Globus Flows Consents

[James Allsopp]

Hi,

I’m trying to upload to our endpoint using the basic example trigger_transfer_flow from this example https://github.com/globus/globus-flows-trigger-examples I can get it to work, but on every transfer I get an email stating

“is unable to make progress without intervention. You may need to resolve the issue by consenting to additional services,”. It works if I do that through the web site, but not through the command line using globus-automate.

 

With SDK I could try and catch this automatically, apply for the consent and try again, but is there a way to do this with Globus Flows. As it currently is, it’s not usable having to approve each transfer manually.

 

Thanks

James Allsopp

[Kurt McKee]

Hello James,

I'm researching this now. I may need to reach out for additional details, but I'll try to have an update for you by tomorrow.

Kurt

--

Kurt McKee

Software Engineer

Globus, University of Chicago

[Kurt McKee]

James,

I've been able to reproduce this behavior using an endpoint that requires something called a "data access consent" [1]. When I start a flow using the Automate CLI, the run will become inactive while waiting to receive the data access consent.

There are two ways to unblock that specific run.

The first, and most obvious, is to use the web app to grant consent. Using the web app will unblock that specific run by adding the consent directly into the run. However, the Automate CLI will not gain the benefit of that consent, which is the behavior that you're describing -- every subsequent run needs to have the same consent re-granted, over and over.

The second method is to use the Automate CLI to grant consent. This will unblock that specific run, but as a side effect, the Automate CLI will be able to start subsequent runs with the data access consent already granted.

The Automate CLI has a `flow run-resume` subcommand [2] that should be used in this situation.

If you're on Windows, you can use Powershell to more easily resume a run after it's started. The following was tested on Powershell 7 for Windows:

# Start the flow, and save the output for later use.

$info=globus-automate.exe flow run [your options here] | ConvertFrom-Json

globus-automate.exe flow run-resume --query-for-inactive-reason --flow-id $info.flow_id $info.run_id

If you're on Linux, you can use bash and the jq utility to more easily resume a run after it's started. The following was tested using bash and jq for Linux:

# Start the flow, and save the output for later use.

globus-automate flow run [your options here] > info.json

FLOW_ID=$(jq -r '.flow_id' < info.json)

RUN_ID=$(jq -r '.run_id' < info.json)

globus-automate flow run-resume --query-for-inactive-reason --flow-id $FLOW_ID $RUN_ID

As a result of this discussion, the Automate team is looking for ways to make this workflow easier and -- importantly -- clearer.

Please let me know if this answers your question, and don't hesitate to ask more questions or provide additional feedback!

Kurt

[1]: Data Access Consent documentation

[2]: Automate CLI flow run-resume subcommand documentation

On Wed, May 3, 2023 at 1:53 PM 'James Allsopp' via Discuss <dis...@globus.org> wrote:

[Rachana Ananthakrishnan]

Hi James,

I’d like to add a couple of things:

- Mapped collections require consent the first time they are accessed from an application, not for each transfer. They also have an authentication timeout requirement specified by the administrator of the mapped collection, that requires user authentication within the specified timeout. So complete automation without user intervention is not feasible with these.

- For full automation, guest collections (or shared endpoints) are needed. That allows consent and user authentication once, and eliminates the need for user to repeatedly authenticate. 

Hope this helps in your use of Flows. Please feel free to reach out to us here, or at sup...@globus.org, for any further assistance. 

Rachana

--
You received this message because you are subscribed to the Google Groups "Discuss" group.
To unsubscribe from this group and stop receiving emails from it, send an email to discuss+u...@globus.org.

[James Allsopp]

Hi,

I'm trying to transfer from

6459185c-3553-11e9-9fa5-0a06afd4a22e, a GCSv4 server

to here; a95af0f3-a49d-407f-aee8-d4b32bab380a which is a Managed Mapped Collection.

When I run my code, it transfers the data, but I'm still stuck with the  " is unable to make progress without intervention." problem. I've got all of the tokens stored locally in a json file, as per the examples, and aren't asked for any more when I run the code.

The problem is that every time I run this code, I get the "unable to make progress" error message. The destination server is limited to 31 days authentication so I shouldn't be hitting that limit as I'm trying to run the code twice in less than ten minutes. When I get to the globus site, I'm asked to "Review Consents", when I just want this to be done once, until the next 31 days window starts.

 Is there a way I can debug this to see why I'm getting this error each time I run it, rather than once every 31 days? I'm using the python globus-sdk.

Thanks for your help,

James

[Ada Nikolaidis]

Hi James,

In order to better understand the issue, it may make sense to review of the code in question and perhaps share access to the flow and some of the runs to provide context that will help determine how to get things working. Would you be willing to open a ticket with sup...@globus.org and reference this thread? I'll make sure that I'm assigned to it and will work with you to figure out precisely what's happening.

Thanks,

Ada

Ada Nikolaidis
Globus Software Engineering Manager
Globus.org | University of Chicago