Skip to content

User Stories

These stories show how users and providers work with services and data in ELIXIR On-Cloud. Use them to plan an integration. The stories about access to services use LS Login, the identity provider of the deployment.

Access to services

Researcher: Access a service

As a researcher, I can access a cloud service that gives access to research data, so that I can analyse the data.

  1. The user opens the service and goes to its login page.
  2. The service redirects the user to LS Login.
  3. The user logs in at their own identity provider, for example their institute.
  4. If the service restricts access by group, LS Login checks the group memberships of the user.
  5. If the user may access the service, LS Login redirects the user back and sends the service the user's information.

LS Login identifies the user and can restrict who reaches the service. The service itself decides what a user may do, with the roles and groups that it receives.

Service provider: Register a service

As a service provider, I can register my service, so that external researchers can log in and use it.

  1. Register the service at LS Login as a relying party (RP). See the LS Login guide and the registration tool (SPREG).
  2. Configure the service to use LS Login. For examples with JupyterHub and HedgeDoc, see Using LS Login.

Service provider: Control access

As a service provider, I can define who may use my service, so that only specific users have access.

LS Login manages groups and decides access from group memberships. See the guide for managing access to a service. In short:

  1. In SPREG, turn on "Restrict access to the service based on membership in groups".
  2. Assign a group to your service as a facility in Perun.
  3. Add users to the group. See the instructions for group managers.

Service provider: Withdraw access

As a service provider, I can withdraw access, so that a user can no longer use the service.

Remove the user from the group. See the instructions for group managers.

Removing a user does not end the tokens and sessions that already exist. The user keeps access until the token or the session of the service expires, or until the service ends it. Check how long these last for your service.

Access to data

Researcher: Find a data set

As a researcher, I can find a relevant sensitive data set, so that I can consider it for my research.

Data can be reused if it is findable, accessible, interoperable and reusable (FAIR) and described in a searchable catalogue. The ELIXIR RDMkit has best practices for FAIR data and data management.

Researcher: Request access

As a researcher, I can request access to a sensitive data set, so that I can use it in my research.

The researcher files a data access request for the data set in an access management system, for example REMS.

Data controller: Grant access

As a data controller, I can give a researcher access to a data set, so that the researcher can work with the data under my usage policies.

The data controller decides on each request. For human data, the data subjects usually limit the purposes of use, and the controller checks that a request fits them. GA4GH helps with two standards:

Analysis

Researcher: Run a workflow on an external data set

As a researcher, I can run a workflow on an external data set in the cloud, so that I can use the results in my research.

GA4GH standardises the execution of workflows and their tasks with the Workflow Execution Service (WES) and the Task Execution Service (TES). The user sends a workflow to a WES service. When the run is complete, the user can use the results. For the services of the deployment, see Using the APIs. For a walk-through, see Researchers.