5/17/065/17/06 11

Information CoordinatorInformation Coordinator

Data CustodianData Custodian

Meeting of 05/17/06 Meeting of 05/17/06

5/17/065/17/06 22

IS Security TeamIS Security Team The members of the team are: Myra Daly, The members of the team are: Myra Daly,

Peter Giovinazzo, Mimi Mark, and Lorraine Peter Giovinazzo, Mimi Mark, and Lorraine Sauro.Sauro.

The IS Director is Erik Anderson.The IS Director is Erik Anderson. The new manager is to be announced.The new manager is to be announced. Contact us by one of the following methods:Contact us by one of the following methods:

Sending an email to Sending an email to issecsd@syr.eduissecsd@syr.edu Creating a Service Desk Request and assigning Creating a Service Desk Request and assigning

the group to the group to is securityis security Submitting your question or problem on this web Submitting your question or problem on this web

page page http://its.syr.edu/admin-sys/fast/form.cfmhttp://its.syr.edu/admin-sys/fast/form.cfm

5/17/065/17/06 33

AGENDAAGENDA HOST REGISTRATIONHOST REGISTRATION BUSINESS LAYERSBUSINESS LAYERS SSO FAST ENHANCEMENTSSSO FAST ENHANCEMENTS FAQFAQ PREVIEW OF THE IS SECURITY WEB SITEPREVIEW OF THE IS SECURITY WEB SITE QUESTIONSQUESTIONS FUTURE MEETING TOPICSFUTURE MEETING TOPICS

5/17/065/17/06 44

HOST REGISTRATION HOST REGISTRATION REQUESTREQUEST

5/17/065/17/06 55

BUSINESS LAYERS REQUESTBUSINESS LAYERS REQUEST

5/17/065/17/06 66

FAST ENHANCEMENTSFAST ENHANCEMENTS PHONE NUMBERSPHONE NUMBERS SSO USER LOCKS AND USER SSO USER LOCKS AND USER

CONNECTON LOCKSCONNECTON LOCKS FAB REQUEST MODIFICATIONSFAB REQUEST MODIFICATIONS DRAFT STATUS FOR FAB REQUESTSDRAFT STATUS FOR FAB REQUESTS

5/17/065/17/06 77

PHONE NUMBERS IN FASTPHONE NUMBERS IN FAST

The telephone # is now included The telephone # is now included for all FAST users under the email for all FAST users under the email address. address. 

5/17/065/17/06 88

FAST uses Peoplesoft Business Phone #s. FAST uses Peoplesoft Business Phone #s. The accuracy is dependent on the The accuracy is dependent on the employees updating their Phone numbers employees updating their Phone numbers through the MySlice Personal Services through the MySlice Personal Services Pagelet below:Pagelet below:

5/17/065/17/06 99

Once an employee selects the View/Update Once an employee selects the View/Update Phone Numbers link, the screen below will Phone Numbers link, the screen below will appear and it is the employee’s appear and it is the employee’s responsibility to update the Business Phone responsibility to update the Business Phone number.number.

5/17/065/17/06 1010

SSO User Account Maintenance - SSO User Account Maintenance - Update and InquiryUpdate and Inquiry

5/17/065/17/06 1111

Requests Detail - For RequesterRequests Detail - For Requester

5/17/065/17/06 1212

Requests Detail - ApproverRequests Detail - Approver

5/17/065/17/06 1313

When you click on the Approver button in the When you click on the Approver button in the Tool Bar the Approver pop up box now lists the Tool Bar the Approver pop up box now lists the telephone # of the Data Custodian in telephone # of the Data Custodian in the  Requests Detail - For Requester & Approver the  Requests Detail - For Requester & Approver screens.screens.

5/17/065/17/06 1414

USER LOCKSUSER LOCKS Locked accounts and connections have Locked accounts and connections have

proved to be problematic. The following proved to be problematic. The following enhancements will prevent requesting enhancements will prevent requesting and approving access if the users are and approving access if the users are locked.locked.

The overnight provisioning process reads FAST The overnight provisioning process reads FAST to verify a user’s status for system access the to verify a user’s status for system access the next day. If the user’s account is locked or if next day. If the user’s account is locked or if the requested connection is locked the user the requested connection is locked the user will not have access to some or all of the will not have access to some or all of the MySlice links (ex. HRSA, FAB, MyReports)   MySlice links (ex. HRSA, FAB, MyReports)   

5/17/065/17/06 1515

When an Information Coordinator starts to When an Information Coordinator starts to add a request, if the user's add a request, if the user's SSO accountSSO account is is lockedlocked, a pop up message will appear with , a pop up message will appear with instructions to unlock the account and start instructions to unlock the account and start a new request.a new request.

5/17/065/17/06 1616

The table in the next slide is taken The table in the next slide is taken from Service Desk Knowledge from Service Desk Knowledge document # 2409. This table is used document # 2409. This table is used by the ITS Call Center to handle by the ITS Call Center to handle locked SSO Accounts inquiries. locked SSO Accounts inquiries. You can use the information to You can use the information to determine when you can unlock user determine when you can unlock user accounts.accounts.

NOTE:NOTE: IS Security can lock or unlock IS Security can lock or unlock for any reason.for any reason.

5/17/065/17/06 1717

 SSO Account Lock Reasons and Source Reason: Source to Lock/Unlock:  Left SU  Department Information

Coordinator Password Violation  ITS Call Center/ Department IC Administrator Lock  IS Security  SSO User Delete Failure  IS Security 

 Short Work Break  Department Information Coordinator

 Changed Department  Department Information Coordinator 

 Leave of Absence  Department Information Coordinator 

 ABUSE - Security Risk  IS Security  Locked for Maint  IS Security  Needs Training  IS Security  Account Inactivity  IS Security  Locked only has Non-Displayed Buttons  IS Security 

5/17/065/17/06 1818

A Data Custodian will NOT be able to A Data Custodian will NOT be able to approve requests for users that have their approve requests for users that have their SSO account lockedSSO account locked. A pop up message will . A pop up message will appear with instructions for the Data appear with instructions for the Data Custodian to contact the Information Custodian to contact the Information Coordinator to unlock the account. Coordinator to unlock the account. 

5/17/065/17/06 1919

A Data Custodian will NOT be able to A Data Custodian will NOT be able to approve a request if the approve a request if the user's connection is user's connection is lockedlocked. A pop up message will appear with . A pop up message will appear with instructions to unlock the connection.instructions to unlock the connection.

NOTE: If the account and connection NOTE: If the account and connection are both locked you will receive both are both locked you will receive both pop up messages.pop up messages.

5/17/065/17/06 2020

INITIATING A FAB REQUESTINITIATING A FAB REQUEST

5/17/065/17/06 2121

Sometimes instead of entering a login ID for Sometimes instead of entering a login ID for the user, an IC may want to add a request the user, an IC may want to add a request by selecting from the list on the leftby selecting from the list on the left

5/17/065/17/06 2222

We have now corrected the problem that We have now corrected the problem that occurred with adding occurred with adding FABFAB requests when requests when the highlighted request in the list was for the the highlighted request in the list was for the same usersame user and the and the same connectionsame connection

5/17/065/17/06 2323

REMINDERREMINDER An IC cannot add a Prod FAB Request if one An IC cannot add a Prod FAB Request if one

currently exists for the same user and same currently exists for the same user and same connection in "Request", "Draft", or "Pending" connection in "Request", "Draft", or "Pending" statusstatus. . The pop up message appears on the next The pop up message appears on the next slide.slide.

The IC must either wait for the first request to be The IC must either wait for the first request to be completed by the DC and then the IC can enter a completed by the DC and then the IC can enter a new requestnew request. .

Or if the conflicting request is in "Request" status, Or if the conflicting request is in "Request" status, then that request can be removed by clicking on the then that request can be removed by clicking on the "Delete" button"Delete" button in the Tool Bar and then creating a in the Tool Bar and then creating a new request that contains the needed informationnew request that contains the needed information . .

5/17/065/17/06 2424

5/17/065/17/06 2525

DRAFT STATUS FOR FAB DRAFT STATUS FOR FAB REQUESTSREQUESTS

The The optionoption of using DRAFT status for Prod of using DRAFT status for Prod FABFAB connections (ex. PROD PS8.8 FAB connections (ex. PROD PS8.8 FAB Campus USE, PROD PS8.8 FAB Budget Campus USE, PROD PS8.8 FAB Budget Worksheet) is now available. Worksheet) is now available.

Draft status has always been available for Draft status has always been available for non FAB FAST requests.  non FAB FAST requests.  

New FAST Requests are not set to Draft status New FAST Requests are not set to Draft status automatically, but Draft status can be used if automatically, but Draft status can be used if desired.desired.

5/17/065/17/06 2626

ADDING A FAB REQUEST IN ADDING A FAB REQUEST IN DRAFT STATUSDRAFT STATUS

To create a new FAST Request in DRAFT status To create a new FAST Request in DRAFT status click on the "Add" button, enter the Login Id and click on the "Add" button, enter the Login Id and select the Connection from the drop down list. Then select the Connection from the drop down list. Then before entering any information on page 2before entering any information on page 2, change , change the status from the default of "Request" to "Draft".the status from the default of "Request" to "Draft".

As with any FAST Request in DRAFT status, As with any FAST Request in DRAFT status, information may be entered on page 2 into the information may be entered on page 2 into the "Request Information" area and/or the "Requester "Request Information" area and/or the "Requester Comment" area. Comment" area.

For Prod FAB, if the request is in Draft status the For Prod FAB, if the request is in Draft status the IC will not be able to select the addition ("A") or IC will not be able to select the addition ("A") or removal ("R") of FAB privileges.removal ("R") of FAB privileges.

5/17/065/17/06 2727

You can enter information into this area

You can enter information into this area

You can not select privileges when in Draft Status

5/17/065/17/06 2828

CHANGING A FAB REQUEST CHANGING A FAB REQUEST FROM DRAFT TO REQUEST FROM DRAFT TO REQUEST

STATUSSTATUSInformation Coordinator steps to follow:Information Coordinator steps to follow:

1)1) Select a Prod Select a Prod FABFAB Request that is in DRAFT status and  Request that is in DRAFT status and change the status to "Request". change the status to "Request".

1)1) Before clicking the 'OK" button, Before clicking the 'OK" button, select the addition ("A") or select the addition ("A") or removal ("R") of FAB privileges. removal ("R") of FAB privileges.

1)1) Enter or remove information from the "Request Enter or remove information from the "Request Information" area and/or the "Requester Comment" area. Information" area and/or the "Requester Comment" area.

2)2) Click on the OK button.Click on the OK button.

NOTE: The "A"s and "R"s cannot be changed after the NOTE: The "A"s and "R"s cannot be changed after the "OK" button is clicked."OK" button is clicked.

5/17/065/17/06 2929

TOP FREQUENTLY ASKED TOP FREQUENTLY ASKED QUESTIONSQUESTIONS

Here are the top 4 frequently asked Here are the top 4 frequently asked questions and their answers :questions and their answers :

5/17/065/17/06 3030

How do I maintain access for How do I maintain access for people on Leave of Absence ?people on Leave of Absence ? IS Security will lock the SSO User only (we IS Security will lock the SSO User only (we

will no longer lock the connections).will no longer lock the connections). IS Security IS Security will notwill not send an email send an email

notification to the individual Data notification to the individual Data Custodian when we lock a SSO User for Custodian when we lock a SSO User for Leave of Absence  Leave of Absence  

The Information Coordinator can unlock The Information Coordinator can unlock the SSO User if and when needed.the SSO User if and when needed.

To keep a person’s access unlocked, the To keep a person’s access unlocked, the Information Coordinator can email the Information Coordinator can email the request to:request to: issecsd@syr.eduissecsd@syr.edu

5/17/065/17/06 3131

I am receiving a Failed to I am receiving a Failed to Launch Application message Launch Application message when clicking on the FAST when clicking on the FAST button. What should I do ?button. What should I do ?Refer your DSPs to the Service Desk Knowledge Refer your DSPs to the Service Desk Knowledge

document # 2674.  This document will walk them through the solution for this problem.

Note:Note: The document is available with the hand The document is available with the hand outs for this presentation.outs for this presentation.

5/17/065/17/06 3232

Why doesn’t the user have Why doesn’t the user have access when it is showing that access when it is showing that it is approved ?it is approved ?

There is a 4:00 PM deadline for approved FAB There is a 4:00 PM deadline for approved FAB access, to be processed, so the access may access, to be processed, so the access may take another day if the deadline is not meet.take another day if the deadline is not meet.

If the user’s SSO account or connection was If the user’s SSO account or connection was locked they need to be unlocked. This will locked they need to be unlocked. This will not be a problem after the previously not be a problem after the previously mentioned enhancements are in place.mentioned enhancements are in place.

5/17/065/17/06 3333

Why has the user’s access Why has the user’s access been taken away ?been taken away ? There is a Weekly Clean Up report run by the Security There is a Weekly Clean Up report run by the Security

team on Mondays for people that have Left SU, team on Mondays for people that have Left SU, Changed Department, or on Leave of Absence.Changed Department, or on Leave of Absence.

If users are on this report, their access is reviewed and If users are on this report, their access is reviewed and deleted or locked depending on the Employee Status.deleted or locked depending on the Employee Status.

The SSO account is locked for a week for people that The SSO account is locked for a week for people that have Left SU. This gives the IC some leeway if there have Left SU. This gives the IC some leeway if there was a paperwork snafu because we can just unlock the was a paperwork snafu because we can just unlock the account and the access will be reinstated the next day. account and the access will be reinstated the next day.

5/17/065/17/06 3434

PREVIEW OF THE NEW IS PREVIEW OF THE NEW IS SECURITY WEB SITESECURITY WEB SITE

QUESTIONS ?QUESTIONS ?

FUTURE MEETING TOPICSFUTURE MEETING TOPICS Guest Data CustodiansGuest Data Custodians What do you want to see for What do you want to see for

future topicsfuture topics