Who is This Guide For?
The Authorization Process - How it Works
Common Procedures

This Department Administrator Guide is intended to assist campus administrators, located in administrative or academic departments, who are responsible for OS/390, Com-Plete, Natural, or PL/1 applications, running on IS&C's Enterprise Server, located in North Hall.

If you are . . .

• a Natural Application administrator or owner, or
• a Department Security Administrator (for the All-In-One application), or
• a "legacy" system administrator or owner, or
• an accounts administrator for your department, or
• a department contact who receives reports from IS&C, or
• an executive, manager or supervisor interested in IS&C processes and procedures,

. . . then this Department Administrator Guide is intended for you.

The information contained within this Guide is not considered "sensitive" and is intended for public dissemination.

For Com-Plete Userid billing. All Com-Plete Userids are billed to a Computer Center account. A request to set up a new Com-Plete Userid may require the IS&C Accounts Administrator to contact your department's account controller to authorize the creation of a new account and approve any allocation of funds to that account. A Com-Plete Userid cannot be activated unless a funded Computer Center account exists.

For linking a Com-Plete Userid to a Production Application. Each application running under Com-Plete has a registered owner known as a "Department of Record". For each department application there is at least one department administrator responsible for authorizing access requests from prospective users. Once formal authorization is received (normally by E-mail), IS&C security administration will proceed with the request. Access requests and department authorizations are filed for audit purposes (there are several access request forms available on the web, including the "Com-Plete Request" form and the "All-in-One Request" form). IS&C security cannot process an access request until approval has been received from the department of record.

For a Test Application. Each "TEST" application running under Com-Plete is administered either by the IS&C Financial Systems Manager or the IS&C Student Systems Manager. Normally, access to a TEST application is restricted to a developer. A developer may request access to a TEST application by contacting the appropriate IS&C Manager. If approved, the IS&C Manager will notify IS&C security administration to set up access.

For Adabas and Natural File Access. A request to link a Natural or Adabas file to an application or system is normally authorized by the department that is billed for the file.

For access to a OS/390 Partitioned Data Set. A "Partitioned Data Set", or PDS, is a special type of library that may contain, for example, JCL, Natural code, or data. Many of these libraries have a registered departmental owner and are secured by RACF. If you are a department administrator responsible for one or more OS/390 Partitioned Data Sets, IS&C security administration will be in contact whenever an access request is received. Once formal authorization is received (normally by E-mail), IS&C security administration will proceed with the request. Access requests and department authorizations are filed for audit purposes. IS&C security cannot process an access request until approval has been received from the department administrator.

As a department administrator, you should to be familiar with some of the most common IS&C security procedures.

How to Request Access

To open a Com-Plete Userid requires that an applicant submit a request form. The request form to be used differs somewhat from application to application. To determine which application form to use, you need to be able to answer these questions:

• What is the Log-on name of the application or system? (examples: STAR01, PYLV01, etc.)
• What is the common name of the application or system that you believe you need access to (examples: Payroll Leave Reporting, Requisitions Express, Star, etc.)?
• Which department is the "Department of Record" for the application, system, or utility that you need (this is important, for all approvals for access must come from the department)?

Once you have the answers to the above questions, the general application process is as follows:

1. The applicant applies for a service. The application form may differ depending on the desired service (Hint: refer to the Forms Lookup Table ).

   For example:

   • to apply for ALLN01 the All-In-One Access Request Form is required;
   • to apply for PYLV01 the Request for Com-Plete Service Form is used;
   • to apply for STAR01 an applicant must fill out an On-line application.

2. The appropriate application form is submitted..

3. The application administrator in the "Department of Record" reviews the request.

4. If the request is approved by the application administrator it is forwarded to IS&C. IS&C staff will:
• coordinate with the IS&C Accounts Administrator to open a Com-Plete account for the new user (a funded account is required before a Userid can be set up);
• set up a Com-Plete Userid (this enables the user to logon to Com-Plete);
• link the user's Userid to the approved application (this enables the user to logon to the application); and
• notify the user and requester once the Userid is ready.
• Normally, processing to set up a Com-Plete account and Userid takes about 10 working days once IS&C security administration has received authorization from the "Department of Record".
5. The user logs on to Com-Plete with the new Userid. The user can then logon to any approved applications (Note: most applications have internal security administered by a department administrator and the department will set up application permissions. Questions regarding specific permissions within an application should be addressed to the "Department of Record").

How to Close Access

Deletion of a Com-Plete Userid is normally a two step process: the Userid is deleted from Com-Plete and the Computer Center account is closed (Note: a Computer Center account should remain open if other Computer Center services (such as email) are to remain in use; in such instances only the Com-Plete Userid is deleted).

As a Userid is normally assigned to an individual, a department administrator should try to anticipate personnel changes (if possible) and arrange to set up a new, replacement, Userid to minimize disruption of work.

A Userid can be deleted and/or an account closed for any of the following reasons:

• By request. The preferred method of deleting a Userid is by request from a department administrator upon employee separation or termination. Upon receiving a request, IS&C security administration will delete the Userid and will coordinate with the IS&C Accounts Administrator to arrange for the closure of the account. Please use the "Request for Com-Plete Service Delete Form".
• Account closure. When a department account administrator initiates a request to close a Computer Center account, IS&C security administration determines if there is an existing Com-Plete Userid tied to the account. If there is an existing Userid tied to the account, confirmation to close the account and delete the Userid is requested (in order to avoid the closure of an account with a Userid that should remain open).

When a Com-Plete Userid is initially set up, a User Profile consisting of Account, User Name, Output Bin and Destination is created. The User Profile has many uses, including:

• Account: accounting information is used for billing on-line access and batch jobs.
• Destination: output is normally routed to the printer specified as the users default printer destination (Note: the printer destination can be changed by the application software).
• Output Bin: bins are located in North Hall, and any printed output directed to UCSBMVS.R0 will be placed into the bin specified as the users bin.
• User Name: often used to identify the owner of printed output.
  
  

Current settings for a User Profile are displayed on any Job Submission screen. The user profile may be need to be changed if there has been:

• An account change; or
• A change in the printer; or
• A change in the user's name; or
• A bin change.
  
  

Send an Email note to isc.security@isc.ucsb.edu to request changes to a User Profile. On this note detail any user profile change you wish to make.

IS&C security distinguishes among types of administrators based on function. These 3 types include:

In practice, a large number of departments have chosen to combine these 3 functional types into one individual, who is often the accounts administrator (these departments have chosen a "1 tier" approach, the least complex). Many such departments do not own applications themselves, but apply to other departments that do.

Some departments combine the functions of an application owner and day-to-day administrator into one individual, but separate those duties from a departmental accounts administrator (these departments have chosen a "2 tier" approach). These departments have decided that a certain amount of specialization is required to manage budgets as opposed to administering a department system (such as the Accounting owned APEX system).

A small number of departments have delegated these 3 functional types among different employees (these departments have chosen a "3 tier" approach, the most complex). In part splitting the "ownership" function from the "day-to-day" administrative functions is necessitated by the workload required for maintenance (such as for the Registrar owned STAR01 system).

However these functions are assigned, care must be exercised to avoid miscommunication within a department, or, between a department and IS&C, or between departments. As an department administrator you should know how your particular department distributes (or combines) these functions within the department.

A Userid is a unique identifier that enables a user to logon to Com-Plete, thereby accessing various computing services for which the user has been authorized.

Spelling. The term "userid" has several valid spellings, which you may encounter, including, for example, User ID, USERID, Userid, and User-ID.

Purpose. A Userid is a simple way to authenticate a user to Com-Plete.

Role of IS&C security administration. IS&C security administration is responsible for setting up a Com-Plete Userid. In order to maintain an audit trail, all Com-Plete Userids are kept for a minimum of 7 years after an employee separates or terminates.

Userid Types:

Did you know that there are almost 150 administrative applications currently in use, with new ones under development! If you are an application administrator you are empowered to make decisions regarding access requests and permissions. IS&C security is here to assist you in administering your application, but you must know your application.

Here are some ways to learn more about your application or system:

1. System Documentation. If formal documentation exists for your system, you are fortunate! Study it! If no formal documentation exists for your system, start a binder for each system or application that you administer. Keep this binder in an easy to reach place. Collect any notes, screen samples, etc., in your binder relevant to your system. Should you transfer or separate from the department pass over your binder(s) to your successor. Keep any confidential information related to your application in a secure location.
2. On-line Help. If your system has an on-line help system, become familiar with it!
3. Training. Arrange for training on how to use your application (if any formal training is available, such as for the All-in-One application). If your application has its own internal security component, additional training may be required.
4. Seek those who have experience with the application. Seek out those individuals in your department that have used your application or system ... their experience may be invaluable.
5. The "Job Submission" screen. As an administrator, you may need to know how to read and understand a "Job Submission" screen, also known as a "RJE Submit" screen. "Job Submission" screens are often used, for example, to submit jobs that print hardcopy reports. Displayed below is a sample "Job Submission" screen (your "Job Submission" screen may differ slightly).

Four elements of a "Job Submission" screen are set up by IS&C security administration when a user is added to Com-Plete, including:

• Output Bin. This is the Bin or Locker where printed output will be distributed if printed at the Computer Center in North Hall. Some departments have reserved special lockers for their output.
• User's Name. The name of the user.
• Account. The Computer Center account being charged for the "Job Submission".
• Destination. The printer where output is to be routed.

Taken together, these four elements are known as a User Profile. As an administrator you can coordinate modifications to a User Profile for a user in your department (such as changing the printer Destination). See the section named Change User Profile for more information on how to submit such requests.

The remaining items on a "Job Submission" screen (such as CPU Time, Print Lines, Message Class, Copies, and Forms) are programmatically controlled by the application itself and are not maintained by IS&C security administration.

Detailed information regarding all the elements of the "Job Submission" screen and Job Control Language (JCL) is available in this document on JCL.

1. Security groups. Access to your application or system is usually accomplished by placing a user into a security group. All applications have at least one such group, others may have two groups (one for "read only" access, the other for "update", for example), and other applications may have many security groups. As an application administrator, do you know the name and function of the security groups for your application? If you don't, contact IS&C security administration for a thorough review of these security groups.

 

2. Account administration and application administration. Department account administrators are responsible for the administration of Com-Plete accounts. Account administrators receive monthly IS&C Billing reports, monitor expenses (such as connect charges), and approve the opening or closing of Com-Plete accounts. The IS&C Accounts Administrator works closely with department account administrators to resolve any questions or concerns regarding accounts.

Application administrators are responsible for approving the setting up (or closing down) of Com-Plete Userids, for authorizing access to an application, for application security and receive IS&C Security reports. Such administrators usually know a great deal about the data, files and security structure of an application.

In many departments, the functions of the account administrator and application administrator are highly specialized with one user focusing on accounts, and another user focusing exclusively on application administration. In other departments, these functions are combined and a single user acts as both the account and application administrator. As a department adminzistrator you should know whether these functions are specialized, or, combined. If these functions are specialized, coordination in your department is required between the accounts administrator and application administrator to ensure that a Computer Center account is not closed for an active Com-Plete Userid.

3. Application-level security. A number of departmental applications have their own built-in security sub-system, administered by a department user, that is totally separate from the security systems administered by IS&C security administration. Applications or systems with such a security sub-system are considered to have "application-level" security. An "application-level" security sub-system supplements (but does not replace) any security systems employed by IS&C security.

Generally, application-level security allows a department administrator to:

• set up access permissions for an application (such as what screens a user may or may not view);
• modify access permissions for an application (such as upgrading a user from "read-only" access to "update" access);
• display existing user permissions for an application;
• purge users from the application.

IS&C security administration is not empowered to maintain any "application-level" security. Consequently, IS&C security administration can only provide minimal assistance should any questions or problems arise with "application-level" security.

4. OS/390 Libraries. Does your department use OS/390 libraries for submitting jobs for a system you administrate? If you are an administrator you should know how to identify these libraries and how they are secured.

If you need further information, contact IS&C security administration for a quick orientation.

5. Monitor Access. To be an effective administrator means that you will need to monitor who has access to your application or system. IS&C security provides these Security Reports to help you monitor access.

A Password is a string of alpha-numeric characters used in conjunction with a Userid to logon to Com-Plete. A password is used to verify that an individual is the legitimate user of a Userid.

User Responsibilities

• To manage their password.
• To ensure the confidentiality of a password.

Responsibilities of a Department Administrator

• To encourage good password design. As an application administrator, you can help your staff to create good passwords!
• To discuss password design with each new employee as part of their orientation.

Responsibility of IS&C Security Administration

• To set up an initial one-time logon password for Com-Plete.
• To respond to user questions regarding password maintenance.

The following tables summarize the enforced and recommended password design elements of Com-Plete.

Contact your Manager, IS&C Security Administration, or Internal Audit to report it.

As an administrator you may receive from IS&C security administration several different security reports to assist you in administering an application. In addition, there is a security report you may generate yourself at your convenience.

(1) Department "Security Report"

(2) "Current Employees with Com-Plete Access" Report

• Active: to be checked if the employee is still actively employed in your office.
• Transfrd (Transferred): to be checked if the employee has transferred to another UCSB department or office.
• Separtd (Separated): to be checked if the employee has terminated employment.
• Mismatch: to be checked if an employee's assigned Userid is being used by another employee.

(3) "List of Datasets Billed" Report

Monitoring of the OS/390, Com-Plete and Natural computing environments is a normal function of IS&C security administration.

E-mail Nicknames