globus-connect-server storage-gateway create Google Drive - Create a Google Drive Storage Gateway



The globus-connect-server storage-gateway create Google Drive command creates a new Google Drive storage gateway. When creating a storage gateway, provide the policies to access a storage system via Globus Connect Server collections.

The Google Drive connector provides access to data stored in Google’s Drive service. Before creating a Google Drive storage gateway, follow the instructions in the connector configuration manual to create the Google application with permissions to access storage.

Google Drive Virtual Filesystem

Google Drive acts somewhat like as a filesystem, but there are differences in some semantics and in how files are related to directories that are slightly different than a normal filesystem on a desktop operating system.

To make things appear like a normal filesystem, Globus Connect Server provides these subdirectories of the root directory of a Google Drive storage gateway:

/My Drive

Files owned by the user’s Google account that are located in the user’s root directory. This is treated the user’s home directory on collections created using the Google Drive connector.

/Shared With Me

Files and directories owned by others which have been shared with the user’s Google account.


Files and directories to which the user’s Google account has added the starred attribute.

/Team Drives

Directories which are Google Shared Drives (formerly called Team Drives) which the user’s Google account has been granted access to.


Files and directories which the user’s Google account has deleted.


Google Drive, unlike most filesystems, allows multiple objects to have the same name in the same directory. If this exists in your data, Globus will not be able to process these ambiguous files. If you need to transfer a directory that contains such files, you must first delete or rename them.

Authentication Policies

There are three command-line options that control which user identities are allowed access to the data on a storage gateway: --domain, --authentication-timeout-mins, and --high-assurance.

The value of the --domain command-line option restricts access to users who have an identity in the given domain. This may be configured to be multiple values to allow authentication by multiple identity providers. If more than one domain is allowed, the storage gateway needs to have an identity mapping method configured to decide how to process names from the different identity namespaces. See Identity Mapping Policies for more information.

The value of the --authentication-timeout-mins command-line option defines the timeout (in minutes) after which a user will need to re-authenticate in order to access mapped collections on non high assurance storage gateways or for any data access on high assurance storage gateways. If this is not supplied, the default value of this timeout is 11 days.

The value of the --high-assurance command-line option defines whether the storage gateway manages high assurance data. If it is set, then the authentication timeout is enforced on per application sessions.

Identity Mapping Policies

Globus Connect Server v5.4 supports a flexible system for mapping user identity information in Globus to the local account needed to access data on a variety of storage systems. This includes a default mapping for cases where there is only one allowed domain, as well as pattern-based mappings and callouts to external programs for custom mapping algorithms.

Default Identity to Username Mapping

Custom Identity to Username Mapping

The --identity-mapping command-line option configures a storage gateway to use either an expression based identity mapping or an external identity mapping program. See the Identity Mapping Guide for more information.

The --identity-mapping command-line option can be passed on the command-line with a few different types of data as its arguments:

--identity-mapping external:CMD

When mapping a identity to a username, Globus Connect Server invokes the command-line program CMD to map the identity. The value of the CMD string will be parsed as a shell command-line, so arguments may be included if quoted. A full description of the input, output, and arguments to the program are included in Identity Mapping Guide.

--identity-mapping file:JSON_FILE
--identity-mapping JSON

The JSON_FILE argument is a path to a file which contains a JSON document containing the mapping configuration, as described in the Identity Mapping Guide. The JSON argument is the json document itself.

User Policies

The --user-allow and --user—​deny command-line options control which users may access data on a storage gateway. These operate on the result of the identity mapping, a user name that is in the namespace of storage gateway. This may be a user name, id, or email address based on the storage gateway requirements.

A username is allowed or denied access depending on whether the --user-allow and --user—​deny command-line option are set on a storage gateway, and whether the username is present in one or both of those policies. In general, if a username is in the value of --user—​deny it is always denied, and if a --user-allow policy is provided the username must be in the policy value in order to be allowed access.

The full set of effects of these policies are contained in the following table:

--user-allow --user—​deny result





not a member






not a member





not a member



not a member

not a member


not a member






Google Drive Policies

The Google Drive connector has policies to manage application credentials, and set the user api rate quota.

Application Credentials

The --google-client-id and --google-client-secret command-line options provide information for Globus Connect Server to authenticate with Google Drive. These are configured by setting up the application project as described in the Google Drive Connector configuration guide.

User API Rate Quota

The Google Drive API has a per-user API rate quota that can not be determined programmatically by the connector. If your site has negotiated a higher quota than the default, or sees transfer errors because of quota issues, you can tune this setting to raise or lower the quota that the Google Drive connector attempts to stay under. The value of is the maximum number of requests per 100 seconds. Use the --google-drive-api-rate-quota command-line option to set this value.

Data Access Policies

The --restrict-paths command-line option controls access to subtrees of the data provided by the storage gateway. This is configured using the PathRestrictions document type.

Path restrictions provide a framework for administrators to constrain data access on the storage gateway. Restrictions can be set at the folder level. They may allow read, write, or deny access to data. These are absolute paths from the root of the storage gateway virtual file system.


-h, --help

Show help message and exit.


Show the version and exit.

-F, --format "text"|"json"

Output format for this command. If the format is json, then the resulting role document is displayed.

--user-deny username

Connector-specific username for a user denied access to this Storage Gateway. Give this option multiple times to deny multiple users. Set a value of "" to clear this value.

--user-allow username

Connector-specific username for a user allowed access to this Storage Gateway. Give this option multiple times to allow multiple users. Set a value of "" to clear this value.

--identity-mapping external:CMD
--identity-mapping file:JSON_FILE | JSON

Identity Mapping configuration for use in this Storage Gateway. You can use JSON input to specify a complete mapping document, or, if you want to use an external command for mapping, use external:command --arguments. Give this option multiple times to set multiple mappings in order of precedence. Set a value of null to clear this value.

--restrict-paths JSON | file:JSON_FILE

Path restrictions for accessing data on collections created using this storage gateway.

--domain DOMAIN

Allowed domain. Give this option multiple times to allow multiple domains. Users creating credentials or collections on this storage gateway must have an identity in one of these domains.

--authentication-timeout-mins INT

Timeout (in minutes) during which a user is required to have authenticated in a session to access this storage gateway.


Flag indicating that High Assurance features are required on this storage gateway.

--google-client-id CLIENT_ID

The client ID of the google application that Globus Connect Server will be accessing the Google Drive resource as.

--google-client-secret SECRET

The application secret associated with the client_id.

--google-drive-user-api-rate-quota REQ_PER_100_SEC

Quota to use as the maximum number of Google Drive API requests per 100 seconds.