Method and system for managing and controlling direct access of an administrator to a computer system

• US 9,471,804 B2
• Filed: 04/08/2015
• Issued: 10/18/2016
• Est. Priority Date: 02/19/2013
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Anderson, Eric M., Dawson, Christopher J., Nelson, Leslie A., Singletary, Brett W.
• Primary Examiner(s): Abedin, Shanto M
• Application Number:
  US14/681,378
• Publication Number:
  US 20150213287A1
• Time in Patent Office: 559 Days
• Field of Search: 726/1, 726/4, 726/19, 726/21, 713/1, 705/7.13, 705/7.14, 705/7.26, 705/304
• US Class Current: 1/1
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: G06F 21/45 Structures or tools for the administration of authentication
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database

Abstract

A method, computer program product, and computer system for managing and controlling direct access of an administrator to a computer system. An interceptor application resides on the computer system and intercepts the direct access. The interceptor application receives a request for the direct access to the computer system and determines whether the administrator requests for a new ticket. The interceptor application redirects the administrator to log onto the service management system for generating the new ticket by the service management system, in response to determining that the administrator requests for the new ticket or open tickets are not found. The interceptor application receives from the service management system the new ticket and grants the administrator the direct access to the computer system.

Claims

1. A method for managing and controlling direct access of an administrator to a computer system, the method comprising:

receiving, by an interceptor application which resides on the computer system and intercepts the direct access, from the administrator, a request for the direct access to the computer system;

sending, by the interceptor application, the administrator a message informing that the computer system is under service management;

determining, by the interceptor application, whether the administrator requests for a new ticket;

requesting, by the interceptor application, a service management system to search open tickets, in response to determining that the administrator does not request for the new ticket, wherein the service management system comprising a ticketing system and a configuration management database (CMDB) storing the open tickets;

redirecting, by the interceptor application, the administrator to log onto the service management system for generating the new ticket by the service management system, in response to determining that the administrator requests for the new ticket and the open tickets are not found;

receiving, by the interceptor application, from the service management system, the new ticket;

allowing, by the interceptor application, the administrator with the new ticket to access the computer system;

requesting, by the interceptor application, the administrator to choose at least one ticket from the open tickets, in response to that the open tickets are found; and

checking, by the interceptor application, status of the at least one ticket to determine whether the at least one ticket is valid; and

granting, by the interceptor application, the administrator the direct access to the computer system, in response to determining that the at least one ticket is valid.

2. The method of claim 1, further comprising:

denying, by the interceptor application, the administrator the direct access to the computer system, in response to determining that the at least one ticket is not valid.

3. The method of claim 1, further comprising:

allowing, by the interceptor application, administrator read-only access to the computer system, in response to determining that the at least one ticket is not valid.

4. The method of claim 1, further comprising:

recording, by the interceptor application, on a log the direct access of the administrator; and

transferring, by the interceptor application, information of the log to the service management system.

5. The method of claim 1, wherein the direct access of the administrator to the computer system is through a system console.

6. The method of claim 1, wherein the direct access of the administrator to the computer system is through a mechanism of bypassing boundary check.

7. A computer program product for managing and controlling direct access of an administrator to a computer system, the computer program product comprising:

one or more computer-readable tangible storage devices and program instructions stored on at least one of the one or more computer-readable tangible storage devices, the program instructions comprising;

program instructions to receive, by an interceptor application which resides on the computer system and intercepts the direct access, from the administrator, a request for the direct access to the computer system;

program instructions to send, by the interceptor application, the administrator a message informing that the computer system is under service management;

program instructions to determine, by the interceptor application, whether the administrator requests for a new ticket;

program instructions to request, by the interceptor application, a service management system to search open tickets, in response to determining that the administrator does not request for the new ticket, wherein the service management system comprising a ticketing system and a configuration management database (CMDB) storing the open tickets;

program instructions to redirect, by the interceptor application, the administrator to log onto the service management system for generating the new ticket by the service management system, in response to determining that the administrator requests for the new ticket and the open tickets are not found;

program instruction to receive, by the interceptor application, from the service management system, the new ticket;

program instructions to allow, by the interceptor application, the administrator with the new ticket to access the computer system;

program instructions to request, by the interceptor application, the administrator to choose at least one ticket from the open tickets, in response to that the open tickets are found; and

program instructions to check, by the interceptor application, status of the at least one ticket to determine whether the at least one ticket is valid; and

program instructions to grant, by the interceptor application, the administrator the direct access to the computer system, in response to determining that the at least one ticket is valid.

8. The computer program product of claim 7, further comprising:

program instructions to deny, by the interceptor application, the administrator the direct access to the computer system, in response to determining that the at least one ticket is not valid.

9. The computer program product of claim 7, further comprising:

program instructions to allow, by the interceptor application, administrator read-only access to the computer system, in response to determining that the at least one ticket is not valid.

10. The computer program product of claim 7, further comprising:

program instructions to record, by the interceptor application, on a log the direct access of the administrator; and

program instructions to transfer, by the interceptor application, information of the log to the service management system.

11. The computer program product of claim 7, wherein the direct access of the administrator to the computer system is through a system console.

12. The computer program product of claim 7, wherein the direct access of the administrator to the computer system is through a mechanism of bypassing boundary check.

13. A computer system for managing and controlling direct access of an administrator to a computer system, the computer system comprising:

one or more processors, one or more computer-readable tangible storage devices, and program instructions stored on at least one of the one or more computer-readable tangible storage devices for execution by at least one of the one or more processors, the program instructions comprising;

program instructions to receive, by an interceptor application which resides on the computer system and intercepts the direct access, from the administrator, a request for the direct access to the computer system;

program instructions to send, by the interceptor application, the administrator a message informing that the computer system is under service management;

program instructions to determine, by the interceptor application, whether the administrator requests for a new ticket;

program instructions to request, by the interceptor application, a service management system to search open tickets, in response to determining that the administrator does not request for the new ticket, wherein the service management system comprising a ticketing system and a configuration management database (CMDB) storing the open tickets;

program instructions to redirect, by the interceptor application, the administrator to log onto the service management system for generating the new ticket by the service management system, in response to determining that the administrator requests for the new ticket and the open tickets are not found;

program instruction to receive, by the interceptor application, from the service management system, the new ticket;

program instructions to allow, by the interceptor application, the administrator with the new ticket to access the computer system;

program instructions to request, by the interceptor application, the administrator to choose at least one ticket from the open tickets, in response to that the open tickets are found; and

program instructions to check, by the interceptor application, status of the at least one ticket to determine whether the at least one ticket is valid; and

program instructions to grant, by the interceptor application, the administrator the direct access to the computer system, in response to determining that the at least one ticket is valid.

14. The computer system of claim 13, further comprising:

program instructions to deny, by the interceptor application, the administrator the direct access to the computer system, in response to determining that the at least one ticket is not valid.

15. The computer system of claim 13, further comprising:

program instructions to allow, by the interceptor application, administrator read-only access to the computer system, in response to determining that the at least one ticket is not valid.

16. The computer system of claim 13, wherein the direct access of the administrator to the computer system is through a system console.

17. The computer system of claim 13, wherein the direct access of the administrator to the computer system is through a mechanism of bypassing boundary check.