Tissue Banks & Pathology Tools Workspace

Developer / Adopter Weekly Meeting

Thursday, June 19, 2008

8:30 AM to 10:00 AM (ET)

**Dial-in Number**: 1-888-790-1566

 

**International Number**: 1-773-681-5890

 

**Passcode**: 97195

 

**Breeze Session Details:
[[https://webmeeting.nih.gov/catissuecore/]{.underline}](https://webmeeting.nih.gov/catissuecore/)**

**Meeting Facilitator:** Linda Schmandt (LiMing is on vacation)

Tara McSherry, Michael Krauthammer, David Steffen, Amber McMahon,
Srikanth Adiga, Devjani Chatterjee, Jack London, Javed Siddiqui, Susanne
Ragg, Jim McCusker, Gunther Schadow, Edmond Abrahamian, Linda Schmandt,
John Milnes (I may have missed some folks)

MINUTES

1.  caTissue Core 1.2.2 and caTissue Suite 1.1 grid security (25 min)

    a.  Explanation of current options (what caTissue and caGrid provide
        by default, what Yale implemented) (Sri, Jim, Linda)

    b.  Adopter requirements and issues

    c.  Next steps

> Discussion: Per Jim, the NCI creates accounts that authenticate
> against an LDAP server (for internal people) and against Dorian (the
> rest of us). All that's verified for the latter is that the email
> address you provide exists. Grid accounts (including for the
> production grid) are granted automatically upon application. To query
> "on the grid" you have to log into the Grid portal and provide your
> valid email and the password you created when you requested the grid
> account.
>
> To achieve greater control over access to your caTissue instance , you
> have to use Grid Grouper. This allows you to specify one or more lists
> of grid identities that your instance of a grid service (e.g.
> caTissue) will accept. When you call the Grid service, it checks the
> group membership(s) of the account that logged into the Grid. Since
> Yale set up Grid Grouper and has not added any of the account info for
> the rest of us yet, if any of us logs into the Grid portal and tries
> to query the Yale instance of caTissue we will get a message that our
> Grid identify is not recognized.
>
> Grid Grouper has fairly sophisticated features that allow for
> composite lists, so (for example) each of our institutions could set
> up a list and manage it for our users, and then each other adopter
> institutions could specify in their instance of Grid Grouper that
> members of our group are allowed.
>
> Yale is using NCI's Dorian server. caTissue team is working on the
> anon issue. Dorian and Grid Grouper are independent
>
> As Jim has posted, caTissue Suite currently allows anonymous access.
> This is because there is a configuration parameter that is set to
> allow it (this was an accident and will be fixed.) Anyone who has
> already deployed the caTissue Core 1.2.2 grid service should change
> this parameter to disallow anonymous access. The distribution of Core
> 1.2.2 has now been changed, so anyone who deploys it in the future
> will have the parameter set correctly by default.
>
> Within a single caTissue Grid service instance, there's only one
> recognized role: scientist. (so if we use Grid Grouper for Core 1.2.2
> and Suite 1.1 the application will only recognize one group).
>
> NOTE that this is not how Grid authentication and authorization will
> operate in the future. The Grid infrastructure is being set up to
> recognize 4 standard levels of identity, where 1 is the least vetted
> and 4 is the most. (See Steve Langella's email, attached.) Each
> institution will be able to configure its grid services to require a
> certain minimum level of credentials.
>
> TJU has the grid sw installed, but still needs to use Introduce to
> edit the grid service and specify groups. (Jim will be on vacation
> next wk, so he can help John R with this this week or not until wk of
> 7/7.
>
> Michael -- 2 issues -- privacy (IRB). Is the data proprietary? If so,
> you may just want researchers to access it. Jack -- would like to know
> that .edu, bah.com, .gov, saic.com, persistent.com. Penn: counting on
> a de-id script to migrate to 1.2.2 -- they will use this to create a
> de-identified instance for the grid. Tara will discuss security reqs
> with Mike F. Prostate SPOREs had decided that they cannot use the grid
> because of the security, but it sounds like they could with Grid
> grouper.

Jim : per Steve L, you can provision the user accounts in caTisssue
individually. ?? Sri?

Michael: Eventually operate our own Dorian server for caTissue?

Gunther: No one should feel they have to be set up a separate,
de-identified instance of caTissue for public consumption. The NCI
should be serious about vetting up these identities. Our time is wasted
if this isn't seriously supported. The identify provision needs to be
set up to support real data sharing. This needs to work w/out
de-identified instances. So far Indiana has limited access to their
public node by allowing only specified IP addresses. Provisioning of
grid accounts will have to be on a high quality level for production
deployment and use of grid.

2.  Date of C1 end user meeting (5 min)

> Linda will notify everyone by end of day Friday.

3.  Bug fix/triage updates -- Edmond/Linda (5 min): Everyone has
    verified the ones they can for now -- no other adoption action
    required.

4.  Model changes -- Sri (not confirmed) (30 min): Mark and Poornima
    were not on the call, so we did not do this.

5.  Open discussion (15 min)

6.  Who is available for a Dev-Adopter meeting on Thu, 6/26? Tara ,
    Amber, Susanne, Jack, Devjani, Michael, Javed, David, Sri . Pitt
    representatives (Linda and John) are not. Linda will check will
    LiMing -- if he can facilitate next week, then the meeting will
    occur.