant of the specified role.
• Sm_PolicyResolution_Org. The policy object is a member (directly or indirectly through another organization) of the specified organization object (this supports organizations and organization units).
• Sm_PolicyResolution_Query. The policy object is contained in the result set of a directory-specific query.
• Sm_PolicyResolution_All. The policy object is located in the specified directory.
• Sm_PolicyResolution_GroupProp. The policy object is policy-related to a "group"-like DN matching the specified filter.
• Sm_PolicyResolution_OrgProp. The policy object is policy-related to a "org"-like DN matching the specified filter.
• Sm_PolicyResolution_DnProp. The policy object is policy-related to any DN matching the specified filter.

More Information:

SmDirValidateUserPolicyRelationship()

Common Structure

The Sm_Api_Context_t structure is used by multiple SiteMinder APIs.

The structure provides the function pointers for the SiteMinder logging utility, trace utility, and error utility.

The following APIs use Sm_Api_Context_t:

• Authentication API
• Authorization API
• Tunnel Service API
• DMS Workflow API
• Directory API

More Information:

Sm_Api_Context_t