2. Hybrid SaaS Architecture
DATA
Channel
CONTROL
Channel
Source Destination
Subscriber owned
and administered
storage system
Globus
âconnectorâ
software
No data relay or
staging via Globus
cloud service
Subscriber
Control
Domain
Globus
Control
Domain
Single, globally accessible
multi-tenant service
3. Globus Connect Server
3
⢠Makes your storage accessible via Globus
⢠Software/tools installed and managed by sysadmin
docs.globus.org/globus-connect-server-installation-guide/
Local system users
Local Storage System
(HPC cluster, NAS, âŚ)
Globus
Connect
Server
DTN
⢠Default access for
all local accounts
⢠Native packaging
Linux: DEB, RPM
4. Creating a Globus endpoint
Globus Connect Server v5
(GCSv5) should be used
for all new endpoint
installations
5. GCSv5 improvements
⢠Standards based web authorization (OAuth2, OIDC)
⢠Modular configuration
⢠Multiple distinct access policies on a single endpoint
⢠Simplified multi-DTN endpoint config/management
⢠Direct browser up/download, with full access control
⢠Guest collections, with fine-grained access control
⢠Interoperability with endpoints running older versions
7. GCS management conceptual architecture
7
Data Transfer Node
GCS Command
Line Interface
GridFTP
Server
Globus
Transfer
Service
GCS
management
requests
Globus
Auth
Service
GCS Manager authorize request
using client ID/secret
GCS Manager endpoint:
abc.abc.data.globus.org
Register a Globus Connect Server at
developers.globus.org get GCS
client ID, secret
Define Globus
Transfer
resources
(gateways,
collections, âŚ)
8. Requires a Globus subscription
GCSv5 installation/configuration summary
1. Register a Globus Connect Server with Globus Auth
2. Install GCS packages on data transfer node (DTN)
3. Set up the endpoint and add node(s)
4. Create a POSIX storage gateway
5. Create a mapped collection
6. Associate endpoint with a subscription
7. Create a guest collection
8. Enable browser down/upload (HTTPS access)
9. Add other storage systems to the endpoint
10. Register GCS and get credentials
⢠Navigate to developers.globus.org and log in
⢠(Optional) Create a project
⢠Add a new Globus Connect Server
⢠Generate a client secret
⢠Save the client ID and secret
14. 3. Set up endpoint and add node
$ globus-connect-server endpoint setup
> "My APS Endpoint"
> --organization "Argonne National Laboratory"
> --client-id 4321dddd-af72-4c4b-9533-a0f4055dd321
> --owner me@anl.gov
$ globus-connect-server node setup
> --client-id 4321dddd-af72-4c4b-9533-a0f4055dd321
Note: endpoint setup command generates deployment-key.json
Use this file when setting up additional data transfer nodes
15. Set up endpoint and add a DTN
⢠Access server: ssh adminN@apsN.globusdemo.org
⢠Switch to root: sudo su
⢠Run: globus-connect-server endpoint setup ...
â Ensure --owner is the identity you used to register the GCS
⢠Run: globus-connect-server node setup ...
⢠Run: systemctl restart apache2
⢠Display endpoint details:
â globus-connect-server login localhost
â globus-connect-server endpoint show Cheatsheet
bit.ly/apsglobus
16. Our setup so far
Run globus-connect-server node setup
to set up additional data transfer nodes
Copy deployment-key.json
from original DTN
17. Storage Gateways define a set of access policies
⢠Authentication for local account-holders
â Which identity domain(s) are acceptable?
â How are identities mapped from domain(s) to local accounts?
⢠Policy scope
â Which parts of the storage system are accessible via Globus?
â Which local accounts does this policy allow (or deny)?
⢠High Assurance settings
⢠MFA requirements
18. Authentication for local account-holders
⢠Primary access (via a mapped collection) requires an
account on the host system*
⢠Two-part authentication configuration:
1. Pick one or more identity domains
2. Configure the method to map the authenticated identity to an
account on your system
* You may allow primary users to share with others who donât have accounts on your system
19. Picking identity domains
⢠User must present identity from one of the configured
domains
â On access attempts, linked identities will be scanned for a match
â If no identity from the required domain(s), will be asked to link one
⢠Identity domains may includeâŚ
â âŚany organization in Globus federated list (incl. anl.gov, bnl.gov)
â âŚyour institutionâs identity provider trusted by Globus
â âŚa local OpenID Connect (OIDC) server using your PAM stack
20. Mapping identities to local accounts
⢠Default: Strip identity domain (everything after â@â)
â e.g. userX@globusdemo.org maps to local account userX
â Best for campus identities w/synchronized local accounts
⢠Use --identity-mapping option on storage gateway
â Specify expression in a JSON document
â Execute a custom script
docs.globus.org/globus-connect-server/v5.4/identity-mapping-guide/
22. Creating a storage gateway
⢠Our storage gateway will access a POSIX system
â This is the only type permitted without a subscription
⢠It will allow access to users with credentials from the
anl.gov (or bnl.gov) domain
⢠Reauthentication will be required every 12 hours
Cheatsheet
bit.ly/apsglobus
23. 4. Create a storage gateway
$ globus-connect-server storage-gateway create posix
> "My APS Storage Gateway"
> --domain anl.gov
> --authentication-timeout-mins 720
Allowed authentication
domain
Duration of user session
when accessing collections
via this storage gateway
26. Creating a collection
⢠Our collection will use the default identity mapping
⢠It will be ârootedâ at the userâs home directory
⢠Access will require authentication with an identity
from the anl.gov (or bnl.gov) domain
Cheatsheet
bit.ly/apsglobus
27. 5. Create a mapped collection
$ globus-connect-server collection create
> f77ff456-1f18-41d3-94a7-f3fd8858ea4d
> /
> "My APS Mapped Collection"
Collections are rooted at the specified base path
Specifying "/" as the base path sets the collection root to the local
userâs home directory
Storage gateway ID
Collection base path
28. Common Collection configuration options
⢠Restrict access: local users, local groups
⢠Allow guest collections à enables sharing
⢠Restrict sharing: paths, local users, local groups
⢠Enable HTTPS access
⢠Force data channel encryption
29. Local account restrictions
⢠Note: These only apply to mapped collections
⢠A storage gatewayâs allowed identity domains and
identity mapping method determine the universe of local
accounts that may access the mapped collection
⢠You can further narrow the access universe usingâŚ
--user-allow
--user-deny
--posix-group-allow (POSIX storage gateways only)
--posix-group-deny (POSIX storage gateways only)
34. Path restrictions
⢠Always use the narrowest base path possible for your storage
gateway(s) and collection(s)
â Storage gateway base specifies where collections may be created
â Collection base specifies the base directory for the collection
⢠POSIX storage gateway
â Use --restrict_paths to specify narrower read, read/write, or none
access for specific paths
â You provide a JSON doc that lists paths for each permission type
â Note: These are absolute paths on the host system
⢠Collection: specify narrowest base path that satisfies the need
36. Setting path restrictions
⢠A new storage gateway will limit access to /home
⢠We specify the path restrictions in paths.json
â This file is in your admin userâs home directory
⢠Run: storage-gateway create command with the
--restrict-paths option
⢠Create a new POSIX mapped collection
Cheatsheet
bit.ly/apsglobus
37. Create a restricted storage gateway, collection
$ globus-connect-server storage-gateway create posix
> "My APS Storage Gateway - Restricted"
> --domain anl.gov
> --authentication-timeout-mins 720
> --restrict-paths file:/home/adminN/paths.json
$ globus-connect-server collection create
> 3926bf02-6bc3-11e7-a9c6-22000bf2d287
> /
> "My APS Mapped Collection â Restricted"
Fully qualified filename containing
rule(s) for restricting access to
specific filesystem paths
38. Revisit your mapped collections
⢠Your will need to authenticate as user@anl.gov on
your new (restricted access) collection, and consent
⢠Note the access behavior differences between the two
mapped collections
⢠Move some files, if you like!
39. Subscriptions and Endpoint Roles
⢠Subscription(s) configured for your institution
⢠Multiple Subscription Managers per subscription
⢠Subscription Manager ties endpoint to subscription
â Results in a âmanagedâ endpoint
⢠Assign additional roles for endpoint management
â Administrator, Manager, Monitor
41. 6. Associate endpoint with a subscription
⢠Subscription managers can enable subscription
features on an endpoint
⢠If you are not the subscription manager, just send
your endpoint ID to your subscription manager and
ask them to add it.
42. Make your endpoint âManagedâ
⢠Option A: Put your endpoint ID in the spreadsheet
and Greg will make it managed
⢠Option B: Run globus-connect-server endpoint
set-subscription-id
⢠Confirm: globus-connect-server endpoint show
Cheatsheet
bit.ly/apsglobus
43. 6. Associate endpoint with a subscription
$ globus-connect-server endpoint set-subscription-id DEFAULT
$ globus-connect-server endpoint set-subscription-id
> 3926bf02-6bc3-11e7-a9c6-22000bf2d287
Can also be set via the web app Endpoints page
app.globus.org/endpoints (search for endpoint name)
Your anl.gov/bnl.gov identity may
already be a subscription
manager on this subscription
44. Be identity-, role-, and permission-aware
⢠Default: Only endpoint owner can configure an endpoint
⢠Delegate administrator role to other sysadmins
â Best practice: Delegate to a Globus group, not individuals
⢠Check identity using the session command
⢠Check resource permissions on storage gateways and
collections with --include-private-policies option
docs.globus.org/globus-connect-server/v5.4/reference/role/
45. 7. Create a guest collection
⢠Created by user, not endpoint administrator
⢠Grants access to specific Globus users without a
mapped local account
⢠âGuestâ users have same (or more limited)
permissions as the guest collection creator
â Access logs show access by the collection creator*
⢠Guest collectionâs root is relative to the mapped
collectionâs base path
* High Assurance collections log guest user identities to enable auditing
46. Sharing restrictions
⢠Guest collections may be created in any directory accessible by the
collection, by any authorized local account
⢠You can restrict the authorized accountsâŚ
--sharing-user-allow
--sharing-user-deny
--posix-sharing-group-allow
--posix-sharing-group-deny
⢠âŚand sharing pathsâŚ
--sharing-restrict-paths (specify JSON PathRestrictions)
⢠You can also set policies for specific user/path combinations
$ globus-connect-server sharing-policy create ...
48. Create and access a guest collection
⢠Enable creation of guest collections
⢠Run: globus-connect-server collection update
⢠Access the mapped collection
⢠Create a guest collection on your /projects directory
⢠Grant read access to the âTutorial Usersâ group
⢠Authenticate and browse guest collection
49. 8. Enable web browser upload/download
⢠Authorized users can upload,
download files via a browser
⢠Must have permissions to the
collection
â Collection configuration governs
access
â Web server is a different
application (separate
authentication)
51. Enable HTTPS access
⢠Run: globus-connect-server collection update
⢠Access your mapped collection
⢠Download the James Webb PNG file
Cheatsheet
bit.ly/apsglobus
52. 9. Add other storage systems to the endpoint
⢠Update your GCS packages
⢠Add the appropriate storage gateway
â Non-POSIX systems require add-on connector subscription(s)
⢠Gateway configuration options vary by connector
â e.g., specify bucket name(s) for AWS S3
⢠Collection authentication options vary by connector
â e.g., provide user access key and secret key for AWS S3
54. Accessing an object store (AWS S3)
⢠An S3 storage gateway and a mapped collection exist
â Access is restricted to two buckets within the AWS account
⢠Authenticating to the mapped collection(s) requires a
credential from the specified domainâŚ
⢠âŚas well as S3 access credentials that allows access
to buckets and objects
56. Things to do with the management console
⢠Monitor current transfers on your endpoints
â See whatâs going on at the transfer request level
â Much better than watching individual file transfers
⢠Pause (and later resume) a transfer in progress
â Sends a notice to the transfer owner
⢠Set a pause rule for current and future transfers
â Ideal for maintenance mode
â Notifies transfer owners,
â Tasks resume when endpoint is un-paused
docs.globus.org/management-console-guide/
57. Migrating an endpoint to a new host (server)
⢠An endpoint is a logical construct
â You can replace the host system without disrupting the endpoint
â Thereâs a lot of hard-to-replace configuration data in your endpoint
(esp. if you have guest collections!)
â Researchers may have built things (automation, workflows, etc.) that
use your endpoint UUIDs
⢠Use GCSâs multi-node configuration to migrate
â First, add the new node(s) to the existing endpoint
â Then, remove the original node(s)
58. When you really need a clean slateâŚ
⢠Proper clean-upâboth on your system and in the
Globus serviceâis important!
⢠Execute these commands in the specified order:
o globus-connect-server node cleanup
o globus-connect-server endpoint cleanup
⢠Delete the GCS registration at developers.globus.org
⢠Donât use the same Client ID for another endpoint!
60. Cleaning up (deleting) an endpoint
⢠You MUST follow these steps in the order specified
â Otherwise you will end up with an âorphanedâ GCS registration
1. Cleanup the data transfer node from the endpoint
globus-connect-server node cleanup
2. Cleanup the endpoint
globus-connect-server endpoint cleanup
3. Delete the registration at developers.globus.org
Cheatsheet
bit.ly/apsglobus
63. Balance: performance - reliability
⢠Network use parameters: concurrency, parallelism
⢠Maximum, Preferred values for each
⢠Transfer considers source and destination endpoint settings
min(
max(preferred src, preferred dest),
max src,
max dest
)
⢠Service limits, e.g. concurrent requests
63
65. Setting network use parameters
⢠May only be changed on managed endpoints
⢠Modify via the web app: Endpoints à Server tab
⢠Modify via Globus Connect Server CLI
â Run globus-connect-server endpoint modify
⢠Strong recommendation: Do not change network use
parameters before establishing baseline performance
65
66. GCSv5 resources â please consult these first
⢠Quickstart Guide
docs.globus.org/globus-connect-server/v5.4/quickstart
⢠GCS Command Line Reference
docs.globus.org/globus-connect-server/v5.4/reference
⢠Video walkthrough of an installation
www.youtube.com/watch?v=8ILtsSRiML8
67. General Resources
⢠Access the service: app.globus.org
⢠Documentation: docs.globus.org/globus-connect-server
⢠Engage: discuss@globus.org
⢠Subscribe: globus.org/subscriptions
⢠Need help? support@globus.org
⢠Follow us: @globus