You can configure the SPO to enforce additional security by limiting the application images that clients can request, and by limiting the ability of clients to specify the location of ASO log files. You specify these options through the Visual OSA utility in the SPO Registry Information frame.

When the Run Authorized Apps Only option is activated, the SPO rejects any client request to run an application image file not previously registered through the Visual OSA utility. This option is enforced by private ASOs and the SPO. The applications authorized for the SPO may be a subset of those authorized for the ASO because the SPO requires the application image to be registered for shared access by at least one AKA Name, whereas the ASO allows any type of registration to satisfy the requirement.

When the Restricted ASO Log Path option is activated, all ASOs ignore any path specified on the -L flag of the CmdFlags passed by a client on the Initiate call. This means that the OpenROAD trace file produced by any ASO is restricted to the default log directory for the OpenROAD installation (that is, %II_LOG%, if specified; otherwise, %II_SYSTEM%\ingres\files).