ActiveScale
The Globus Connect Server ActiveScale Connector provides access to ActiveScale storage via Globus Connect Server.
This document describes the data types and API routes provided by this connector.
ActiveScale Connector Virtual Filesystem
The ActiveScale connector provides a distributed object store, where each data object is accessed based on a bucket name and an object name.
The ActiveScale connector attempts to make this look like a regular
filesystem, by treating the bucket name as the name of a directory
in the root of the storage gateway’s file system. For example, if a
user has access to buckets bucket1 and bucket2, then those buckets
would show up as directories when listing /.
The ActiveScale connector also treats the / character as a delimiter
in the S3 API so that it can present something that looks like like
subdirectories. For example, the object object1 in bucket1 would
appear as /bucket1/object1 to the ActiveScale connector, and the
object object2/object3 in bucket2 would appear as a file called
object3 in the directory /bucket2/object2.
Authenticated and Anonymous Access
Each ActiveScale Storage Gateway can be configured to perform either authenticated or unauthenticated access to ActiveScale data. When creating an ActiveScale Storage Gateway, you must choose which type of access to require.
- authenticated
-
Globus users must register an ActiveScale Credential with Globus Connect Server in order to access data on its collections. The credential must be associated with ACLs permitting the desired level of access.
- unauthenticated
-
Globus users can only access ActiveScale Buckets that permit anonymous access.
ActiveScale Storage Gateway Policies
The s3_user_credential_required, s3_buckets, and s3_endpoint properties control access to an ActiveScale resource.
Endpoint
The s3_endpoint property is used by Globus Connect Server to contact the ActiveScale S3 API to access data on this storage gateway. This should be the URL of the ActiveScale storage system.
Access Mode
If the s3_user_credential_required property is enabled, then each user accessing collections on this storage gateway must register an ActiveScale access key id and secret key with the storage gateway.
Bucket Restrictions
The s3_buckets property value is the list of bucket names which are allowed access by this storage gateway.
If no buckets are configured, then any buckets accessible using the user’s registered ActiveScale key_id and secret_key may be accessed by collections on this storage gateway. If any are configured, then they act as restrictions to which buckets are visible and accessible on collections on this storage gateway.
ActiveScale User Credentials
ActiveScale user credentials can either be a placeholder for unauthenticated bucket access, or can contain an ActiveScale key_id and secret access_key value. The type of credential needed for any particular collection is based on the configuration of the storage gateway that it uses.
Storage Gateway Allowing Anonymous Bucket Access
In order to access a collection using the ActiveScale connector configured for anonymous bucket access, users don’t have to do anything to create a credential. It will be automatically provisioned on first use.
Users may disable and reenable a credential by changing the value of the invalid property.
Storage Gateway Requiring a Key
In order to access a collection using the ActiveScale connector
configured to use an ActiveScale key, users must supply key
information to the GCS Manager.
This can be most easily done via the Globus web application.
If a user does not supply key information, the credential will have its
invalid property set to true and must be updated by the
user to include key data.
The key provided by the user must have the appropriate permissions to access ActiveScale buckets and objects.
Creating a Credential
When creating a credential, the caller MUST include values for the DATA_TYPE and storage_gateway_id properties. If any of these are missing, the credential can not be created. If the identity_id value is missing, the identity with the lowest-valued identity id value in the caller’s identity set which meets the storage gateway policies is used.
In order for a credential to be valid, it must have values for the
DATA_TYPE, s3_key_id and s3_secret_key in the policies
document. If any of these are missing, the credential is created,
but its invalid property is set to true and it cannot be used
until the user has updated the credential.