Sprint 116 Review / Sprint 117 Planning September 23th, 2013

Sprint Resource Pages For this sprint, visit: nt+116+Progress+Summary nt+116+Progress+Summary For next sprint, visit: nt+117+Progress+Summary nt+117+Progress+Summary For information on the CONNECT 4.3 release visit: 2

Sprint 116 Summary - Cumulative Flow 3 To Do In Progress QA Done

Sprint 116 Summary - Burndown Chart 4

Sprint 116 Summary – Sprint Statistics Points committed = 17.5 –Initial points committed – 16.0 –0 ticket was moved to sprint 117 for 0.0 –2 tickets pulled into sprint for 1.5 Points remaining (unclosed) at end of sprint = 4.5 Points completed in sprint (velocity) =

Sprint What We are Showing Today Release 4.2 Available Release 4.2 Available –The Release 4.2 Wiki page: WC WC 6

Sprint Proposed Themes Testing wrap up and Certification Complete final automation steps for nightly run of Regression test suite –Bimodal test runs in Passthru –Ensure automated Regression suite successfully runs for all environments Meaningful Use certification testing support –Address a couple potential issues found –Meet with NIST test team Requirements and design for database-less transaction logging and Wiki page Support community with Release 4.2 deployments Start review of DoD Fortify scan results 7

Sprint What We are Showing Today Regression Test Automation Complete final automation steps for nightly run of Regression test suite –Enable a nightly automated run of the enhanced Regression suite with the ability to switch between Standard and Passthru operating modes –CONN-594 Some of the Bimodal regression suites fail when running automatically in Linux environment (Windows works) –CONN-579 Create a new regression suite to validate that UDDI is correctly looked up for all services Still Open –CONN-583 Some of the Bimodal regression suites fail when running automatically – passthru mode –CONN-593 Embedded glassfish does not start a JMX listener, required for regression tests to set passthru mode 8

Sprint What We are Showing Today Database-less Logging Requirements and design for database-less transaction/ event logging with Wiki page –Meet the needs of adopters with multi-tier architectures where the gateway and databases reside on different tiers –CONN-590 Create wiki page for requirements and design related to database-less transaction logging –CONN-335 & CONN-587 As a Federal Partner, I want a database-less implementation of transaction logging, so that I can deploy CONNECT 4.x without a database at the gateway –This effort also identified needed work with the Regression suite CONN-599 & CONN-601 9

Sprint What We are Showing Today Meaningful Use Certification Meaningful Use certification testing support –Work with the NIST team to ensure they have support they need to develop the MU2 test tool utilizing CONNECT as the test gateway –CONN-592 In person meeting with NIST team to discuss issues found with MU certification testing and the CONNECT gateway –Addressed a couple of issues to support MU testing –CONN-588 WS-Addressing Header “MustUnderstand” –CONN-560 Accepting an empty URI reference ("") for the Resource attribute of the the Authorization Decision Statement 10

Sprint What We are Showing Today Healtheway Certification Support Healtheway Participation Certification Support –Working with CCHIT on any clarifications –Metro based gateways; SAML Assertion issues TC: MAQD-R Handle missing Assertion signature element TC: MAQD-R Handle Missing Subject Name ID in Assertion TC: MAQD-R Handle Missing Subject Confirmation Method in Assertion –Spec Factory Still awaiting Spec Factory to set up subsequent meetings for Metro issue discussion Should a security header be required in response message 11

Sprint What We are Showing Today Healtheway Certification Support Healtheway Participation Certification Support –Release 4.2 passes all certification tests CXF properly handles all the SAML assertion test cases –No new updates or details on vendor certification –Links below provide valuable insight and help on CONNECT and the certification test cases Test case results Table 1 – Table 2 – Certification

Sprint What We are Showing Today Community Support Release 4.2 Support –Working with NIST testing 4.2 against MU2 use cases –Assisted SSA installing 4.2 into their dev environment –Actively supporting CMS and DoD with 4.2 testing –Working with several community members testing and working with 4.2 –A couple are moving closer to entering eHealth Exchange participant testing –Supporting other vendors via the CONNECT forums about leveraging 4.2 sa 13

Sprint What We are Showing Today Security Scan Fortify Security Scan Analysis –DoD has been performing security scans on each CONNECT release with the Fortify application. They supplied the Product team with the most recent report for Release 4.2 –CONN-594 Research Fortify scan issues/results so that we can come up with plan to address issues –Wrote up an initial finding and plan for pursuing deeper analysis of the potential issues 14

Sprint What We are Showing Today Additional Work this Sprint Bug Fixes –CONN-599 Deferred Services use the “relatesto” id as the transaction id for transaction logging –CONN-586 General security error (Cannot load the resource saml.properties) – Not a Code Fix –CONN-585 CONNECT-Webservices Maven dependency on Common-Types library incorrectly referencing version 4.0.4; s/b Community Support Tools (JIRA & Wiki) –Made changes to increase stability and uptime for both JIRA and CONNECT Wiki 15

Sprint What We are Showing Today Custodial Agent and Community Support Working on updates to the CONNECT Roadmap to reflect current needs and industry requirements Other tasks –Partner and Community Support –Ongoing Custodial Agent Duties Product Backlog selectedProjectId=

Sprint Proposed Themes Testing wrap up and Certification Support community with Release 4.2 deployments –Several active community installations underway Meaningful Use certification testing support (NIST) –Support of NIST testing effort –Work with current version of NIST test suite in CONNECT env. Begin Direct Updates –Document and validate requirements for QoS and Trust Bundles –Install the current version of RI in our development env. Finalize Audit Design Approach Start deeper research of potential issues identified in the Fortify security scan results Community Tickets 17

CONNECT 4 Community Announcements CONNECT Awareness –Open sprint review and planning meetings  Next sprint meeting will be October 7 th –CONNECT 4 Blogs and Forum posts – resources/forumshttp:// resources/forums 18

Questions and Discussion 19