The GT4Portlets extension to this allows the
execution of jobs on remote Globus Toolkit 4
systems, and further enhances GridPortlet’s
compatibility with the newest version of Globus.
A SimpleCA (SimpleCA, Accessed 2008)
certificate authority supplies users with credentials
to access ASRB Grid resources. To further facilitate
the researcher’s use of the system, PURSe portlets
(Christie, 2007) are used to eliminate the user’s need
to knowingly interact with this system. Using these
portlets, a user fills in a Web-based form to request
an account. The user is then sent an email to verify
their request and an administrator is informed of the
request. The administrator can accept or reject the
user, and has the capability to provide the user with
access to an account on the Grid; ultimately the user
is informed by email of the result. When a user is
accepted, appropriate Grid credentials are
automatically created for him/her and a personal
proxy certificate stored the MyProxy server. The
user can then log in to the Web portal, using the
single password supplied by them in their initial
request, and a proxy certificate is automatically
retrieved from the MyProxy server. This proxy
certificate is then available for access by the portlets
in the Web portal; the portlets use these credentials
to authenticate with any Grid resources in a manner
that is completely transparent to the user.
As previously described, it is vitally important
that researchers are restricted to access only that data
for which they are approved. The Globus Toolkit
includes a component that can be used for this
purpose: the Community Authorization Service
(CAS) (Globus, Accessed 2008) (not to be confused
with JA-SIG’s Central Authentication Service (JA-
SIG, Accessed 2006)). CAS allows resource
providers to give course-grained access to various
systems, handing finer-grained access control
management to the community of users. This is
important for the ASRB Grid because there are very
complex levels of access for different data resources,
so fine-grained control is needed, and the users
themselves (or the administrator, on their behalf) can
best handle the complexities of these relationships.
CAS is based on the notion of assigning users to
roles, which then have different sets of permissions
associated with them. Each user can have multiple
roles, and his or her access to a particular resource is
only allowed if at least one of the roles allows access
to the resource. Support for CAS roles has been
added to the PostgreSQL database (PostgreSQL,
Accessed 2006) used to store volunteers’ responses
to the clinical assessment battery.
Whenever a new role is needed (for example
when a new ethics approval is granted), the system
administrator creates a database view that is
accessible only to users in the new role. The view
can provide fine-grained control, specifying whether
the users with a role have permission only to read
data, or to insert new data, update existing data or
delete data.
When a user (or group of users) is provided with
a new role, the system checks to see whether the
view allowed by the user’s combination of roles
currently exists. If it does not, a new view is
automatically created, including rules that allow
database operations such as insertion of new data or
updating of existing data, but only if those
permissions are included in one or more of the roles
assigned to the user.
Users are then able to access the database using
the Web portal, and any of their queries are
automatically restricted to the views permitted by
their roles. For example, the role of clinical
assessment officer (CAO) allows the user access to
complete volunteer information collected at the
officer’s site. Thus, if a Newcastle CAO performs
the same database search as a Sydney CAO, they are
returned different results; the Newcastle CAO will
‘see’ identifying data for Newcastle volunteers,
while the Sydney CAO will be returned similar data
about Sydney volunteers.
4 CLINICAL ASSESSMENT
After considering various structured numbering
schemes for volunteer identification, it was decided
that any such scheme could potentially breach
privacy. For example, representation of familial
relationships, as occurs in some numbering schemes,
could allow a CAO with access to a volunteer’s
identity to discern and possibly identify that person’s
relation(s) for whom the CAO does not have
identification permission. Accordingly a simple
scheme was adopted whereby numbers are centrally
and sequentially allocated.
Clinical Assessments (CAs) are performed at
locations chosen in part with regard to the
convenience of volunteers, so CAOs may, or may
not be Internet connected while performing the
assessment. Each CAO has been provided with a
notebook computer, with installed CA software. To
minimise the possibility of discomfort to volunteers
who may feel threatened by the sight of the back of a
screen, the tablet form of computer was chosen, so
that the CA can be conducted with direct computer
input using a stylus (very similar to use of a pen and
paper). The lack of Internet connectivity during CA
requires initial storage of the collected data on the
notebook computer. It also requires allocation of the
identification numbers prior to commencement of
the CA. The process is that the CAO, in preparation
IT SUPPORT FOR THE AUSTRALIAN SCHIZOPHRENIA RESEARCH BANK
407