Information Technology News

UCI Identity and Access Management Website

IAT-NACS provides a suite of identity management, authentication, and authorization services collectively referred to as Identity and Access Management services. A group of web pages has been developed describing UCI network identities (e.g., UCInetIDs), how they work, and how they will evolve.  There is a wealth of information for those interested in technical details.  Here are some highlights.

The campus directory provides contact information for campus affiliates, and allows you to control certain information pertaining to your network presence on campus, such as the server your UCI email should be sent to.

UCInetIDs are network identities issued to campus affiliates.  With your UCInetID and password, you can access a variety of online services, many through WebAuth.  IAT has recently extended UCInetID authentication, with appropriate limits, to applicants for admission, and third parties for whom some services will be provided.

UC Trust is a system for using each campus’s network authentication system (UCInetIDs at UCI) to access services, as appropriate, provided by other UC campuses as well as some companies whose services are restricted to UC affiliates.

Because UCInetIDs are so vital to conducting University business, IAT has developed plans for enhancing UCInetID security.  Also, as the number of users, past and present, grows, it will be necessary to upgrade UCInetIDs beyond their current 8-character limit.  You can read about this project online as well.

The Life and Death of a UCInetID

Many campus network and computer services are reserved for faculty, staff, and students, and your network identity (UCInetID) is the key to accessing them.

People who separate from the University are no longer eligible for some or all such services, and their UCInetIDs are subject to deletion.  It may be helpful to understand the policies for UCInetID deletion.

The UCInetIDs of faculty and staff who separate from the University become eligible for deletion when their records are removed from the campus payroll database.  In general, you will receive notification of pending deletion 60 days after removal from the payroll database, and the actual deletion will take place 30 days later.  Retirees may request to retain their UCInetID and certain services, such as email.  Faculty awarded emeritus status retain full UCInetID privileges.

Students lose email and services 1 year after they leave unless they graduate and apply for lifetime alumni services, although access to Registrar services continue for at least 2 years.

UCInetIDs for Applicants

NACS has expanded the availability of campus network identities this year for the first time to include applicants for admission to the university.

Since applicants now have the ability to officially authenticate to UCInet, units such as the Registrar, Admissions, Financial Aid, and Housing can offer online information and support to potential students without creating their own systems of identification, providing applicants more uniform and convenient access to these resources.

NACS issued over 64,000 UCInetIDs to applicants this year.

Password Security

NACS has recently upgraded its password infrastructure to allow for longer passwords. Longer passwords are more secure because it becomes prohibitively difficult to discover a password by computationally grinding through all the possibilities. The “rules” for choosing a good password still stand: use a combination of upper- and lower-case letters, numbers, and punctuation; don’t use recognizable strings (dictionary words, runs of keys as they appear on the keyboard, multiple copies of the same letter) or personal information (name, UCInetID, birthday, employee ID number). A summary of password guidelines can be found at http://www.nacs.uci.edu/ucinetid/password.html

It is also strongly recommended to change your password at least once a year. Long-lived passwords accumulate risk as the number of times and places they are used increases. One of the major risks today’s users are exposed to are so-called “key loggers,” small programs that hide on a computer and watch everything that is typed. Regular security scans (e.g., virus checkers), applying security patches, and caution with regard to opening email attachments or visiting unfamiliar web sites will help protect you from key loggers.

Security may seem inconvenient, and costs the University resources that we’d rather use in other ways, but it is an inescapable part of providing reliable network services, and much cheaper than the loss of valuable research data or identity theft. NACS will continue to watch the security landscape, make necessary advances in network security, and work with users and departments to help protect UCI.

Manage Your Password

An increasing number of network resources are accessible using your UCInetID and password. This is a convenience analogous to a master key, but as with such a key, you want to be very careful to protect it.

You should plan to change your UCInetID password with some regularity, perhaps once a quarter. NACS’s tools for managing your UCInetID have been improved in several ways which will make UCInetIDs more secure, and help you manage your password.

Choosing a password can be a daunting task. You must choose one that no one can guess but you can remember! To make passwords more difficult to guess, the “rules” for a valid password include:

• Password must be between 6-8 characters.
• Password must contain at least one alpha character [a-z]. Note that passwords are case-sensitive – they can have both upper and lower case letters.
• Password must contain at least one non-alpha character, which is neither the first nor last character.
• Password can’t contain any part of your name, forward or reverse.

The most significant recent change to these rules is that all the standard printable non-alphabetic characters are allowed, and since using such characters makes a password harder to guess or crack, NACS encourages their use.

With a more obscure password, there is always the risk that you yourself will lose your password. NACS now allows you to select a secret “question and answer” that allows you to reset your UCInetID password.

More information about UCInetID passwords is available at http://www.nacs.uci.edu/ucinetid/password.html .

Help for activating or resetting your UCInetID password is at http://ucinetid1.nacs.uci.edu/activate/menu.html .

Improved Activation Web Page

Many network services are accessible using your campus network identity — your UCInetID. New staff and students use the “Activate” system to initialize their UCInetID and choose a password. Now, the system has been updated to make activation easier. In particular, the process for recovering from a forgotten password is now much simpler.

The previous system required users to negotiate several web pages. Now, all the required prompts are on a single web page, in four sections.

The first section is used to enter personal identification information. The second section permits you to select your UCInetID password. The third section is a new feature, called the Password Reset Question and Answer. By using this feature, you can reset your UCInetID password if it is lost or forgotten. (Previously, it was necessary to come to NACS with a picture ID.) The final section requires users to agree to the UCI Computer and Network Use Policy.

If an error occurs trying to validate the information, or if the password does not meet the required guidelines, then the user is returned to the same page with an error message indicating the problem. All other data entered is restored to avoid re-typing.

To access the activation system and password changers, go to http://activate.uci.edu/