Managing and controlling administrator access to managed computer systems

• US 8,839,400 B2
• Filed: 09/27/2012
• Issued: 09/16/2014
• Est. Priority Date: 09/27/2012
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Anderson, Eric, Dawson, Christopher J., Nelson, Leslie A., Singletary, Brett W.
• Primary Examiner(s): Schwartz, Darren B
• Application Number:
  US13/628,537
• Publication Number:
  US 20140090022A1
• Time in Patent Office: 719 Days
• Field of Search: 726 1- 7, 726/10, 726 26- 30, 713/150, 713/168, 713/180, 713/182, 709217-219, 709/223, 709/225, 709227-229
• US Class Current: 726/10
• CPC Class Codes: G06F 21/50 Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices

Abstract

A method and computer program product for managing and controlling access of an administrator to a managed computer system. At least one computer program on an access system of the managed computer system receives from the administrator a request for access to the managed computer system and requests a managing computer system to search open tickets for service management. In response to that the open tickets are not found, the at least one computer program redirects the administrator to log onto the managing computer system to obtain a new open ticket for the access. In response to that the open tickets are found, the at least one computer program requests the administrator to choose at least one ticket from the open tickets and grants the administrator the access to the managed computer system in response to determining that the at least one ticket is valid.

Claims

1. A method for managing and controlling access of an administrator to a managed computer system, the method implemented by at least one computer program on an access system of the managed computer system, the method comprising:

receiving, by the access system of the managed computer system, from the administrator, a request for access to the managed computer system;

requesting, by the access system of the managed computer system, a managing computer system to search open tickets which are managed by the managing computer system for the managed computer system;

requesting, by the access system of the managed computer system, the administrator to choose at least one ticket from the open tickets, in response to that the open tickets are found;

checking, by the access system of the managed computer system, in response to determining that the administrator chooses the at least one ticket from the open tickets, status of the at least one ticket;

redirecting, by the access system of the managed computer system, the administrator to the managing computer system for a new service management ticket generated by the managing computer system, in response to determining that the open tickets are not found;

receiving, by the access system of the managed computer system, from the managing computer system, the new service management ticket; and

granting, by the access system of the managed computer system, the administrator the access to the managed computer system, based on at least one of;

determining that the status of the at least one ticket is valid and determining that the new service management ticket is received.

2. The method of claim 1, further comprising:

denying, by the access system of the managed computer system, the administrator the access to the managed computer system, in response to determining that the status of the at least one ticket is not valid.

3. The method of claim 1, further comprising:

allowing, by the access system of the managed computer system, the administrator read-only access to the managed computer system, in response to determining that the status of the at least one ticket is not valid.

4. The method of claim 1, further comprising:

redirecting, by the access system of the managed computer system, the administrator to the managing computer system for a new service management ticket generated by the managing computer system, in response to that the administrator does not choose the at least one ticket from the open tickets;

receiving, by the access system of the managed computer system, from the managing computer system, the new service management ticket generated by the managing computer system; and

granting, by the access system of the managed computer system, the administrator the access to the managed computer system.

5. The method of claim 1, further comprising:

recording, by the access system of the managed computer system, on a log the access of the administrator; and

transferring, by the access system of the managed computer system, information of the log to the managing computer system.

6. The method of claim 1, wherein the access system is a firewall to the managed computer system, a proxy server, or a virtual private network server, and wherein the access system is an entry point to one or more managed computer systems.

7. A method for managing and controlling access of an administrator to a managed computer system, the method implemented by at least one computer program on an access system of the managed computer system, the method comprising:

receiving, by the access system of the managed computer system, from the administrator, a request for access to the managed computer system;

requesting, by the access system of the managed computer system, a managing computer system to search open tickets which are managed by the managing computer system for the managed computer system;

requesting, by the access system of the managed computer system, the administrator to choose at least one ticket from the open tickets, in response to determine that the open tickets are found;

redirecting, by the access system of the managed computer system, the administrator to the managing computer system for a new service management ticket generated by the managing computer system, based on at least one of;

determining that the open tickets are not found and determining that the administrator does not choose the at least one ticket from the open tickets;

receiving, by the access system of the managed computer system, from the managing computer system, the new service management ticket generated by the managing computer system; and

granting, by the access system of the managed computer system, the administrator the access to the managed computer system.

8. The method of claim 7, further comprising:

checking, by the access system of the managed computer system, in response to determining that the administrator chooses the at least one ticket from the open tickets, status of the at least one ticket; and

granting, by the access system of the managed computer system, the administrator the access to the managed computer system, in response to determining that the status of the at least one ticket is valid.

9. The method of claim 8, further comprising:

denying, by the access system of the managed computer system, the administrator the access to the managed computer system, in response to determining that the status of the at least one ticket is not valid.

10. The method of claim 8, further comprising:

allowing, by the access system of the managed computer system, the administrator read-only access to the managed computer system, in response to determining that the status of the at least one ticket is not valid.

11. The method of claim 7, further comprising:

recording, by the access system of the managed computer system, on a log the access of the administrator; and

transferring, by the access system of the managed computer system, information of the log to the managing computer system.

12. The method of claim 7, wherein the access system is a firewall to the managed computer system, a proxy server, or a virtual private network server, and wherein the access system is an entry point to one or more managed computer systems.

13. A computer program product for managing and controlling access of an administrator to a managed computer system, the computer program product comprising:

one or more computer-readable tangible storage devices and program instructions stored on at least one of the one or more tangible storage devices, the program instructions comprising;

program instructions to receive, by the access system of the managed computer system, from the administrator, a request for access to the managed computer system;

program instructions to request, by the access system of the managed computer system, a managing computer system to search open tickets which are managed by the managing computer system for the managed computer system;

program instructions to request, by the access system of the managed computer system, the administrator to choose at least one ticket from the open tickets, in response to that the open tickets are found;

program instructions to check, by the access system of the managed computer system, in response to determining that the administrator chooses the at least one ticket from the open tickets, status of the at least one ticket;

program instructions to redirect, by the access system of the managed computer system, the administrator to the managing computer system for a new service management ticket generated by the managing computer system, in response to determining that the open tickets are not found;

program instructions to receive, by the access system of the managed computer system, from the managing computer system, the new service management ticket; and

program instructions to grant, by the access system of the managed computer system, the administrator the access to the managed computer system, based on at least one of;

determining that the status of the at least one ticket is valid and determining that the new service management ticket is received.

14. The computer program product of claim 13, further comprising:

program instructions to deny, by the access system of the managed computer system, the administrator the access to the managed computer system, in response to determining that the status of the at least one ticket is not valid.

15. The computer program product of claim 13, further comprising:

program instructions to allow, by the access system of the managed computer system, the administrator read-only access to the managed computer system, in response to determining that the status of the at least one ticket is not valid.

16. The computer program product of claim 13, further comprising:

program instructions to redirect, by the access system of the managed computer system, the administrator to the managing computer system for a new service management ticket generated by the managing computer system, in response to that the administrator does not choose the at least one ticket from the open tickets;

program instructions to receive, by the access system of the managed computer system, from the managing computer system, the new service management ticket generated by the managing computer system; and

program instructions to grant, by the access system of the managed computer system, the administrator the access to the managed computer system.

17. The computer program product of claim 13, further comprising:

program instructions to record, by the access system of the managed computer system, on a log the access of the administrator; and

program instructions to transfer, by the access system of the managed computer system, information of the log to the managing computer system.