Institutional Computing Services

Security Related to Banner Systems

With the move from the old UNIX FOCUS batch system to AppWorx, this is a good time to review related security items. The first item to review is the types of user-IDs which may be involved with the AppWorx batch system.

UNIX User-IDs on the jade server

Two types of jade UNIX user-IDs are involved. First are jade UNIX user-IDs containing a zero (0) after the department designation (for example, bus0mode). These user-IDs are to be used for FOCUS against the IA system. These user-IDs will eventually be deleted after the Student system is totally off the IA system. The second type are jade UNIX user-IDs which are to be used for FOCUS against BANNER tables (for example, busmode).

AppWorx User-IDs

To use FOCUS batch, each of the UNIX user-IDs (both IA- and BANNER-related) must have a corresponding user-ID on AppWorx (with the name corresponding to the jade UNIX ID). Remember, even though the name is identical, these AppWorx user-IDs are separate from the jade UNIX user-IDs and may have a different password.

BANNER/Oracle User-IDs

Another type of user-ID involved is the BANNER/Oracle login ID. Typically it has the same name as the corresponding UNIX user-ID (for example, busmode). Even though the name is the same as the jade UNIX and AppWorx user-IDs, the password may be different. This BANNER/Oracle user-ID has one type of security built for on-line BANNER access and another type for FOCUS use against BANNER.

On-line BANNER Security

The on-line security is based on classes of use. Forms/processes (in either query or modify mode) are defined as valid members of one or more classes of use. Each user-ID is then made a member of one or more classes of use which determines the forms/processes which an user-ID may use. Forms or processes can be added or deleted from classes of use and these changes automatically apply to all user-IDs which are members of that class of use. The ISU classes of use which are currently defined are listed in appendix A.

Logging in for AppWorx

For batch use against BANNER tables, click on the AppWorx icon on your PC and log into AppWorx using your AppWorx user-ID and password. When the job is actually run, the AppWorx system will automatically log into your corresponding jade UNIX user-ID. You have to set up prompts for USER, PASS, and SID for each AppWorx job (FOCUS program) which is to be defined. USER is the BANNER/Oracle login user-ID which is to be used to run the job. PASS is the password for the BANNER/Oracle user-ID. SID is the database to be used to run the job (MICA, CLNT, DEVL, SEED, etc). AppWorx will actually log into the BANNER/Oracle user-ID (as defined by USER) to run the job.

Changing or Resetting Passwords

Assuming that the current password is known, passwords for jade UNIX user-IDs, AppWorx user-IDs, and BANNER/Oracle login user-IDs can be changed by the owner of the user-ID. If the password is forgotten, it cannot be retrieved. If you forget your password, call Vicki WInn (x3351) who will reset your password. You will need to specify the type of user-ID involved. Identification may be required before resetting the password.

[NOTE: Request for LAN user-IDs, or for resetting forgotten LAN user-ID passwords, should be made to the Help Desk via their  web form.]

Administrative Computing User-IDs - Miscellaneous

Other items relating to administrative computing user-IDs are:

• Each ID (LAN, UNIX, AppWorx, or BANNER/Oracle) on systems and servers supported by ACNS/ICS must have one person designated to have the primary responsibility for the ID. One ISU department must be designated to have the secondary responsibility for the ID. Such administrative IDs will be mostly for ISU faculty/staff use; there will be a few for students who are working in an administrative office. There will also be a few IDs used for miscellaneous functions (for example, state board of accounts). All such administrative IDs for student and miscellaneous purposes must have a full-time ISU staff member as the sponsor of the ID.

• Administrative user-IDs are to be 8 characters or less with the first 2-3 to be the standard university department and the rest of the 8 characters to identify the person, such as the person's first or last name. (In the case of student and miscellaneous user-IDs, this may be more generic).

• User-IDs related to students who are working for offices where the student needs access to University databases are to be the responsibility of a full-time employee within the office. The person responsible must request that either the user-ID be deleted or the password be changed when the student no longer needs the access.

• Each person logging into BANNER PROD will be given one unique BANNER user-ID. The user-ID is normally the same as their LAN user-ID. User-IDs for departments to access financial accounts are composed of DR (Departmental Reporting) and their budget access code (for example, dralum). These DR user-IDs will be an exception to the philosophy of one ID per person.

• Unix user-IDs used for FOCUS Finance departmental reporting will begin with the characters DR. These Unix user-IDs will be set up only for reporting of their Finance departmental needs and not for other BANNER FOCUS needs (such as reporting on Student data).

• The on-line BANNER user-IDs used to access Finance departmental information will normally begin with the characters DR. These DR user-IDs can also be given other accesses (such as access to the Student data) if desired so a person only has one BANNER user-ID to remember. Other forms of on-line BANNER user-IDs (for example, busmode) can also be given access to departmental information (again, in the interest of a person only needing to remember one BANNER logon user-ID).

• The Finance part of BANNER has its own value-based security systems. Finance value base security is set for each BANNER user-ID (which is to be used with BANNER Finance) and is controlled by  Jeff Jacso.

• Individual BANNER/Oracle user-IDs will be required to log onto PROD. Both individual and standard user-IDs may be used to log onto CLNT. (The standard BANNER logon user-IDs are adisusr, fimsusr, faisusr, hrisusr, saisusr.) Individual user-IDs on PROD and CLNT, although having the same name, may have different passwords. It is required to use one of the standard BANNER user-IDs to log onto DEVL and SEED.