CSO Researcher User Guide

Instructions for Accessing RMFs using CSO Researcher Data Portal

June 2019

1

Table of Contents

Introduction ............................................................................................................................................ 2

CSO Research Data Portal ....................................................................................................................... 2

Off-Site and On-Site Research ............................................................................................................ 2

Off-Site Researcher Logon Procedure ..................................................................................................... 2

Token ............................................................................................................................................... 3

PIN ................................................................................................................................................... 3

Installation of Citrix NetScaler EndPoint Analysis agent ................................................................. 5

Installation of Citrix Receiver .......................................................................................................... 8

On-Site Researcher Logon Procedure ................................................................................................... 12

On-Site Procedures ........................................................................................................................... 13

Working with Data within the RDP ................................................................................................... 14

Working with Statistical packages .................................................................................................... 15

Importing Packages to R-Studio .................................................................................................... 15

Importing Packages to Stata 15 .................................................................................................... 16

Project Expiry .................................................................................................................................... 17

Resetting your Password .................................................................................................................. 17

Support ................................................................................................................................................. 18

Troubleshooting ................................................................................................................................ 18

2

Introduction The CSO 2020 strategy outlines the importance of Access to Microdata for Researchers.

The provision of access to research microdata files is an important service the CSO provides to a

range of users including those involved in policy development and evaluation and the research

community.

The Researcher Coordination Unit facilitates the use of microdata for statistical research purposes by

using secure virtual desktops both for off-site and on-site researchers.

The aim of the section is to provide further opportunities for approved users and enable current

users continued access to microdata securely.

CSO Research Data Portal The Research Data Portal (RDP) is a Citrix-hosted platform for securely accessing virtualised desktops

remotely. Citrix is device-agnostic, insofar as it can be accessed from any standard operating system.

It allows users to access, view and edit data in a secure Windows 10 environment using a prescribed

collection of statistical packages, depending on the RMF-type to which they have been assigned.

The current catalogue of available software includes:

• Libre Office (all users)

• Stata 15 (all users)

• R & R Studio (all user)

• SPSS – (GUI Researchers)

• ArcGIS (POWSCAR Researchers)

• ESRI SWITCH (SWITCH Desktop Researchers).

Off-Site and On-Site Research All RMF datasets are now accessible via the Research Data Portal, however, depending on the

sensitivity of the data, there may be a requirement that the data is only accessed within the CSO

buildings in Dublin or Cork. Business-related datasets generally fall into this category.

Off-Site Researcher Logon Procedure Researchers assigned to projects for which the RMF data can be accessed from outside the CSO can,

where approved, log onto https://sara.cso.ie and gain access to the RMF data. To guarantee the

security of the data, RCU impose multi-factor authentication to restrict access. A researcher must

know their username

Note: These instructions show logon procedure using Chrome browser.

There are three elements to configure or install prior to system access:

3

• Token (6 digit number generated from keyfob provided) and PIN.

• Installation of Citrix Netscaler Client.

• Installation of Citrix Receiver.

Glossary:

• Token: 6 digits displayed on RSA SecurID fob, (e.g. 123456)

• PIN: 4 to 8 character alphanumeric code determined by the user, (e.g. P1Nc0d3)

• PassCode: 10-14 character code consisting of PIN followed by Token, (e.g. P1Nc0d3123456)

•

Token

• Connect to https://sara.cso.ie

• Enter username and password provided by CSO.

• In the Token field, enter the 6 digit code displayed on the RSA SecurID token provided.

The token code changes at 60 second intervals with countdown bar on left side of display.

PIN

• If the credentials and the code are correct, the user is prompted to set a PIN

4

• Re-enter PIN to confirm.

• Wait for the Token to change code.

• Then enter the PIN + the new Token code.

For example, if the PIN is 1234 and the token is 567 567. Please enter 1234567567 as

passcode

• Again, connect to https://sara.cso.ie

5

• Log in with the username, PassCode (PIN + Token) and password.

• Enter the PIN + the new pass code. For example, if the PIN is 1234 and the token is 567 567.

Please enter 1234567567 as passcode

• If the user credentials and the PIN + Token are validated, the user can log in and access the

published applications after installing Citrix NetScaler Analysis and Citrix Receiver.

Installation of Citrix NetScaler EndPoint Analysis agent

After logon, Citrix will check your device for compatibility. It is a one-time only installation.

The NetScaler page will display a request to install the EndPoint Analysis agent. Click Download .

Run the download by clicking the setup file in the bottom left corner.

6

Install the agent.

Click Finish to complete the installation.

7

Once installed, go back to the browser page (already open) and the Endpoint Analysis agent will

trigger opening the installed file, ‘CitrixNG Protocol Handler’.

Click Remember my choice and then Open CitrixNG Protocol Handler.

• This will launch the Netscaler Gateway and enable checking of the IP address of client

computer.

8

• Provided the IP address is authorised to access the system, the Citrix receiver download can

commence.

• If the IP address of the computer accessing the system is not authorised, a ‘Wrong source IP’

message will be presented.

Installation of Citrix Receiver

• Citrix Receiver is required to use the service. It is a one-time only installation.

9

• The web site connection is encrypted using the CSO wild card certificate. The certificate has

to be trusted by the browser, so please install the Root and Intermediate CA certificates.

Note: If not prompted to install the certificate, no action necessary so proceed to Detect

Receiver.

The first time, the website will detect if the Citrix Receiver is installed on the user workstation

• The user needs to click on Detect Receiver to proceed.

• If the Citrix Receiver is not installed, the website will allow for download.

• Accept the Citrix license agreement and click Download

10

• Run the download by clicking the setup file in the bottom left corner.

Note: The Citrix receiver installation may require local administrative rights.

• Click Start to initiate.

• Tick to accept the Licence Agreement and click Install

• Click Finish and return to the web page. The user does not need to add an account at this

stage.

11

• Click Continue

Note: If presented with an External Protocol Request notice.

• Tick Remember my choice for all links on this type and click Launch Application.

• Select DESKTOPS and accessible virtual machines can be started by clicking on the relevant

icon.

• After clicking the relevant desktop a launch file will download. Click this to initiate the

remote desktop.

12

• The remote desktop will then connect.

On-Site Researcher Logon Procedure The Researchers Office is located in room GS14 in Cork and on the 1st Floor at the front of the

building in Ardee Road. In each location there are four networked PCs.

On-site researchers must boot up and log onto the PC using their “_int” account. Once the desktop

appears, click on the desktop icon to open a web-browser. The only web-page that is accessible from

these PCs is https://connect.cso.ie . Researchers must log in here using their “_int” user accounts

and passwords. Users must not access the system using accounts with “_ext” suffixes. There is no

requirement for a PIN or token when logging on within the CSO.

On-site researchers will be only granted access to one RMF project folder within their home-drive at

any one time. If you intend to do work on two separate projects for which you are approved in the

one day, please arrange a time with RCU at which they will replace the project-folder shortcuts in

your home-drive.

13

On-Site Procedures 1. Researchers will contact the Researcher Coordination Unit (RCU) by email (rcu@cso.ie) at least

one business-day in advance to book on-site appointments between the hours of 9:15 and 16:30. Only researchers with a scheduled appointment may be allowed onsite.

RCU will maintain a Booking Register in Lotus Notes – Divisional Databases | Researcher

Coordination Unit | RMF Process | Booking Register for Onsite Researchers.

RCU will notify the relevant Statistician by email in advance of the scheduled appointment.

2. On arrival, the researcher will present to CSO Reception. The Service Officer will verify the identity of the researcher by checking their photographic identification. Valid forms of photographic ID are:

Passport (or passport card), driving licence, Public Services Card (PSC), employer ID, or university

student ID.

Photo identification should be confirmed each day the researcher comes on-site. Only those

with valid forms of identification may be allowed on-site. A researcher whose identity cannot be

verified will not be allowed on-site.

The researcher must sign in using the CSO Visitor Book and be issued a visitor badge and lanyard.

The Service Officer will request the researcher to place any electronic recording equipment

(mobile phone(s), tablet, etc.) into a bag to be provided by the Service Officer. This bag will

remain at CSO Reception. Researchers will not be permitted to bring electronic recording

equipment beyond the reception area.

The Service Officer will notify the statistician of the arrival of the researcher. The statistician or

nominated POC will escort the researcher to the Researchers Room (GE14).

3. The researcher must leave their desk clear when leaving the office. Any notes not approved to be removed from the office by the data custodian must be destroyed.

14

Working with Data within the RDP The data storage system within the Research Data Portal works in the following ways:

• facilitates collaboration between researchers on shared projects.

• keeps all project-related data within the project folder.

• assists in the control of access to data.

• facilitates the efficient transfer of approved data inputs and outputs.

Once you have launched your required Virtual Desktop, you will be presented with a Windows 10

desktop from which you will see shortcuts in your personal network drive to any project to which

you have been assigned.

Click the Windows Start Button on your desktop and click on “This PC”. This will bring up the remote

server and from here you will be able to access your mapped home network drive. You do not have

“write” permissions to this folder. Within your home network drive you will see a shortcut for each

project to which you are currently assigned.

15

• Within each project folder, you will see an "Inputs", "Outputs" and "Researchers" folder

along with a shortcut to the Changelog file marked README.txt.

• Within the "Input" folder you will find a shortcut to the relevant RMF dataset for that project

as well as any Syntax files or other Inputs that have been approved by the CSO Project

Liaison. To have code or other data transferred to the “Input” folder, please forward the

file(s) along with a completed RMF Input Request form to the CSO Project Liaison/data

custodian. You will not be able to save or modify files within the "Inputs" folder.

• Any resultant work that needs to be approved by the CSO Project Liaison should be saved to

the "Outputs" folder. Once you have copied the file(s) here please notify your CSO Project

Liaison for them to approve its release by submitting an RMF Output Request form available

from the CSO website.

Please refer to the “Guidelines and Instructions for Researchers on the use of CSO Datasets”

document accessed via the “Supporting Documentation” shortcut in your project folder for

direction when preparing outputs.

• The "Researchers" folder is your workspace. You may create or delete any number of sub-

folders as necessary and save any data that you are working on. Please be aware that all

researchers assigned to the project will have read/write permissions to this "Researchers"

folder and any subfolder or file within.

Working with Statistical packages In order to protect your data and that of the CSO, our RDP environment is isolated from the internet.

It is not possible to access any online resources from within the virtual desktop.

As the usefulness of Stata or R-Studio depends greatly on the installation of additional external

packages, RCU maintain an offline repository of packages for both applications.

Importing Packages to R-Studio

A full repository of packages (CRAN) is available from a regularly updated mirror of CRAN located on:

16

\\crctxksc001\CRAN\bin\windows\contrib\3.3

In order to access and install from this mirror, please follow the below instructions: · Open R-Studio · Click on Tools->Global Options... · Click Packages · Untick - Use secure download method for HTTP · Click Apply · Click Ok

Enter the following lines to install packages including dependencies:

options(repos=NULL)

(install.packages("package_name", contriburl = "file:////crctxksc001/CRAN/bin/windows/contrib/3.3"))

For example, in order to install the gglot2 package, use:

(install.packages("ggplot2", contriburl = "file:////crctxksc001/CRAN/bin/windows/contrib/3.3"))

It is possible to install multiple packages simultaneously by adding their names to the above command, separated by a comma, e.g.

(install.packages(c(“reshape2”, “foreign”, “scales”, “plyr”, “gdata”, “xtable”, “zoo”,”seasonal”), contriburl = "file:////crctxksc001/CRAN/bin/windows/contrib/3.3"))

Please note: Installation of packages in RStudio via Tools-> Install Packages... will not function and should only be attempted via the install.packages command, documented above.

Importing Packages to Stata 15

The Boston College code repository, “BoCoDe”, is a comprehensive collection of user-written

packages for Stata. RCU synchronise our offline BoCoDe repository with Boston College periodically

throughout the year.

To access the code packages within Stata, click on “File | Open” and browse to the project shortcut

within your home-drive. Then open the “Input | Syntax” folder and double-click on the “bocode”

shortcut. Packages are grouped into folders alphabetically. For a full definition of the function of

each package, please refer to https://ideas.repec.org/s/boc/bocode.html

17

Project Expiry Two months prior to the expiration of an RMF Project, the RCU will send an email to the lead

researcher of the project to remind them of the impending expiry and to prompt them to submit an

RMF Application Form for project renewal if necessary, and also to remind them to return the RSA

security-fobs for any researcher who does not have another existing project for which they require

access to the RDP. Unused fobs must be returned to the RCU at the earliest opportunity.

Resetting your Password The username assigned to you and the PIN that you will have set yourself on first log in (for off-site

researchers) will not change. The password, however, will change every 42 days. From ten days

before expiry, a notification will appear in the System Tray on your RDP.

To reset your password in advance of its expiry:

• log onto https://sara.cso.ie and launch your RDP desktop.

• Click on the Citrix Menu tab at the top-centre of the desktop, as shown below.

• From the Citrix Menu tab that appears, select “Ctrl+Alt+Del” button.

• Select “Change a Password” from the options that appear.

• Enter your old Windows password, and now enter your chosen new password twice where

prompted to do so.

18

• Once confirmed, this new password will replace the password used previously to log onto

https://sara.cso.ie.

This new password will expire 42 days after creation. If you are not a regular user of the RDP it may

be advisable to create a reminder to reset your password in advance of its expiry.

Support For issues relating to logging on (e.g. "incorrect username or password", "invalid PIN", etc) please

email itsupport@cso.ie directly instead of contacting the Researcher Coordination Unit. The ICT

Support team are best placed to deal quickly with such issues with logging onto https://sara.cso.ie.

For any other queries relating to the RMF data accessed through the CSO Researcher RDP please

feel free to contact the Researcher Coordination Unit directly at rcu@cso.ie.

For urgent enquiries, you can contact RCU directly by telephone at 01-4984376.

The README is a Changelog which contains details of any change in process, application upgrade or

scheduled maintenance that may affect your use of the RDP system. If you experience any

difficulties as a result of any changes listed in this file please do not hesitate to contact us at

rcu@cso.ie

Troubleshooting

Problem: You have logged on but see a yellow page with “Wrong Source IP”.

Description: As an extra security measure, CSO insist that traffic to the RDP environment come only from specific IP addresses or ranges nominated by you. This is to ensure that the RMF data is not accessible on your personal devices (PCs or mobile units).

It has been found that, on occasion, despite CSO IT having recorded the correct public/external IP address for the end-users’ organisation, the “Wrong Source IP” page is still being displayed. This problem has arisen after a change has been made by your IT department to their proxy-server.

Solution: Firstly, you should confirm your public IP address and notify RCU of same. This can be done by querying www.google.com with the question “What’s my IP?”. Your public IP address is noted by RCU and the CSO IT Department.

19

Secondly, you should contact your own IT department to confirm whether there have been recent changes to the proxy server.

If the recorded public IP address is correct, you should log a ticket with your IT department requesting the following, where possible:

Create a new security-group for all of their organisations’ staff who access https://sara.cso.ie and add these users to it.

Create a new rule within the Proxy settings with no filtering in place, with the aforementioned security-group assigned to that rule. Have a user test to confirm whether they can access the CSO RDP successfully.

Enable each component of the proxy/gateway antivirus scanning and Web Filtering individually, where possible to isolate the component preventing communication.

You may need to create a new rule to allow open traffic to cso.ie / 193.178.30.103.