Taking configuration management data and change business process data into account with regard to authorization and authentication rules

摘要

An approach receives a request from a user, typically a change implementer, on a computer system. The request includes a user identifier and a requested action. A current timestamp corresponding to a computer system clock is retrieved. Scheduled changes are retrieved from a data store accessible by the processor. The current timestamp is compared to the scheduled change periods. The requested action is allowed if the comparison reveals that the current timestamp is within one of the retrieved scheduled changes, and the requested action is denied if the comparison reveals that the current timestamp is outside of the retrieved scheduled change periods.

主权项

1. A processor-implemented method comprising:
receiving a request, wherein the request includes a user identifier, a system identifier, and a requested command, wherein the requested command comprises a command to be executed on a system corresponding to the system identifier; retrieving one or more scheduled change periods from a data store accessible by the processor, wherein the retrieved scheduled change periods correspond to the system identifier included in the request; determining if the requested command is included in a predetermined list of allowed commands associated with the user identifier included in the request; in response to determining that a current time is within at least one of the retrieved scheduled change periods and that the requested command is included in the predetermined list of allowed commands associated with the user identifier included in the request, executing the requested command; in response to executing the requested command, determining that a system-wide restriction period is reached, wherein the current time is not within any of the retrieved scheduled time periods; and in response to determining that the system-wide restriction period is reached, disallowing one or more subsequent requested commands, and informing a user associated with the user identifier that the one or more subsequent commands are disallowed.