Globus Auth

[yuanzhou]

Currently I'm exploring options to implement SSO for our organization. We have multiple systems running under the same main domain name with different sub-domains on AWS. Each system has its own login/logout implementations via Globus Auth. Some systems are WordPress sites with member management and the auth is handled using OpenID Connect plugin with Globus Auth. Some systems are Python web apps that handle the Globus login/logout very differently through sessions and cookies or browser's local storage. So in short, the login/logout of each sub-domain system is different.

Globus Auth is compliant with the OAuth2 and OpenID Connect standards, but extends them to support use cases that are beyond the scope of those standards.

For authenticated users, the sub-systems use the Globus Auth token along with other tokens for further talks to the backend APIs. Would I be able to use Vouch to pass around the Globus Auth token between requests?

Before digging into the details of Vouch with the Nigix auth_request module, I wanted to ask if Globus can be integrated with Vouch?

I also found this tool: https://github.com/pusher/oauth2_proxy but it seems Globus Auth is not one of the supported providers.

Please advise. Thanks!

[bnfinet]

Hello @yuanzhou

I don't know of anyone else using Globus Auth with Vouch Proxy but if your use case is the typical "enforce login to OAuth2/OIDC provider" (Globus in this case) then I'd think it would be worth a try.

This looks fairly straight forward
https://docs.globus.org/api/auth/developer-guide/

For authenticated users, the sub-systems use the Globus Auth token along with other tokens for further talks to the backend APIs. Would I be able to use Vouch to pass around the Globus Auth token between requests?

Possibly yes. @artagel recently developed #104 which allows passing IdP through tokens to backend apps.

Before digging into the details of Vouch with the Nigix auth_request module, I wanted to ask if Globus can be integrated with Vouch?

It certainly could be. Its possilbe that a slight modification to Vouch Proxy to properly receive the userinfo json from Globus Auth would be necessary for full integration. This has been the case for other providers. (#141 for example).

I'd be happy to review a PR for Globus Auth if you'd care to develop one. The other relevant PRs should offer good guidance on how to do that.

Cheers!