building the research applications and services ecosystem with … · 2017-04-17 · globus auth...
TRANSCRIPT
![Page 1: Building the Research Applications and Services Ecosystem with … · 2017-04-17 · Globus Auth • Foundational identity and access management (IAM) platform service • Simplify](https://reader035.vdocuments.us/reader035/viewer/2022081406/5f0ddd417e708231d43c76a0/html5/thumbnails/1.jpg)
Building the Research Applications and Services Ecosystem with the Globus Platform
Steve [email protected]
![Page 2: Building the Research Applications and Services Ecosystem with … · 2017-04-17 · Globus Auth • Foundational identity and access management (IAM) platform service • Simplify](https://reader035.vdocuments.us/reader035/viewer/2022081406/5f0ddd417e708231d43c76a0/html5/thumbnails/2.jpg)
Cloud has transformed how software and platforms are delivered
2
Infrastructureasaservice:IaaS
Platformasaservice:PaaS
Softwareasaservice:SaaS
PaaS enables more rapid, cheap, and scalable delivery of powerful (SaaS) apps
(web & mobile apps)
![Page 3: Building the Research Applications and Services Ecosystem with … · 2017-04-17 · Globus Auth • Foundational identity and access management (IAM) platform service • Simplify](https://reader035.vdocuments.us/reader035/viewer/2022081406/5f0ddd417e708231d43c76a0/html5/thumbnails/3.jpg)
Globus SaaS: Research data lifecycle
3
Researcher initiates transfer request; or requested automatically by script, science gateway
1
InstrumentCompute Facility
Globus transfers files reliably, securely
2
Globus controls access to shared
files on existing storage; no need
to move files to cloud storage!
4
Curator reviews and approves; data set
published on campus or other system
7
Researcher selects files to share, selects user or group,
and sets access permissions
3
Collaborator logs in to Globus and accesses shared files; no local
account required; download via Globus
5
Researcher assembles data set;
describes it using metadata (Dublin core and domain-
specific)
6
6
Peers, collaborators search and discover datasets; transfer and share using Globus
8
Publication Repository
Personal Computer
Transfer
Share
Publish
Discover
• Only a Web browser required
• Use storage system of your choice
• Access using your campus credentials
![Page 4: Building the Research Applications and Services Ecosystem with … · 2017-04-17 · Globus Auth • Foundational identity and access management (IAM) platform service • Simplify](https://reader035.vdocuments.us/reader035/viewer/2022081406/5f0ddd417e708231d43c76a0/html5/thumbnails/4.jpg)
How do we empower the research community to create
an integrated ecosystem of services and applications?
4
![Page 5: Building the Research Applications and Services Ecosystem with … · 2017-04-17 · Globus Auth • Foundational identity and access management (IAM) platform service • Simplify](https://reader035.vdocuments.us/reader035/viewer/2022081406/5f0ddd417e708231d43c76a0/html5/thumbnails/5.jpg)
Example: NCAR RDA
5
![Page 6: Building the Research Applications and Services Ecosystem with … · 2017-04-17 · Globus Auth • Foundational identity and access management (IAM) platform service • Simplify](https://reader035.vdocuments.us/reader035/viewer/2022081406/5f0ddd417e708231d43c76a0/html5/thumbnails/6.jpg)
Science DMZ
FirewallDesktop
GlobusCloud
Prototypical research data portal
6
HTTPS
GridFTP
REST Other Services
Identity Provider
Globus Web Helper Pages
Globus Auth Globus TransferBrowser
User’s Endpoint (optional)
Portal Web Server (Client)
Portal Endpoint
Other Endpoints
Login
Applications
![Page 7: Building the Research Applications and Services Ecosystem with … · 2017-04-17 · Globus Auth • Foundational identity and access management (IAM) platform service • Simplify](https://reader035.vdocuments.us/reader035/viewer/2022081406/5f0ddd417e708231d43c76a0/html5/thumbnails/7.jpg)
Next-Generation Portal Leverages Science DMZ
10GE10GE
10GE
10GE
Border Router
WAN
Science DMZSwitch/Router
Firewall
Enterprise
perfSONAR
perfSONAR
10GE
10GE
10GE10GE
DTN
DTN
API DTNs(data access governed
by portal)
DTN
DTN
perfSONAR
Filesystem (data store)
10GE
Portal Server
Browsing pathQuery path
Portal server applications:· web server· search· database· authentication
Data Path
Data Transfer Path
Portal Query/Browse Path
7https://fasterdata.es.net/
![Page 8: Building the Research Applications and Services Ecosystem with … · 2017-04-17 · Globus Auth • Foundational identity and access management (IAM) platform service • Simplify](https://reader035.vdocuments.us/reader035/viewer/2022081406/5f0ddd417e708231d43c76a0/html5/thumbnails/8.jpg)
Sample Research Data Portal
github.com/globus/globus-sample-data-portal
8
![Page 9: Building the Research Applications and Services Ecosystem with … · 2017-04-17 · Globus Auth • Foundational identity and access management (IAM) platform service • Simplify](https://reader035.vdocuments.us/reader035/viewer/2022081406/5f0ddd417e708231d43c76a0/html5/thumbnails/9.jpg)
Example: Automation
Courtesy of Francesco De Carlo, Argonne National Laboratory (2016)
dmagic.readthedocs.ioSpot.nersc.gov
![Page 10: Building the Research Applications and Services Ecosystem with … · 2017-04-17 · Globus Auth • Foundational identity and access management (IAM) platform service • Simplify](https://reader035.vdocuments.us/reader035/viewer/2022081406/5f0ddd417e708231d43c76a0/html5/thumbnails/10.jpg)
Example: Command Line Interfaces
docs.globus.org/cli
![Page 11: Building the Research Applications and Services Ecosystem with … · 2017-04-17 · Globus Auth • Foundational identity and access management (IAM) platform service • Simplify](https://reader035.vdocuments.us/reader035/viewer/2022081406/5f0ddd417e708231d43c76a0/html5/thumbnails/11.jpg)
Security Challenge• How to provide:
– Login to appso Web, mobile, desktop, command line
– Protect all REST API communications• While:
– Not introducing even more identities– Providing least privileges security model– Being agnostic to programming language and
framework– Being web friendly– Making it easy for users and developers
11
![Page 12: Building the Research Applications and Services Ecosystem with … · 2017-04-17 · Globus Auth • Foundational identity and access management (IAM) platform service • Simplify](https://reader035.vdocuments.us/reader035/viewer/2022081406/5f0ddd417e708231d43c76a0/html5/thumbnails/12.jpg)
Globus Auth
• Foundational identity and access management (IAM) platform service
• Simplify creation and integration of advanced apps and services
• Brokers authentication and authorization interactions between:– end-users– identity providers: InCommon, XSEDE, Google,
portals– services: resource servers with REST APIs– apps: web, mobile, desktop, command line clients– services acting as clients to other services
12
![Page 13: Building the Research Applications and Services Ecosystem with … · 2017-04-17 · Globus Auth • Foundational identity and access management (IAM) platform service • Simplify](https://reader035.vdocuments.us/reader035/viewer/2022081406/5f0ddd417e708231d43c76a0/html5/thumbnails/13.jpg)
Globus Auth
• Identity and access management PaaS
docs.globus.org/api/auth
• Introduction• Developer Guide• Reference
13
![Page 14: Building the Research Applications and Services Ecosystem with … · 2017-04-17 · Globus Auth • Foundational identity and access management (IAM) platform service • Simplify](https://reader035.vdocuments.us/reader035/viewer/2022081406/5f0ddd417e708231d43c76a0/html5/thumbnails/14.jpg)
Based on widely used web standards
• OAuth 2.0 Authorization Framework– aka OAuth2
• OpenID Connect Core 1.0– aka OIDC
14
![Page 15: Building the Research Applications and Services Ecosystem with … · 2017-04-17 · Globus Auth • Foundational identity and access management (IAM) platform service • Simplify](https://reader035.vdocuments.us/reader035/viewer/2022081406/5f0ddd417e708231d43c76a0/html5/thumbnails/15.jpg)
Log in with Globus• Similar to:
“Log in with Google”“Log in with Facebook”
• Using existing identities• Providing access to
community services
![Page 16: Building the Research Applications and Services Ecosystem with … · 2017-04-17 · Globus Auth • Foundational identity and access management (IAM) platform service • Simplify](https://reader035.vdocuments.us/reader035/viewer/2022081406/5f0ddd417e708231d43c76a0/html5/thumbnails/16.jpg)
Protect all REST API communications
• App à Globus services• App à non-Globus services• Service à Service
16
![Page 17: Building the Research Applications and Services Ecosystem with … · 2017-04-17 · Globus Auth • Foundational identity and access management (IAM) platform service • Simplify](https://reader035.vdocuments.us/reader035/viewer/2022081406/5f0ddd417e708231d43c76a0/html5/thumbnails/17.jpg)
Globus Transfer API
• Nearly all Globus Web App functionality implemented via public Transfer API– File and folder management, transfer, sharing,
and sync
docs.globus.org/api/transfer
17
![Page 18: Building the Research Applications and Services Ecosystem with … · 2017-04-17 · Globus Auth • Foundational identity and access management (IAM) platform service • Simplify](https://reader035.vdocuments.us/reader035/viewer/2022081406/5f0ddd417e708231d43c76a0/html5/thumbnails/18.jpg)
Globus Python SDK
• Python client library for the GlobusAuth and Transfer REST APIs
globus.github.io/globus-sdk-python
• Open source
18
![Page 19: Building the Research Applications and Services Ecosystem with … · 2017-04-17 · Globus Auth • Foundational identity and access management (IAM) platform service • Simplify](https://reader035.vdocuments.us/reader035/viewer/2022081406/5f0ddd417e708231d43c76a0/html5/thumbnails/19.jpg)
Python SDK Jupyter notebook
• Jupyter (iPython) notebook demonstrating use of Python SDK
github.com/globus/globus-jupyter-notebooks
• Open source
19
![Page 20: Building the Research Applications and Services Ecosystem with … · 2017-04-17 · Globus Auth • Foundational identity and access management (IAM) platform service • Simplify](https://reader035.vdocuments.us/reader035/viewer/2022081406/5f0ddd417e708231d43c76a0/html5/thumbnails/20.jpg)
HTTPS to Endpoints
• Each endpoint HTTPS server is a Globus Auth protected service
• Web pages can link to files on server• Apps and services can request access
token to access endpoint via HTTPS
20
![Page 21: Building the Research Applications and Services Ecosystem with … · 2017-04-17 · Globus Auth • Foundational identity and access management (IAM) platform service • Simplify](https://reader035.vdocuments.us/reader035/viewer/2022081406/5f0ddd417e708231d43c76a0/html5/thumbnails/21.jpg)
Globus Search PaaS (coming soon)
• All data, irrespective of location• Access controlled metadata and data• Schema agnostic• Flexible, deep metadata indexing• Rich query API• Ingestion API
![Page 22: Building the Research Applications and Services Ecosystem with … · 2017-04-17 · Globus Auth • Foundational identity and access management (IAM) platform service • Simplify](https://reader035.vdocuments.us/reader035/viewer/2022081406/5f0ddd417e708231d43c76a0/html5/thumbnails/22.jpg)
Why Globus Auth for your service?
• Outsource all identity management and authentication– Federated identity with InCommon, Google, etc.
• Outsource your REST API security– Consent, token issuance, validation, revocation– You provide service-specific authorization
• Apps use your service like all others– Its standard OAuth2 and OIDC
• Your service can seamlessly leverage other services• Other services can leverage your service• Implement your service using any language and framework
Add your service to the science cyberinfrastructure platform
22
![Page 23: Building the Research Applications and Services Ecosystem with … · 2017-04-17 · Globus Auth • Foundational identity and access management (IAM) platform service • Simplify](https://reader035.vdocuments.us/reader035/viewer/2022081406/5f0ddd417e708231d43c76a0/html5/thumbnails/23.jpg)
Join the Globus developer community
• Join [email protected] mailing lists: globus.org/mailing-lists
• Documentation: docs.globus.org• Python SDK and CLI• Examples: Jupyter notebook, sample data
portal, native app examples
Together we can build an integrated ecosystem of services and applications
23
![Page 24: Building the Research Applications and Services Ecosystem with … · 2017-04-17 · Globus Auth • Foundational identity and access management (IAM) platform service • Simplify](https://reader035.vdocuments.us/reader035/viewer/2022081406/5f0ddd417e708231d43c76a0/html5/thumbnails/24.jpg)
Thank you to our sponsors!U . S . D E PARTMENT OF
ENERGY
24