globus online globus nexus · policy cim-earth understand asc flash supernovae to measure universe...
TRANSCRIPT
![Page 1: globus online Globus Nexus · policy CIM-EARTH Understand ASC FLASH supernovae to measure universe ARTFL Conte Center Map human knowledge in the ... – Consolidates troubleshooting](https://reader035.vdocument.in/reader035/viewer/2022081614/5fc162d4fbb0f9125e6c966e/html5/thumbnails/1.jpg)
globus online
Globus Nexus
Steve TueckeComputation InstituteUniversity of Chicago and Argonne National Laboratory
![Page 2: globus online Globus Nexus · policy CIM-EARTH Understand ASC FLASH supernovae to measure universe ARTFL Conte Center Map human knowledge in the ... – Consolidates troubleshooting](https://reader035.vdocument.in/reader035/viewer/2022081614/5fc162d4fbb0f9125e6c966e/html5/thumbnails/2.jpg)
www.globusonline.org
Promulgatevia new educational
methods
Apply to challenging problems
Computation Institute (CI)
Accelerateby building the research cloud
![Page 3: globus online Globus Nexus · policy CIM-EARTH Understand ASC FLASH supernovae to measure universe ARTFL Conte Center Map human knowledge in the ... – Consolidates troubleshooting](https://reader035.vdocument.in/reader035/viewer/2022081614/5fc162d4fbb0f9125e6c966e/html5/thumbnails/3.jpg)
www.globusonline.org
Apply computation: Examples
Create better models for climate & energypolicy CIM-EARTH
ASC FLASHUnderstand supernovae to
measure universe
ARTFL Conte Center
Map human knowledge in the humanities and science
Transformdigital media into art
CMTS
Explaincellular structur
Center for multiscale theory and simulation
Extract meaning fromscientificimages
DTI for TBIDiffusion tensor imaging
![Page 4: globus online Globus Nexus · policy CIM-EARTH Understand ASC FLASH supernovae to measure universe ARTFL Conte Center Map human knowledge in the ... – Consolidates troubleshooting](https://reader035.vdocument.in/reader035/viewer/2022081614/5fc162d4fbb0f9125e6c966e/html5/thumbnails/4.jpg)
www.globusonline.org
The Research Cloud
Accelerate discovery via research cloud
Millions of researchers worldwide need advanced IT to tackle important and urgent problems
Accelerate discovery and innovation worldwide by providing research IT as a service
![Page 5: globus online Globus Nexus · policy CIM-EARTH Understand ASC FLASH supernovae to measure universe ARTFL Conte Center Map human knowledge in the ... – Consolidates troubleshooting](https://reader035.vdocument.in/reader035/viewer/2022081614/5fc162d4fbb0f9125e6c966e/html5/thumbnails/5.jpg)
![Page 6: globus online Globus Nexus · policy CIM-EARTH Understand ASC FLASH supernovae to measure universe ARTFL Conte Center Map human knowledge in the ... – Consolidates troubleshooting](https://reader035.vdocument.in/reader035/viewer/2022081614/5fc162d4fbb0f9125e6c966e/html5/thumbnails/6.jpg)
www.globusonline.org
Why SaaS?
• Deliver advanced functionality that:– Requires no user software installation or operation
• Minimal IT proficiency required
– Can be cheaply and incrementally adopted• Usage-based subscription pricing; no big up-front costs
– Consolidates troubleshooting and support• An expert group can proactively detect and correct problems
– Utilizes an efficient software delivery lifecycle• Updates developed, tested and deployed quickly
• Dominates commercial & consumer markets– What about the research market?
Software-as-a-Service (SaaS)
Platform-as-a-Service (PaaS)
Infrastructure-as-a-Service (IaaS)
![Page 7: globus online Globus Nexus · policy CIM-EARTH Understand ASC FLASH supernovae to measure universe ARTFL Conte Center Map human knowledge in the ... – Consolidates troubleshooting](https://reader035.vdocument.in/reader035/viewer/2022081614/5fc162d4fbb0f9125e6c966e/html5/thumbnails/7.jpg)
www.globusonline.org
• Transfer and synchronize files– Easy “fire-and-forget” transfers– Automatic fault recovery– High performance– Across multiple security domains
• Minimize IT costs– Software as a Service (SaaS)
• No client software installation• New features automatically available
– Consolidated support & troubleshooting– Simple endpoint installation with Globus Connect and GridFTP
>5,000 registered users, 6PB / 500M files transferred
Globus Transfer: For when you want to…
7
![Page 8: globus online Globus Nexus · policy CIM-EARTH Understand ASC FLASH supernovae to measure universe ARTFL Conte Center Map human knowledge in the ... – Consolidates troubleshooting](https://reader035.vdocument.in/reader035/viewer/2022081614/5fc162d4fbb0f9125e6c966e/html5/thumbnails/8.jpg)
www.globusonline.org
Commercial storage service
provider
National research center
Campus computing center
• Place your data where you want
• Access it from anywhere via different protocols
• Update it, version it,and take snapshots
• Share versions with who you want
• Synchronize among locations
Globus Storage: For when you want to …
Globus Storage volume
Globus Transfer, HTTP/REST, Desktop sync
![Page 9: globus online Globus Nexus · policy CIM-EARTH Understand ASC FLASH supernovae to measure universe ARTFL Conte Center Map human knowledge in the ... – Consolidates troubleshooting](https://reader035.vdocument.in/reader035/viewer/2022081614/5fc162d4fbb0f9125e6c966e/html5/thumbnails/9.jpg)
www.globusonline.org
Join with a few or many people to:• Share documents• Track tasks• Communicate• Share data • Work togetherWith:• Common groups• Delegated
management
Globus Collaborate: For when you want to…
![Page 10: globus online Globus Nexus · policy CIM-EARTH Understand ASC FLASH supernovae to measure universe ARTFL Conte Center Map human knowledge in the ... – Consolidates troubleshooting](https://reader035.vdocument.in/reader035/viewer/2022081614/5fc162d4fbb0f9125e6c966e/html5/thumbnails/10.jpg)
www.globusonline.org
• No one SaaS provider can deliver it all• Must create ecosystem that:
– Allows any SaaS provider to easily participate– Dramatically reduces the cost of creating and
operating services within the ecosystem– Provides seamless user experience across services– Agnostic to / works across any cloud IaaS provider– Integrates with (existing) research infrastructure
• Ecosystem requires Platform as a Service– Target the unique needs of the research community
PaaS for Research
10
Software-as-a-Service (SaaS)
Platform-as-a-Service (PaaS)
Infrastructure-as-a-Service (IaaS)
![Page 11: globus online Globus Nexus · policy CIM-EARTH Understand ASC FLASH supernovae to measure universe ARTFL Conte Center Map human knowledge in the ... – Consolidates troubleshooting](https://reader035.vdocument.in/reader035/viewer/2022081614/5fc162d4fbb0f9125e6c966e/html5/thumbnails/11.jpg)
www.globusonline.org
• Integrate with the Globus research cloud ecosystem• Write programs that leverage:
– user identities, profiles, groups (Globus Nexus)– data, compute and collaboration
… via REST APIs and command line programs
Globus Integrate
Globus Integrate: For when you want to…
Globus Transfer
Globus Storage
Globus Collaborate
Globus Connect Multi User
Globus Connect
Globus NexusGlobus Toolkit
Globus Compute
![Page 12: globus online Globus Nexus · policy CIM-EARTH Understand ASC FLASH supernovae to measure universe ARTFL Conte Center Map human knowledge in the ... – Consolidates troubleshooting](https://reader035.vdocument.in/reader035/viewer/2022081614/5fc162d4fbb0f9125e6c966e/html5/thumbnails/12.jpg)
www.globusonline.org
Globus Nexus: For when you want to…
12
Manage groups
Manage identities
Manage profiles
![Page 13: globus online Globus Nexus · policy CIM-EARTH Understand ASC FLASH supernovae to measure universe ARTFL Conte Center Map human knowledge in the ... – Consolidates troubleshooting](https://reader035.vdocument.in/reader035/viewer/2022081614/5fc162d4fbb0f9125e6c966e/html5/thumbnails/13.jpg)
www.globusonline.org
• Nexus is a federated identity relying party– Multiple federated identities linked to Globus account– Supports: InCommon/CILogon, OpenID, MyProxy,
OAuth for MyProxy• Nexus is a (federated) identity provider
– Native or federated identity providerto Globus and 3rd party services
– User authenticates to Globus account with username/password or via 3rd party federated identity provider
– Uses OAuth 2 profile (future: SAML, OpenID?)• Auth provider for Globus REST APIs
Globus Nexus: Manage Identities
13
![Page 14: globus online Globus Nexus · policy CIM-EARTH Understand ASC FLASH supernovae to measure universe ARTFL Conte Center Map human knowledge in the ... – Consolidates troubleshooting](https://reader035.vdocument.in/reader035/viewer/2022081614/5fc162d4fbb0f9125e6c966e/html5/thumbnails/14.jpg)
www.globusonline.org14
![Page 15: globus online Globus Nexus · policy CIM-EARTH Understand ASC FLASH supernovae to measure universe ARTFL Conte Center Map human knowledge in the ... – Consolidates troubleshooting](https://reader035.vdocument.in/reader035/viewer/2022081614/5fc162d4fbb0f9125e6c966e/html5/thumbnails/15.jpg)
www.globusonline.org
• User authentication – Web browser:
• Globus account name and password• Federated identity providers linked to Globus account
– Native application:• RSA (using SSL key)• X.509 client auth• Username/password (Globus account, SAML ECP?)
• Client authentication using RSA (SSL key)– Globus account name is valid client id
• Bearer access token for resource access
Globus Nexus use of OAuth 2
15
![Page 16: globus online Globus Nexus · policy CIM-EARTH Understand ASC FLASH supernovae to measure universe ARTFL Conte Center Map human knowledge in the ... – Consolidates troubleshooting](https://reader035.vdocument.in/reader035/viewer/2022081614/5fc162d4fbb0f9125e6c966e/html5/thumbnails/16.jpg)
www.globusonline.org
• Various (Globus) services require delegated X.509 client credentials to access resources
• Nexus federated authentication supports X.509 credential retrieval from Oauth for MyProxy– Authenticate with OAuth– Use access token to get X.509 credentials– E.g., CILogon, GCMU, XSEDE
• Nexus REST API allows authorized services (OAuth clients) to get credential
Delegated X.509 credential management
16
![Page 17: globus online Globus Nexus · policy CIM-EARTH Understand ASC FLASH supernovae to measure universe ARTFL Conte Center Map human knowledge in the ... – Consolidates troubleshooting](https://reader035.vdocument.in/reader035/viewer/2022081614/5fc162d4fbb0f9125e6c966e/html5/thumbnails/17.jpg)
www.globusonline.org
Integration of new and old
MyProxyOnline CA
PAM
Local Authentication System(LDAP, RADIUS, Kerberos etc)
Usernamepassword
Certifficate 1
Transfer request
Certificate 1
Step 5
Step 7 Step 8
Step 9
Local Storage
GridFTP Server
certificates
Access files
Step 10
Step 11
Authentication & Data Transfer
Authorization
Step 1Access Endpoints
GridFTP Server
Campu
s Cluster
Globus Connect Multi‐User
Globus Online (Hosted Service)
Campus 2
OAuthServer
Username password
Certificate 1
Certificate 1
RedirectStep 3
Step 4
Step 6
Username password
Step 2Transfer request
Certificate 2
Redirect
Certificate 2
CILogon(OAuth)
SAML
InCommonIdP
![Page 18: globus online Globus Nexus · policy CIM-EARTH Understand ASC FLASH supernovae to measure universe ARTFL Conte Center Map human knowledge in the ... – Consolidates troubleshooting](https://reader035.vdocument.in/reader035/viewer/2022081614/5fc162d4fbb0f9125e6c966e/html5/thumbnails/18.jpg)
www.globusonline.org18
![Page 19: globus online Globus Nexus · policy CIM-EARTH Understand ASC FLASH supernovae to measure universe ARTFL Conte Center Map human knowledge in the ... – Consolidates troubleshooting](https://reader035.vdocument.in/reader035/viewer/2022081614/5fc162d4fbb0f9125e6c966e/html5/thumbnails/19.jpg)
www.globusonline.org
• Globus Transfer is– OAuth client to Globus Nexus– OAuth resource provider to 3rd party client
• Goal: Allow full participation by 3rd parties– Use Globus Online services as OAuth client– Use Globus Nexus OAuth as resource server
• How to implement resource servers as a relying party to the Nexus OAuth service?– OAuth is silent on resource and OAuth server interaction– Make it easy for SaaS developers to use Nexus OAuth
OAuth client vs resource
19
![Page 20: globus online Globus Nexus · policy CIM-EARTH Understand ASC FLASH supernovae to measure universe ARTFL Conte Center Map human knowledge in the ... – Consolidates troubleshooting](https://reader035.vdocument.in/reader035/viewer/2022081614/5fc162d4fbb0f9125e6c966e/html5/thumbnails/20.jpg)
www.globusonline.org
• Ecosystem of communicating services– Any service can be client to any other service’s resource– Communication may be chained: user->s1->s2->s3
• Use OAuth scope to limit resources accessible by an access token– Must maintain scope dependency tree
• Delegation: client1 delegating to client2– Bearer access token can be passed from client1 to
client2 for full delegation– Or, allow client1 access token to be used to retrieve a
new authorization code with narrow scope that is passed to client2, which client2 uses to get its own access token
Delegated, scoped OAuth access
20
![Page 21: globus online Globus Nexus · policy CIM-EARTH Understand ASC FLASH supernovae to measure universe ARTFL Conte Center Map human knowledge in the ... – Consolidates troubleshooting](https://reader035.vdocument.in/reader035/viewer/2022081614/5fc162d4fbb0f9125e6c966e/html5/thumbnails/21.jpg)
www.globusonline.org
• User centric group management– Create group– Set policies (e.g., visibility, admins)– Control admission workflows
• Approach:– Keep identity issuance light-weight– Move vetting from identity creation to group admission– Allow each group to control own admission policy
• REST APIs– Manage, query, etc.– Import/export (into specified identity namespace)
Globus Nexus: Manage Groups
21
![Page 22: globus online Globus Nexus · policy CIM-EARTH Understand ASC FLASH supernovae to measure universe ARTFL Conte Center Map human knowledge in the ... – Consolidates troubleshooting](https://reader035.vdocument.in/reader035/viewer/2022081614/5fc162d4fbb0f9125e6c966e/html5/thumbnails/22.jpg)
www.globusonline.org
• Attribute/value information associated with Globus account
• Group admission can require an extensible set of attributes, which are drawn from and stored in the user profile
• REST APIs• Future: Integrate with SAML attribute release
and social network profiles
Globus Nexus: Manage User Profiles
22
![Page 23: globus online Globus Nexus · policy CIM-EARTH Understand ASC FLASH supernovae to measure universe ARTFL Conte Center Map human knowledge in the ... – Consolidates troubleshooting](https://reader035.vdocument.in/reader035/viewer/2022081614/5fc162d4fbb0f9125e6c966e/html5/thumbnails/23.jpg)
www.globusonline.org
• Goal: Common tools should be able to leverage federated identities, groups, profiles– Wikis, issue tracking, science gateways, etc.
• Community effort to domesticate applications and services?
• What APIs?– Identity: OAuth 2, SAML?, X.509 certs?– Groups: LDAP? REST?– Profile: OpenID Connect?
Domestication
23
![Page 24: globus online Globus Nexus · policy CIM-EARTH Understand ASC FLASH supernovae to measure universe ARTFL Conte Center Map human knowledge in the ... – Consolidates troubleshooting](https://reader035.vdocument.in/reader035/viewer/2022081614/5fc162d4fbb0f9125e6c966e/html5/thumbnails/24.jpg)
www.globusonline.org
• Visit https://www.globusonline.org/signup to:– Get a free account and start moving files
• Visit www.globusonline.org for:– Tutorials, FAQs, Pro Tips, Troubleshooting– Papers, Case Studies
• Contact [email protected] for:– Help getting started & using the service
• Follow us at @globusonline on Twitterand Globus Online on Facebook
For More Information
24