[Go-essp-tech] Data node authorization

[Kettleborough, Jamie]

Hello Luca,

Thanks for this information.  It would be good to hear from anyone that
can shed any light on the timescales for the migration to the MyProxy
system.

I've come up with the following list of data nodes (may be incomplete -
as you'll see from how I created it)

| Institute    | Data Node                             |
|--------------+---------------------------------------|
| BCC          | http://bcccsm.cma.gov.cn/thredds      |
| CCCMA        | http://dap.cccma.uvic.ca/thredds      |
| CNRM-CERFACS | http://esg.cnrm-game-meteo.fr/thredds |
| INM          | http://pcmdi3.llnl.gov/thredds        |
| IPSL         | http://vesg.ipsl.fr/thredds/          |
| MOHC         | http://cmip-dn.badc.rl.ac.uk/thredds  |
| NASA-GISS    | http://esg.nccs.nasa.gov/thredds      |
| NCC          | ?                                     |
| CSIRO        | http://esgnode1.nci.org.au/thredds    |

This in part contributes, I think, to Estani's request for information
on contributing organisations.

I created this table by: looking at each gateway, figuring out which
modelling institutes contributed to the CMIP5 project, selecting a
sample data-set, creating a wget script, and then inspecting the url in
the script.  (I couldn't get to any NCC data as I didn't have access).
I only sampled one dataset.

This feels a bit long winded - what is the expected way to do this?
Although today I was just gathering information on what data nodes are
out there I can imagine this as a part of a real life use case (a very
common use case).  If I want to gather a diagnostic, such as monthly
mean surface temperature from as many models as I can, I think I'd have
to do this sort of trawling.  OK I maybe only have to do the initial
mapping of institute to data node once, but I think there is still a
trawl needed between gateways to get the data.  I may be missing
something - and I took some unnecessary steps. Please let me know if
this is the case.  Estani, Martin, Sebastien - sounds like you have
already started to do this sort of thing?

I also note that not all gateways know about all institutes - I think
this is a known problem.  For instance PCMDI doesn't know about IPSL,
and only NCI seems to know about CSIRO. Any ideas when this might be
resolved?

I think I have some obvious missing institutes: GFDL, NCAR, MPI. I guess
they are (understandably given the size of the task) still doing model
runs, and getting the output CMOR compliant, or have they submitted
somewhere I've missed it?

Back to the original thread of the e-mail (sorry for the tangent).  I
haven't yet managed to figure out which of the nodes I can use the
MyProxy on, and which need the token.  Picking up from what Martin
reports then I think I *should* be able to use MyProxy on CCCMA, CNRM
but not the BCC node.  Did I understand correctly?  I'll have a go next
week to see what nodes I can get to using the MyProxy method.  I seem to
remember when I was trying earlier in the week I couldn't get to nccs
(NASA-GISS) data using MyProxy, and I had a problem with nci (CSIRO)
because of a self signed certificate.

Thanks

Jamie

Ps Martin - if you have copies of data then of course its easier for us
to get it from you rather than fetch it from the original data nodes.
What do you have, where can we get it? - I *think* we can take this bit
off the list.


> -----Original Message-----
> From: Cinquini, Luca (3880) [mailto:Luca.Cinquini at jpl.nasa.gov] 
> Sent: 30 June 2011 20:10
> To: Kettleborough, Jamie
> Cc: go-essp-tech at ucar.edu
> Subject: Re: [Go-essp-tech] Data node authorization
> 
> Hi Jamie,
> 	the established plan is to move all sites to the 
> MyProxy (SAML-based) authentication and authorization system, 
> and to gradually phased out the token based system. I know 
> JPL and BADC have already moved, and that PCMDI is still on 
> the token based system. AS for the timeline at each site, the 
> corresponding administrators will have to chime in.
> thanks, Luca
> 
> On Jun 30, 2011, at 7:22 AM, Kettleborough, Jamie wrote:
> 
> > Hello,
> > 
> > Earlier this week I was trying to get data from different 
> data nodes.
> > There seemed to be two authorization methods in place - one 
> based on 
> > MyProxy, the other based on a token in the HTTP query string.
> > 
> > Is this the long term plan?  
> > If not then how soon will just one method be supported 
> across all nodes?
> > If it is then I guess there will be follow up questions 
> about how to 
> > handle both...
> > 
> > Thanks,
> > 
> > Jamie
> > _______________________________________________
> > GO-ESSP-TECH mailing list
> > GO-ESSP-TECH at ucar.edu
> > http://mailman.ucar.edu/mailman/listinfo/go-essp-tech
> 
>