Section E.1.1 may undercount people who use XSEDE identities in applications

In Section E.1.1, there's an analysis of how many additional people are likely to need Duo enrollment. It cites the number of people who use XSEDE's Web SSO service and compares to those who use XSEDE's SSO Hub, which already requires Duo. This analysis is made looking at use of XSEDE identities in XSEDE applications, which is surely the most critical category of applications to be considered. But it isn't the only place XSEDE identities are used.

XSEDE identities are also used in systems such as (but not limited to) Globus, where they may either be used as an option for signing into the application or, in some cases, are required to authorize access to XSEDE systems. (E.g., data transfer endpoints hosted by XSEDE service providers for use by XSEDE users require an XSEDE identity to authorize data access. When upgraded to Globus Connect Server version 5, these will also use the new XSEDE IDP for this requirement and will thus require enrollment in XSEDE's Duo.)

The data used for the former (XSEDE Web SSO) didn't include use of XSEDE identities in other applications--including the Globus web app, CLI, or APIs for data management services. It does, of course, include use of XSEDE identities in the XSEDE User Portal (XUP) and Jetstream's web interface, Atmosphere, which are the top two XSEDE web apps that use Globus Auth by number of unique users. So the potential undercount is people who use XSEDE identities in applications via Globus Auth, but don't regularly use them in XSEDE web apps.

I expect this isn't a huge number, and I don't think it should change any decisions, but we can probably expect the number to be somewhat larger than the estimate in section E.1.1 for this reason.