1. XNAT Configuration and Administration
Rick Herrick
13 Sept, 2012

2. Configuration and Administration
Who’s back from the 2010 workshop?
Who’s been using XNAT for a while?
Who’s a complete and utter novice?
Configuration and Administration
Managing projects
Managing users
Projects and users form XNAT's basic security model
Users are administrators or not
Projects have accessibility levels for public facing
Users have access levels as project members
System Configuration
Data types, pipelines (more on these later)

3. Managing Projects
This is totally dependent on your particular requirements:
A single research project
Multiple research projects in an organization
Multiple research projects across organizations
Single multi-site study (GENFI, HCP)
Heterogeneous project requirements (CNDA)

4. Managing Projects, continued...
Creating projects is pretty simple:
Create a project in the UI
Import a project from XML

5. Project Access Level
Public: Project and data are visible to non-members. Non- members can request access to the project.
Protected: Project is visible to non-members, data is invisible. Non-members can request access to the project.
Private: Project and data are invisible to non-members. Non- members can not request access to the project, because they can't even see the project!

6. Managing Users Not very complicated in and of itself
Users are enabled or disabled
Users can exist solely in XNAT or be linked via other authentication sources (mainly LDAP or AD at this time, but the framework exists for OpenID, Kerberos, etc.)
Users can be site administrators and have various levels of ability to modify data
Users can become members of projects
Member access level is where you'll find the core of the XNAT security model

7. Combining Accessibility
Non-admin users access is controlled completely by project settings
You can see public projects and any project of which you are a member
Project accessibility levels:
Collaborator: read-only access
Member: create, edit, and read access
Owner: Full update and delete access
There is no per-object access control!
Administrators can administer projects but are not the same as project owners

8. System Configuration Mostly GUI driven, some configuration file driven
GUI administrative features only available to administrators
Users, Data Types, Pipelines, Configuration, and others
Site information
File system
Registration
Notifications
Anonymization
DICOM Receiver

9. Project Configuration
Project administrative features only available to project owners
Details
Access
Manage
Pipelines

10. What else? Best practices:
Deactivate admin and boss users (boss will be going away in newest code)
If you're an administrator, create two users: one for performing administrative tasks and the other for checking the effects of your administrative changes
If you're a developer, create three users (at least!): admin and plain user, also users to take various roles
Su function: Administrator's best friend
Groups: very top secret
Authentication

11. Q&A