REVIEW-83: XCI-826: Deliver Globus Connect Server (GCS) v5.4 to XSEDE - Design/Security Review

Globus Connect Server version 5.4 (GCS v5.4) is the next generation of the storage provider’s interface to the Globus system. It connects a storage system to the Globus data transfer service, enabling researchers to use the Globus web application (https://app.globus.org), Globus CLI, Globus Transfer API, or a Web browser to access the storage system, subject to the administrator’s data access policies.

GCS v5.4 replaces the X.509-based security mechanism used in GridFTP and Globus Connect Server version 4 with a new mechanism based on OpenID Connect 1.0 (OIDC) and OAuth 2.0 (OAuth2). OIDC/OAuth2-based security is widely used in the research community and in the mainstream Internet.

This design and security review gives XSEDE Operations, Service Providers, and other key stakeholders an opportunity to review the most important functional, design and security characteristics of GCS v5.4. Feedback from this review should identify the most important concerns that need to be addressed to deploy GCS v5.4 in production on XSEDE. XCI is conducting endpoint deployment and access testing before releasing it to XSEDE service providers.

Most important DSR feedback:

• Suggestion to add end-user and science gateway developer documentation
• Suggestion to include GCS v4 to v5 endpoint migration information will not be addressed as XSEDE never released GCS v4
• Recommendation that the XSEDE Installation Guide better describe the use of multiple mapfiles
• Suggestion to clarify whether the identities the user must authenticate with can be configured into the Storage Gateway
• Various clarifications recommendations or broken link issues were addressed

• XSEDE GCS v5.4 Design/Security Description

• XSEDE GCS v5.4 Design/Security Description
• XSEDE GCS v5.4 Installation Guide
• GCS Domain Guide

• Does GCS satisfy XSEDE and SP security requirements and mitigate the most important risks
• Does GCS address the most important functional requirements for operators to manage storage access
• Does GCS address the most important functional requirements for users and science gateway developers to access storage systems
• Are the Design/Security Description, XSEDE Installation Guide, and Domain Guide documents clear and do they cover the most important design/security elements
• Do you have any deployment, announcement, and training recommendations