Summary

The first phase of the AcIS ID System deployment implements a new version of webcreate, the web application by which faculty, staff, and students create and manage their UNIs and unix accounts.

Motivation

The new application enables users to manage their accounts in a secure and straightforward way, based on timely data, without imposing unnecessary burdens or delays on the user. It also lays the groundwork for future improvements in the field of unix account management.

Furthermore, this new application significantly reduces the complexity of the account creation system, thus making the new system significantly more maintainable.

Specific improvements include:

• New application removes several possible attacks that might be used to steal someone's password or social security number.
• Uses authentication data that is roughly 8 hours fresher than previous system's data.
• Allows users to set up their accounts even if they are not listed in the public directory.
• Improved authentication logic allows users to authenticate even when we know feed data about them to be partially faulty (as when a single user has two different ssns).
• Does not require ssn/dob information to authenticate to all account management functions. (This information is required only where no stronger authentication is available.)
• Correctly supports password management for users with multiple accounts.

Details and Timeline

1. Tuesday, October 28th, 2003

   Name	Who is Affected	When	Change Description
   Password Change Page	All users	When changing passwords	Replaces previous "password change" web application. Users no longer required to supply ssn/dob when changing passwords; password changes handled correctly for people with multiple accounts.

2. Wednesday, November 12th, 2003

   Name	Who is Affected	When	Change Description
   Forgot Password Page	All users	When they forget their passwords	Replaces previous "forgot" page. Enables users to set up passwords using more current data, with improved logic for user input and ssn/dob matching rules.
   resetpw	AcIS Staff	When helping users who forgot their passwords	Replaces 'resetpw' function in cid helpdesk program. Enables helpdesk to reset passwords regardless of ingres database lockups.

3. Wednesday, December 17th, 2003

   Name	Who is Affected	When	Change Description
   Account Create Page	All users	When setting a password for the first time; when requesting a unix account	Replaces previous "account create" web application. Enables users to set initial passwords using more current data, with improved logic for user input and ssn/dob matching rules; users no longer required to supply ssn/dob when requesting a unix account.