Special Access (general) documentation

 About

This article goes over Special Access for individuals at K-State.

 Audience

  • Service Desk Staff

 Details  

Rules:

  1. people cannot request for themselves If they are both the requester and the target eID close the ticket with this response:  Unfortunately, you are not able to request special access to K-State resources for yourself. This form must be completed by someone in your unit or department with administrative authority to provide the assertion that you need this access.  Please have them complete the Special Access form on your behalf.
     
  2. No one gets more then one year access – people lobby for more from time to time but this provides a check point to examine access.  Even internal KSU people should not get this although special exceptions do make sense from time to time.
     
  3. Give people Connect-student or Connect-employee  if they are getting access to services.  They don’t know they need it but we need people to have it or they can get Sign in and out errors.
     
  4. People can request more than 1 eID per form. You can do more then one per form You need to enter them comma separated with no spaces so like eIDone,eIDtwo,eIDthree,eIDfour
     

The most used ‘WHY’ category items are:

sal-emp-access - give access for Salina employees to their computers

RESEARCH – This is requested by academic depts. For visiting scholars, researchers, grad students from other schools working a project, etc.   They usually check every box but are not allowed to get library access as they are not current students or staff.  See Library note below.

PRE-EMPL - Some people/places do not have the personnel officers who can do that or they don't know and they submit.  Others are due to something beyond that 30-day bit like they are recurring graduate school employees and the dept wants them whitelisted for a year to cover the times they go on and off the payroll.   Another common example is that they are future instructors and they are trying to get access to resources for them well over 30 days out (usually about 3-4 months out) so they can start preparing now instead of 30 days before they start.

VENDOR – Mostly requests from sys admins and IT folks around campus to grant VPN or email access to external vendor type eIDs.

SPECIAL   - This one is the catch-all for requests that don’t fit into another.  The categories have been adjusted so they are usually is one for the request but sometimes I need this.

SUROP – These are to grant access to visiting students participating in some summer program.  most fac/staff coordinators who run a summer program like Physics, ENGG, Chem, know to submit them all in 1 ticket.  Some send an attached file of the user details instead of including in ticket.  Most requests come in June but a few come in July and there are always last minute additions of students or changes ,dropouts, etc and so we get a few more throughout the summer.

COMMBUIL – these are requested by student life and are mostly campus ministers but could be a few other types.

There are others like President that you use when you get a request from that office or Retired or Housemom that are pretty obvious.

Below is an example setup:

Accounts (services you are granting permission to)

Any one not mentioned below is not in use.  See image below.  The purple ones are not in use.

'dce-ksol' grants Axio access

'lms' grants Canvas access.  If someone asks for K-State Canvas access, please check both.  Once Axio goes away only LMS will remain as a choice

'zcsemail' is still the one for any/all email access

'cts-ads-lab' is a broad coverage one.  This gives access to ADS, wireless, computing labs, Housing and Dining, Rec services.

‘pubs-ems’  - this gives people access to K-State Alerts.  I usually give this to people if they are going to be on campus for any length of time so they can chose to use it if they want.  Most won’t.

'connect-employee' or 'connect-student' - people don't request this because it is not on the list but if they get any access to email, labs, library or KSOL they need to get 'connect-employee' or 'connect-student' also.  That gives them access to the default Connect portal that one gets to from the homepage and other places. 

NOTE: SUROP people need the student one, all others need the employee one.  Vendor do NOT need it.

NOTE: when a VPN only vendor category request comes in, they almost always need to be escalated to the NOC to be put into a security group after they get 'cts-ads-lab'.  I give them that, then reply with 'completed as requested and forwarding on to NOC for adding to the proper security group.'  Then I switch the ticket to the NOC and 'work in progress' and save it.

Library-checkout and Adriana Gonzalez-proxy request  - Library requests for anyone but a PRE-EMPL grant must go through Adriana Gonzalez at the library. She must approve any library special access requests.  I forward her the SN ticket email I get that contains all the info and she contacts the requestor for more info then informs us of her decision.

So when someone requests library access along with other services requested go ahead and grant all the other parts of the request (if it makes sense) and then send them this as a response.  I also close the ticket so they have to re-open it if they want to add the library request back in.

“Access for webmail, wireless, K-State Canvas and computer labs [NOTE: or whatever you specifically granted them] ...

 ... have been completed as requested.  However, Library services require additional approval and can be requested on your behalf.  If you feel that additional library services are still required, please respond to this ticket. Once that approval has been granted or denied, we will update this ticket with additional information.. The library checkout policy for visitors can be found athttp://www.lib.k-state.edu/check-out-policies and here are the important details:

-Visiting Faculty

K-State Libraries provides borrowing privileges to visiting faculty, researchers, and scholars. “Visiting scholars” or “visiting faculty” is defined as users who are not employed by K-State, but are visiting from other academic institutions for the purpose of short-term instruction, research, and scholarship.  Visiting scholars and faculty may register at Library Help, on the 2nd floor of Hale Library, by presenting one of the following:

   -Current photo identification from their home academic institution or an OCLC/ARL Reciprocal Faculty Borrowing Program card
   -Letter of introduction from sponsoring K-State faculty or department and current state-issued identification.

This card is used for borrowing K-State Libraries materials only and does not provide access to other library services (such as Interlibrary Loan) or online resources outside of the libraries. Visiting scholars and faculty must observe K-State Libraries check out policies."

Visiting researchers and faculty can access most library electronic resources from computers in the library or elsewhere on campus.  Access from off-campus computers requires a special request.

If you feel that additional library services are still required, please respond to this ticket."

Expire Action:   This is always set to N – disable normally.  That keeps our notification cycle intact and is the best choice in 99% of cases.

R – means it will NEVER expire.  And no one actually sees this list to review so it is not a good choice except in extreme cases.

Q – expire immediately is what I do for very short-term date requests sometimes.  People who are only getting an eID to do one specific vendor job say and then don’t expect to keep the eID, can expire immediately without all the email notifications. 

Special Cases:

GPIDEA and their students each term – every term we get a list of 30-40- GPIDEA students who are external students to K-State but taking K-State courses.  They are granted services as if they are enrolled, students.  They get dce-ksol, lms, email, library-proxy and connect-student.  We are sent a spreadsheet and they add oney-twosy after that and they do NOT complete the form, they do this by direct contact with Scott Finkeldei.   gpideacc@ksu.edu is the eID of the person who coordinates this.

IDEA Center and NISTAC employees – once a year a person from these shops sends us a list of their employees to reauthorize for a year

campus ministers and Greek affairs - office of student life – eID lmoody sends a list yearly.  They should have email, wireless, Alerts, Connect. Greek affairs rarely contacts us.

Finally, any questions or unclear cases, escalate to Identity Management --Scott Finkeldei.  I can still serve as Tier 3 on this.

Details

Article ID: 761
Created
Tue 8/9/22 12:54 PM
Modified
Wed 11/30/22 4:30 PM