---
type: entity
title: UMS
tags: [account-management, resource-request, university-it, administration, it-resources, tool, university-infrastructure, resource-provisioning, software, identity-management, portal, resources, identity, urz, authentication]
related: ["zentraler-nutzeraccount", "mailing-list-server", "universitatsrechenzentrum-urz", "email-spam-virus-protection", "matrix", "ressourcenverwaltung", "ressourcen-beantragen", "ressource-genehmigen", "restic", "2-factor-authentication", "ressource-beantragen", "device-registration", "groupware"]
created: 2026-06-30
updated: 2026-07-01
sources: ["output/rz_uni_greifswald_de_dienste_allgemein_e_mail_listenserver.md", "output/rz_uni_greifswald_de_dienste_allgemein_e_mail_spam_virenschutz.md", "output/rz_uni_greifswald_de_dienste_allgemein_instant_messaging_chat_matrix_anmelden.md", "output/rz_uni_greifswald_de_dienste_allgemein_ressourcen.md", "output/rz_uni_greifswald_de_dienste_allgemein_ressourcen_ressource_genehmigen.md", "output/rz_uni_greifswald_de_dienste_allgemein_zentrale_datenspeicherung_backup_allgemei.md", "output/rz_uni_greifswald_de_dienste_allgemein_zentraler_nutzeraccount.md", "output/rz_uni_greifswald_de_dienste_allgemein_zentraler-nutzeraccount_2_faktor_authenti.md", "output/rz_uni_greifswald_de_dienste_allgemein_zentraler_nutzeraccount_2_faktor_authenti.md", "output/rz_uni_greifswald_de_dienste_allgemein_zentraler_nutzeraccount_nutzeraccount_bea.md", "output/rz_uni_greifswald_de_dienste_technische_infrastruktur_geraeteregistrierung.md", "output/rz_uni_greifswald_de_dienste_webdienste_groupware_grundlegende_einstellungen.md", "output/rz_uni_greifswald_de_support_faq_zwei_faktor_authentifizierung_2fa.md"]
---

# UMS

**UMS** (Central Account Management system / Account Management System / Accountverwaltung / User Management System) is the central electronic portal and tool used at the Universität Greifswald and by the [[universitatsrechenzentrum-urz]] for managing user identities, managing user account settings, and requesting and managing IT resources. It serves as the primary interface between the user and the [[universitatsrechenzentrum-urz]] for the provisioning of network access and other digital services.

## Identity Management
The UMS acts as the authoritative source for user identity data across various university services and serves as the central interface for managing the [[zentraler-nutzeraccount]] and general university-wide user account settings.

### Account Lifecycle and Activation
- **Account Lifecycle**: Handles the requesting, approving, and activating of [[zentraler-nutzeraccount]] instances.
- **Account Activation**: New users must use the platform to change their initial password to activate their account.
- **Password Management**: Users can change their passwords via the `Mein Account` $\rightarrow$ `Kennwort` section.
- **2FA Activation**: The UMS serves as the interface for the mandatory activation of Two-Factor Authentication. Upon the first login with a username and password, the UMS presents the TOTP setup dialog where users can link their account to a TOTP-capable application via QR code or a manual secret.

### Primary Email Address
A key function of the UMS is the designation of a **Primary Email Address**. Since users may have multiple email aliases, the address marked as "Primary" in the UMS is the one automatically synchronized and displayed in the [[groupware]] profile.

### Guest Account Workflow
- **Guest Workflow**: Manages the specific electronic workflow for guest accounts, including the routing of requests to designated personal approvers.
- **Integration**: The UMS is integrated with the university's identity management systems to ensure that only authorized personnel (using personal, non-functional accounts) can approve access for external guests.

## Resource Management
The UMS serves as the primary interface for [[ressourcenverwaltung]] and requesting various IT resources.

### Resource Requesting and Approval
- **Requesting**: Users use the UMS to apply for various IT resources ([[ressourcen-beantragen]]), request new resources, extend existing ones, or change the designated responsible party for a resource.
- **Approval**: 
    - Designated approvers use the UMS to review and decide on pending resource requests via the **Genehmigung $\rightarrow$ Ressourcen-Anträge** menu ([[ressource-genehmigen]]).
    - Staff can authorize account requests via the path `Genehmigung` $\rightarrow$ `Account-Anträge genehmigen`.

### Provisioned Resources
Users can manage specific technical assets provided by the [[universitatsrechenzentrum-urz]], including:
- **IP Addresses**
- **Web Space**
- **Device Registration**: Requested via the path `Meine Ressourcen` $\rightarrow$ `Ressource beantragen` $\rightarrow$ `Geräteregistrierung` ([[device-registration]]).
- **Mailing Lists**: Requested via `Meine Ressourcen` $\rightarrow$ `Beantragen` $\rightarrow$ `Verschiedenes` $\rightarrow$ `Mailingliste`. Users must provide a description of the list's function (e.g., distribution vs. discussion) and adhere to specific naming conventions.
- **Restic Backup-Service**: Available for server systems under the "Verschiedenes" (Miscellaneous) category.

### Lifecycle and Administrative Management
- **Renewal**: Resources (such as the Restic Backup-Service) must be renewed every 3 years.
- **Automatic Deletion**: If a resource is not renewed, it is automatically deleted after 12 weeks. For backup services, this includes the deletion of all associated backup and archive data.
- **Administrative Access**: The UMS allows designated [[ressourcenverantwortliche]] to manage resources, including the ability to view or change 2FA settings for [[funktionsaccount]] entities.

## Service Activation and Security Controls

### Consents
Certain services require explicit user consent before they can be activated. For example, access to the [[matrix]] home server is only granted after the user has provided a consent declaration within the UMS "Consents" section.

### Email Service Controls
The UMS provides specific controls for email services:
- **Email Rate Limit Management**: Users can access account settings to temporarily deactivate the email sending rate limits (normally 200 emails/24h) for a period of 4 hours.
- **Functional Accounts**: For email functional accounts, unlimited mail sending can be configured within the resource detail view.

### Security and Lockout Behavior
To prevent brute-force attacks, the UMS employs a security lockout mechanism (similar to Fail2Ban):
- **Trigger**: 5 consecutive failed login attempts or 5 incorrect 2FA (TOTP) entries.
- **Symptom**: The user may encounter a "white screen" (page fails to load) or an "Internal Error!" message.
- **Penalty**: The user is blocked from the system for **30 minutes**.