RFC workflow sharing with colleagues

[tiborsimko]

RFC workflow sharing with colleagues

About

We are starting a new sprint to allow workflow sharing on REANA. The primary goal is to allow researchers to share their workflow runs, logs, and output files with colleagues. The analyst will retain the full read-write access, the colleagues will get a read-only access. The system will work a little bit like e.g. Google Docs sharing of documents.

This issue is a request-for-comment to help us specify the high-level goals and define requirements with any desiderata that you may have. Thanks for your input!

Goals

• Allow researchers to share workflow runs with a few selected individual users. Example: Alice (analyst) shares a workflow run with Bob (colleague) and Cecile (student).

• Allow researchers to share workflow runs with their collaborators within research groups. Example: Alice (analyst) shares a workflow run with all the members of "myresearchgroup" group. (CERN e-group, Keycloak/LDAP group)

Use cases

1. As an analyst,
   I would like to share one of my workflow runs with a colleague,
   so that the colleague can visualise the final plots and the intermediate tuples.

2. As an analyst,
   I would like to share one of my workflow runs with a colleague,
   so that the colleague can inspect the job logs that were showing unexpected errors.

3. As an analyst,
   I would like to easily distinguish between shared and unshared workflows,
   so that I can keep track which workflows I shared with whom and which workflows I did not.

4. As an analyst,
   I would like to have the option to set an expiration date for the shared workflow link,
   so that I can ensure the security of shared content.

5. As an analyst,
   I would like to unshare a previously shared workflow,
   so that I can maintain control over access to my content.

6. As an analyst,
   I would like to share a workflow to one or more CERN e-groups,
   so that I can reach my entire team without specifying individual users one by one.

7. As an analyst,
   I would like to add comments or notes to the shared workflow link,
   so that I can provide more context to my collaborators.

8. As an analyst
   I would like to view a list of the collaborators with whom I have shared a workflow,
   so that I can easily manage and track who has access to my shared content.

9. As a collaborator,
   I would like to be notified when a workflow has been shared with me,
   so that I am timely aware of what workflows colleagues shared with me.

10. As a collaborator,
    I would like to see who shared which workflows with me,
    so that I can quickly get back to corresponding analysts.

11. As a collaborator,
    I would like to receive precise links to the concrete file or the concrete line in the output logs,
    so that I can directly view the relevant shared content without loosing any time browsing around.

Command-line interface mock-up

How do I share the run 42 of my analysis with Bob? And with my research group?

$ reana-client share -w myanalysis.42 --user [email protected] --group [email protected]

Which workflows did I share with Bob?

$ reana-client list --filter [email protected]

Which workflows did Cecile share with me?

$ reana-client list --filter [email protected]

How do I unshare the run 42 of my analysis regardless of with whom I might have shared it previously?

$ reana-client unshare -w myanalysis.42 --shared_with anybody,anygroup

Web interface mock-up

How do I manage sharing of my analysis run 42 on the web interface?

How do I search for all workflow runs that Cecile shared with me?

A) drop-down style:

B) faceted search style:

Further considerations

Please let us know what you think and please share any other desiderata you may have for the workflow sharing.

[egazzarr]

The "share with e-group" would only work with the CERN SSO.
In our ESCAPE use case, we have users with IAM accounts, and I think we will therefore have reduced functionality in terms of group sharing. The sharing of a workflow through the command:

$ reana-client share -w myanalysis.42 --user [email protected] 

will work if I know the email. In the GUI interface example (first screenshot), the drop down menu will automatically connect with the CERN SSO. It would be useful if it also had the option of connecting to the IAM DB to fetch all the potential user collaborators.

[tiborsimko]

It would be useful if it also had the option of connecting to the IAM DB to fetch all the potential user collaborators.

Yes, the mock-up illustrations are showing CERN as an example, but the development will be obviously generic and support any Keycloak IAM user groups connected to REANA. (See the introductory description mentioning CERN e-group, Keycloak/LDAP group examples.) BTW do you use Keycloak groups directly? Or something else?

[egazzarr]

In our case, INDIGO IAM does not use Keycloak to manage groups, but offers the possibility of creating different groups: https://indigo-iam.github.io/v/v1.8.2/docs/tasks/administration/group-management/.