Access Management
Applies to the UMass Chan installation
This page describes how access is managed for the Via Foundry installation hosted by UMMS Biocore at viafoundry.umassmed.edu, including access granted to external collaborators at partner institutions.
Via Foundry is self-hosted software. Other installations are operated independently and manage their own access. Nothing on this page is a guarantee, service level agreement, or default behaviour of the software itself.
Overview
Access to this installation is governed by a documented procedure covering provisioning, periodic review, and termination. Three principles apply throughout:
- Named accounts only. Every user has an individual account. Shared or system credentials are never issued to end users.
- Least privilege. Access is scoped by role-based access control (RBAC) to only the projects and datasets a user needs.
- Sponsored access. Every external collaborator account has an identified sponsor — a project lead accountable for that person's continued need for access.
How users authenticate
| Method | Use |
|---|---|
| Interactive sign-in over HTTPS/TLS | Normal web access |
| Per-user personal access tokens | Programmatic and API access; individually issued and individually revocable |
| OAuth 2.0 with PKCE | Application and tool integrations |
No shared or system-level credentials are issued to end users, so access can always be attributed to, and revoked for, a single individual.
Provisioning
- A project sponsor submits a request identifying the individual, their institution, and the projects they need.
- Biocore verifies the requester is an authorized sponsor for those projects.
- A named account is created with project-scoped permissions only. Administrative roles are restricted to Biocore staff.
- The account, its sponsor, its scope, and the date are recorded in the access register.
Review
Access is reviewed quarterly. Biocore confirms with each sponsor that their listed collaborators still require access at the current scope. Accounts that are unconfirmed, dormant, or over-scoped are reduced in scope or disabled. Administrative accounts are reviewed on the same cadence and kept to the minimum necessary. Each review is recorded with its date, reviewer, and any resulting changes.
Termination
Access is removed when a user leaves their institution, changes role such that access is no longer required, the project concludes, or a sponsor requests removal.
On notification, Biocore:
- Revokes all personal access tokens issued to the user.
- Disables the account, so interactive sign-in is refused.
- Removes project-scoped permissions.
The removal is recorded with its date and reason. Access identified as no longer required during a quarterly review is removed by the same steps.
For partner institutions
Prompt notification of departures is the most important control here. Please ensure your own leavers process notifies biocore@umassmed.edu when a collaborator no longer requires access.
Records
Biocore maintains an access register recording, for each account: identity, institution, sponsor, granted scope, provisioning date, review history, and termination date where applicable. This register is the evidence base for the procedure above and is available to support institutional security assessments.
Related
Questions
For questions about access management for this installation, contact biocore@umassmed.edu.