Newsgroups: bit.listserv.ibmtcp-l
Date:         Fri, 8 Jan 1993 11:05:27 EST
From:         Aaron Morris <SYSAM@ALBNYVM1.BITNET>
Subject:      Automated Computer Account Application

> We have had in place for several years now a system whereby a student
> can go to a user room and get him/herself a computer account on any    of
> our central systems.  Maybe Aaron Morris (SYSAM@ALBANY), our IBM
> systems manager who developed the system, would be willing to say a
> little more about it, seeing as there's some interest in the topic.

The above mentioned Computer Account Application Process (CAAP) is part
of UAINFO (our current Campus Wide Information System) and is available
to any user via the 'Generic Logon' mods to CP (obtained from VMSHARE).
CAAP is written in REXX and uses IBM's Display Management System (DMS)
to display screens which query users for information needed to create
accounts on our central computing systems (IBM, VAX and UNIX).

The first order of business is to verify that the user has read our
Computer Ethics statement and agrees to be a good citizen in our
computing community.  If the user has not read our ethics statement,
CAAP presents the document to the user before processing continues.
After that formality is attended to, CAAP goes on to query the user for
their birthday/university id combination.  This combo is then sent to a
secure disconnected virtual machine which looks them up in the university
database to find the student name that is uniquely paired with the bd/id
combination.  This name is sent back to the CAAP user who must verify
that they are indeed the person found by the secure DVM.

From here the user is queried for the machine(s) on which they desire
an account and they must choose an initial password for the account(s).
The initial password must be changed on the user's first logon to the
machines(s) of choice.  CAAP also checks to make sure that user's don't
already have an account on the machine(s) they request and also verifies
that the user is eligible for an account on the chosen machine (UNIX
accounts are restricted to graduate students and undergraduates who are
taking a UNIX course).  The machine choice and initial password are then
sent to the accounting processor on the appropriate machine and the
accounts are ready for the user on the following day.

This automates the account application process.  Security is an obvious
concern here.  Users of our CWIS who gain access through the 'generic
logon' run in a 'lobotomized' version of CMS which only has available to
it the commands necessary to run the CWIS.  If users are able to break
out of the CWIS (which is impossible as far as we know) they are logged
off the machine.  The database lookups are handled by the secured DVM
and all communication between CAAP and the DVM is handled through IUCV,
so even if a used COULD break out of the CWIS, the critical information
would not be available to them.  Obviously a bd/id combo can be obtained
through collusion with other university students, but the answers
necessary to get through the CAAP process imply an electronic signature
that the account requestor is not in collusion with any other student
and that the fingers pressing the keys actually belong to the person
identified by the secured DVM.