DRN Demonstration

Someone just remembered for me that I never summarized the results of our Harvard Distributed Research Network research project.

Ken will ultimately write up the findings, but until then, I thought I'd make a few comments.

We presented to the DRN/DEcIDE group on February 19th at 230pm. The group included: DEcIDE centers at the HMO Research Network Center for Education and Research on Therapeutics and the University of Pennsylvania and the participating health plans: Geisinger Health System, Group Health Cooperative, Harvard Pilgrim Health Care, HealthPartners, Kaiser Permanente Colorado, and Kaiser Permanente Northern California

I've uploaded the presentation to the wiki.

The short story is that we demonstrated secure transfer of SAS programs over the PHGrid nodes using the PHGrid SSTS service, remote execution of the program at clinical partners (on synthetic data) and then combining the aggregate results together in the NCPHI lab using open source spreadsheet software (StarOffice).

DiSTRIBuTE's Aggregate Data Model

John Stinn reminded me of the DiSTRIBuTE's Aggregate Data Model. This summer, the PHGrid team met with Ross Lazarus and the BioSense epis about the potential structure of an Aggregate Minimum Data Set (written about earlier on this blog).

The International Society for Disease Surveillance has a project called DiSTRIBuTE (aside to future project namers- name your project something that is easily googlable) that seeks to collect aggregate data on ILI. DiSTRIBuTE uses a minimal aggregate data structure of:
| date | zip3 | age group | fever count | denominator |

This is similar to that proposed by Dr. Lazarus for use at Harvard ESP.

PHGrid Service Registry 0.1 (beta)

When the PHGrid collaborators met after the PHIN Conference, one of the ideas was to set up a place where all the PHGrid collaborators can share descriptions of services they developed, services they are planning or even services they want to develop.

I just created a very basic service registry on the wiki available at http://sites.google.com/site/phgrid/Home/service-registry that contains the services that have been developed or that I know of as of now.

This registry initially serves as a human readable repository of service information, but eventually we will extend this with a UDDI registry and Index services that provides a standards based search for services.

This is of course a tiny step, but it is a start. Now we just have to get each service provider add in details and links for their services. Peter took the first step and went ahead and created a page for the RODSA-DAI services and client. This can be used as an example for how other services can be documented.

caGridTransfer Service - Successful Upload

I have managed to successfully upload a file from the client to the server. Globus was running without securtiy.I need to work on persisting the received data to the local file system. Unfortunately this does not seem to be part of the caGridTransfer Service API.

caGridTransfer Service

The basic caGridTransfer Service was successfully deployed to the staging and dallas nodes.

Found a interesting twist with the caGridTransfer Service, when trying to undeploy the service, it breaks the Globus container. Currently investigating what is causing this problem.

VBrowser Plug-in

I have been in contact with Piter De Boer, primary developer for vBrowser. Piter provided me with some direction and code for creating a custom plug-in for vBrowser. I was also added to the developer mailing for the vBrowser project. I'll begin exploring ways to add actual Grid Services to the vBrowser interface, starting with GridMedLee.

More successful testing of secure grid services!

Ron Price, with the University of Utah CoE, sent over a new demo project this morning to test out the secure invocation of his grid services.

Utah is using cagrid's gridgrouper to manage security configuration (phirg uses manual maintenance of certs at each node), so I created a userid with cagrid (https://cagrid-portal.nci.nih.gov/web/guest/register) and Ron added my cagrid user the PH Grid group.

Ron made it pretty easy to test by providing an Eclipse project export and the required certificates to authenticate with cagrid's Dorian services.

I copied the certificates to the ~.globus folder on my workstation, specified my cagrid provided userid and password, and ran the service from inside Eclipse. Pretty straightforward

When I tried with an invalid password I get an exception thrown back from Dorian (gov.nih.nci.cagrid.authentication.stubs.types.InvalidCredentialFault).

So we tested securely invoking a Utah phGrid service over SSL using the cagrid authentication management from the NCPHI Research Lab grid.

Next steps will be to test out invoking the service using phirg specific credentials.

GridMedlee Progress

Making progress on GridMedlee testing. I have altered the initial client code to add security options. I have gotten it to the point to where I am receiving a error of Unknown CA. In speaking with my team members this issue should be resolvable by running the code from a controlled node rather than my local laptop. I am in the process of moving the code over to the controlled node and will (hopefully) get it running from there.

Along the way I picked up some knowledge with regard to the GlobusCredential class. When the Introduce framework created the test client for GridMedlee there were several versions of the GridMedleeClient method that were created, some included a parameter for a GlobusCredential object. Upon further investigation I found that the GlobusCredential class can be used to create secure credentials.

I will have another update later today after I get the GridMedlee client built on the controlled node.

Testing, Testing and more testing

• I spent the day working with the GridMedLee services and I feel I have made a lot of progress. I modified the client code sent to me to invoke the GridMedLee service. Currently working through what appears to be a security issue with getting a status back from the GridMedLeeContext service. I have some ideas of a few things to do on my end to try to make sure my set up is functioning properly.
  

• I also went back and re-ran the client for the ZipCode service for Utah and I am getting the same message from their service that I am receiving with GridMedlee.

• I also installed WireShark locally to be able to actually view the contents of data being sent between the client and the server.

Stay tuned friends more to come as I delve deeper into Globus security.

Local Globus Install Completed

I completed the local installation of Globus with a Simple CA (using section A.3 from the Globus 4 Programming book as a guide) on my laptop yesterday afternoon. This will allow me to deploy the Columbia medLee project locally for client coding and testing purposes. It took a couple of tries to get the Simple CA installation to function correctly with Globus.

Some of the lessons I learned when installing Globus:

1. Certificates -- always select root install for certificates (option r) rather than the local install (option l)
   
2. Manually copy the *.pem files from globus/etc directory to /etc/grid-certificates directory
3. Edit the system bash resource file to source both the VDT setup and Globus user env scripts so that the necessary environment variables are available after logging into the system
   

NLP & Ramp-Up Progressing

I completed the installation of Ubuntu on my laptop last night and I have installed Globus locally. I installed the Simple CA client to keep everything self contained. I will continue to install the other components in the installation guide before the end of the week.

I have access to both the GridMedLee and Zip Code project on my local box. I will begin writing the GridMedLee client in the morning. Both of the above projects were created using the Introduce tool which produces atuo-generated code client code. My intentions are producing a client outside of the Introduce framework.

Therapeutics Research and Infectious Disease Epidemiology

Tom, Ken and I had a productive call with Jeff Brown, Richard Platt, Roseanne Kue and Suzan Mitchell from the Harvard CoE regarding using grid technology and the research grid with their current process for running SAS code against various SAS data sets.

Currently, SAS programs are emailed to data sources who modify the SAS code, run it and email back the results. The idea is to use grid to send jobs using Globus that will run a SAS script on a Globus node and return the results. This is a big benefit to public health by immediately simplifying the workflow to take out email and manual modification of SAS using Glbus. The real big benefit is that it allows for remote analysis of data sets across remote data sets. No more copying over data sets to epis so they can use the data for research.

Some specific points we covered is that Harvard's timeline is to demonstrate at least 4 nodes running a script and returning the results by January, 2009.

Grid service testing

The University of Utah Center of Excellence has developed a couple of services using cagrid's Introduce service tool.

Today we successfully tested calling out to the public services using the Introduce generated java client and also using a standard SOAP client (soapui) to call the service.

Utah is now applying authentication and authorization controls and we'll test secure invocation. Utah has established their own grid network using Globus/cagrid and we'll test interoperability with Globus certificates issued by Utah and with Globus certificated issued by PHIRG.

RODSAdai Webapp not able to find certification path

Today was pretty much all day trying to hammer against tomcat and getting it to recognize the globus certificates for clients... and I have no idea where such things are controlled within tomcat, and the things I tried didn't fix the problem.

Thus, the "the secure client won't run through tomcat" problem is back, and I still am not sure how to tell tomcat "use these keystores that exist within globus when invoking this client which connects to a secure globus server". The error that is thrown is the familiar "unable to find certification path"

I really have two problems: The first is that I have no idea how to get tomcat to use a keystore other than the default java one for client programs. Ideally it should be made-to pick up the certificates and look up the proxies like the command line clients... something about the tomcat container prevents security policies from being overwritten in the same way they are within the command line clients.

The second problem is that there is tons of stuff written about how to enable tomcat as a secure ogsadai/wsrf server, and it is blocking out google searches of how to enable tomcat to run secure clients which access other globus/wsrf servers with things other than the default keystore.

I have tried several things which haven't worked:

1. Moving client-config.wsdd into the WEB-INF/classes/ directory of the web-app.
2. Modifying server.xml in [tomcat-root]/conf to use the globus certificates for secure access as described by this website: 'http://www.gridlab.org/WorkPackages/wp-5/guide/axis.html#install' and it was really more of an old way of setting up some sort of globus ws server with an old version of globus.
3. importing cog-tomcat.jar into the libs directory (of the webapp and the server), after finding that cog-tomcat seemed to hold several of the security handlers...

I am out of ideas at the moment... Dr. Jeremy Espino is working on setting up his globus/ogsadai environment and then he'll tinker with it too.

I figure there is a workaround to write clients that explicitely invoke the globus security elements... but I imagine I will have to pore over acres of ogsa-dai and wsrf source code to set such things up and any resulting code might be locked to very specific versions of ogsadai and/or globus.

I just feel like there is some "oh, you just set this property in the config file for the webapp" thing I don't know exists... I just have no idea where that is and my attempts to look for it keep getting flushed out by examples showing me how to enable https on port 8443.

Teleconferences with collaborators

Tom, Ken and I talked with Ron Price from the University of Utah yesterday about the CoE activities. Ron has a non-secured service that we can start testing on Monday.

Utah is using many of the caBIG/caGrid grid components for security management and service development. Specifically they're using Introduce to speed up service development and GAARDS to work with security management.

Dan is starting to research GAARDS and how that can help with the security infrastructure of the PHIRG. We're going to start looking into Introduce for test/sample services.

Tom, Ken and I also spoke with the team at Ohio State that is responsible to the bulk of the caBIG infrastructure (including GAARDS and Introduce) and they were extremely helpful and open to collaboration. They also pointed us to a caGrid bulk data transfer service that uses web services and HTTPS to secure transfer large files and data sets.

So the PHIRG team has a lot of links to follow. Fortunately we have some deep expertise available to help with the tough questions.

medLEE NLP Grid Service Progress

Dr. Albert Lai of Columbia CoE, on June 18, wrote...

Yes, we were able to develop a functioning wrapper service for MedLEE. We
ended up wrapping a batch job version of MedLEE instead of the client
server version.

We used Introduce, a piece of software developed by Shannon, which created
most of the stubs necessary to deploy software onto the grid. However,
since this used the Java core of Globus and not the C core currently being
used in the PHGrid efforts.

This leaves the current service unsecured. One of the steps we still need
to do is to somehow figure out how to integrate the certificates and all of
the authentication/authorization into the Java core.

There were a number of problems launching MedLEE from Java. However, I
have hacked together a (suboptimal) solution to make it run. There are
some other limitations of the version that we have put together, but it
seems to be sufficient for any demo needs. Right now, we package files and
transfer them to the server in a way that would limit the size of the data
transfer to available memory of the process as it is my understanding that
the files are serialized and then transferred. There are also some other
specific options that we currently do not support via the grid.

-Albert

Now we just need to work on getting the grid service deployed on the public health research grid.

New Potential Collaboration

Yesterday, I had a productive call with Shannon Hastings and Philip Payne from Ohio State University's caGrid grid architecture group, which has extensive (over 5 years) experience in designing, developing and implementing grid architecture for caBIG, NIH-UK and several grid projects in Ohio. Ohio State is also working with Columbia and Albert Lai to develop a grid service wrapper for medLEE. Albert is in Columbus today and tomorrow working with Shannon's team on the Globus service with medLEE. Based on these results, the PHRG may be able to deploy the service developed by Ohio State in addition (or hopefully instead of developing) to using our own wrapper.

Shannon also brainstormed about some potential future scenarios that involve paralleling the processing done by medLEE to allow for much quicker performance.

I will set up a call with Tom, Ken, Philip and Shannon once schedules allow to further explore collaboration opportunities.

Shannon also specifically mentioned the security architectures that they have worked with over the past five years and pointed us to GAARDS as a potential way to improve the management of security for nodes and services.

Tagging Posts by Proof of Concept Project

During today's PHGrid call, someone suggested (I cannot remember who precicely) that we add tags for each of the Proof of Concept Projects running through the summer. This will allow a reader to quickly filter and sort posts by the area they are interested in. Some posters are already tagging their writings to allow for this. I want to propose the following tags that writers will assign whenever they write regarding a PoC:

• Grid PoC Phase II PoC- CoE PoC


• Secure Reliable Grid Messaging- SRGM PoC


• Leveraging Grid to Enhance Biosurveillance Capacity - GBC PoC

I've linked to the searches in the list above. In the future you can click on these tags to search for posts specific to a PoC project.