1.0

CHAPTER 14 Understanding Policies
245
The sample scripts presented in Sample Scripts on page 250 are installed with
VMware ACE Manager. The default location is C:\Program
Files\VMware\VMware ACE Manager\Samples.
The following descriptions give the format for the output that your plug-ins must
write to StdOut to control various policies.
Authentication Plug-Ins
The following table outlines the basic information you need to write authentication
plug-ins.
Question Explanation
When does this script execute? This script executes when the virtual machine is opened.
What relevant environment variables
are available to the script?
No authentication-specific environment variables are
available, but VMWARE_PROJ_ID and VMWARE_MVM_ID
give some context, indicating what virtual machine the user
is trying to open.
What is the expected output? The output of this script is hashed to create a key to encrypt
and decrypt virtual machine files. The first time this script is
run, the output is hashed to encrypt the virtual machine.
When a virtual machine is decrypted, the script must return
the same value. If the script returns a different value, the
virtual machine is not decrypted and the user sees an error
message.
The script may return any value. To ensure best security, a
value that includes only printable characters should be at
least 32 bytes long. For binary data, the value should be at
least 16 bytes long to ensure proper entropy.
What can I do with this script? The script should do one of the following:
• If the user is to be granted access to the virtual machine,
generate the data used to create the key for this user and
send it as output. The data should be unique for each user.
• If the user is to be denied access to the virtual machine,
the script should exit with a non-zero exit code.
Note: This is a reference to the exit code, not the output
value.
Where should the output of the script
go?
The script should send its output to StdOut.