Sprint 116 Review / Sprint 117 PlanningSeptember 23th, 2013

Sprint Resource Pages

• For this sprint, visit: https://developer.connectopensource.org/display/NHINProgress/Sprint+116+Progress+Summary

• For next sprint, visit:https://developer.connectopensource.org/display/NHINProgress/Sprint+117+Progress+Summary

• For information on the CONNECT 4.3 release visit: https://developer.connectopensource.org/x/NIADCQ

2

Sprint 116 Summary - Cumulative Flow

3

To Do

In Progress

QA

Done

Sprint 116 Summary - Burndown Chart

4

Sprint 116 Summary –Sprint Statistics

• Points committed = 17.5– Initial points committed – 16.0

– 0 ticket was moved to sprint 117 for 0.0

– 2 tickets pulled into sprint for 1.5

• Points remaining (unclosed) at end of sprint = 4.5

• Points completed in sprint (velocity) = 13.0

5

Sprint 116 - What We are Showing TodayRelease 4.2 Available

Release 4.2 Available

–The Release 4.2 Wiki page: https://developer.connectopensource.org/x/AoBWC

6

Sprint 116 - Proposed ThemesTesting wrap up and Certification

• Complete final automation steps for nightly run of Regression test suite

– Bimodal test runs in Passthru

– Ensure automated Regression suite successfully runs for all environments

• Meaningful Use certification testing support

– Address a couple potential issues found

– Meet with NIST test team • Requirements and design for database-less transaction

logging and Wiki page• Support community with Release 4.2 deployments• Start review of DoD Fortify scan results

7

Sprint 116 - What We are Showing TodayRegression Test Automation

• Complete final automation steps for nightly run of Regression test suite

– Enable a nightly automated run of the enhanced Regression suite with the ability to switch between Standard and Passthru operating modes

– CONN-594 Some of the Bimodal regression suites fail when running automatically in Linux environment (Windows works)

– CONN-579 Create a new regression suite to validate that UDDI is correctly looked up for all services

Still Open

– CONN-583 Some of the Bimodal regression suites fail when running automatically – passthru mode

– CONN-593 Embedded glassfish does not start a JMX listener, required for regression tests to set passthru mode

8

Sprint 116 - What We are Showing TodayDatabase-less Logging

• Requirements and design for database-less transaction/ event logging with Wiki page

– Meet the needs of adopters with multi-tier architectures where the gateway and databases reside on different tiers

– CONN-590 Create wiki page for requirements and design related to database-less transaction logging https://developer.connectopensource.org/x/iYADCQ

– CONN-335 & CONN-587 As a Federal Partner, I want a database-less implementation of transaction logging, so that I can deploy CONNECT 4.x without a database at the gateway

– This effort also identified needed work with the Regression suite CONN-599 & CONN-601

9

Sprint 116 - What We are Showing TodayMeaningful Use Certification

• Meaningful Use certification testing support

– Work with the NIST team to ensure they have support they need to develop the MU2 test tool utilizing CONNECT as the test gateway

– CONN-592 In person meeting with NIST team to discuss issues found with MU certification testing and the CONNECT gateway

– Addressed a couple of issues to support MU testing– CONN-588 WS-Addressing Header “MustUnderstand”

– CONN-560 Accepting an empty URI reference ("") for the Resource attribute of the the Authorization Decision Statement

10

Sprint 116 - What We are Showing TodayHealtheway Certification Support

• Healtheway Participation Certification Support

– Working with CCHIT on any clarifications

– Metro based gateways; SAML Assertion issues

• TC: MAQD-R-0003.301-2011 - Handle missing Assertion signature element

• TC: MAQD-R-0003.421-2011 - Handle Missing Subject Name ID in Assertion

• TC: MAQD-R-0003.424-2011 - Handle Missing Subject Confirmation Method in Assertion

– Spec Factory

• Still awaiting Spec Factory to set up subsequent meetings for Metro issue discussion

• Should a security header be required in response message

11

Sprint 116 - What We are Showing TodayHealtheway Certification Support

• Healtheway Participation Certification Support

– Release 4.2 passes all certification tests

• CXF properly handles all the SAML assertion test cases

– No new updates or details on vendor certification

– Links below provide valuable insight and help on CONNECT and the certification test cases

Test case results

Table 1 – https://developer.connectopensource.org/x/JwA4C

Table 2 – https://developer.connectopensource.org/x/IoA7C

Certification - https://developer.connectopensource.org/x/ZIC6C

12

Sprint 116 - What We are Showing TodayCommunity Support

• Release 4.2 Support– Working with NIST testing 4.2 against MU2 use cases

– Assisted SSA installing 4.2 into their dev environment

– Actively supporting CMS and DoD with 4.2 testing

– Working with several community members testing and working with 4.2

– A couple are moving closer to entering eHealth Exchange participant testing

– Supporting other vendors via the CONNECT forums about leveraging 4.2

sa

13

Sprint 116 - What We are Showing TodaySecurity Scan

• Fortify Security Scan Analysis – DoD has been performing security scans on each

CONNECT release with the Fortify application. They supplied the Product team with the most recent report for Release 4.2

– CONN-594 Research Fortify scan issues/results so that we can come up with plan to address issues

– Wrote up an initial finding and plan for pursuing deeper analysis of the potential issues

14

Sprint 116 - What We are Showing TodayAdditional Work this Sprint

• Bug Fixes

– CONN-599 Deferred Services use the “relatesto” id as the transaction id for transaction logging

– CONN-586 General security error (Cannot load the resource saml.properties) – Not a Code Fix

– CONN-585 CONNECT-Webservices-4.0.3 Maven dependency on Common-Types library incorrectly referencing version 4.0.4; s/b 4.0.7

• Community Support Tools (JIRA & Wiki)

– Made changes to increase stability and uptime for both JIRA and CONNECT Wiki

15

Sprint 116 - What We are Showing TodayCustodial Agent and Community Support

• Working on updates to the CONNECT Roadmap to reflect current needs and industry requirements

• Other tasks

– Partner and Community Support

– Ongoing Custodial Agent Duties

• Product Backlog

https://issues.connectopensource.org/secure/VersionBoard.jspa?selectedProjectId=10140

16

Sprint 117 - Proposed ThemesTesting wrap up and Certification

• Support community with Release 4.2 deployments

– Several active community installations underway

• Meaningful Use certification testing support (NIST)

– Support of NIST testing effort

– Work with current version of NIST test suite in CONNECT env.• Begin Direct Updates

– Document and validate requirements for QoS and Trust Bundles

– Install the current version of RI in our development env.• Finalize Audit Design Approach • Start deeper research of potential issues identified in the Fortify

security scan results

• Community Tickets

17

CONNECT 4Community Announcements

• CONNECT Awareness

– Open sprint review and planning meetings Next sprint meeting will be October 7th

– CONNECT 4 Blogs and Forum posts

– http://www.connectopensource.org/developer-resources/forums

18

Questions and Discussion

19