Basic Questions on Python SDK

[John Gullett]

Hi all,

My name is Julian, and I'm an academic researcher. My lab uses Globus to transfer protected data between third-party data providers and our research computing environment. 

I have no issues using the Globus web platform to transfer data between collections, but the directory structure of our data partner is incredibly inconvenient.  They use a Year/Month/Day/Country structure which makes transferring data for a week's worth of data for single country very tedious.  I'd like to write a script to transfer data in a more structured way, by crawling over lower levels of this collection.  

I've been familiarizing myself with Globus v4 - SDK for Python documentation and chatting with a couple Globus support staff, but I'm still struggling to figure things out.  Many of the examples use NativeAppAuthClient(), but none use ConfidentialAppAuthClient().  

I was only able to find this example, which explains the creation of confidential client app and how to acquire tokens.  It doesn't describe how to use those tokens for transfer.  I've tried to plug-and-play my confidential client app into the examples for native clients, but they fail with:

Only native app clients can access https://auth.globus.org/v2/web/auth-code. If you meant to create a native app client, you will need to create a new client on the Globus developers page.

I get the feeling I'm missing something rather basic, so I thought posting here might be useful.  Please feel free to redirect me if this is an inappropriate forum!

Cheers,

Julian 

[Beth Halsema]

Hi John,

It sounds like you are attempting to use a NativeApp flow while using a client credentials grant.  If you have a client registered as a Confidential Client (used for automation or service accounts), then your code should look something like the flow presented in the Globus SDK Examples  (https://globus-sdk-python.readthedocs.io/en/stable/examples/client_credentials.html).

In short, there is no auth-code for token exchange when using a confidential client app.  You already have a token as the result of the confidential client's authentication.  

I hope that this helps.

Regards,

Beth

--

Beth A. Halsema  

Senior Software Engineer

 

Email: be...@globus.org 

Mailing Address:  The University of Chicago - Globus, NBC Tower, 455 N Cityfront Plaza Drive, Suite 3250, Chicago, IL 60611

[Stephen Rosen]

Hi Julian,

Just to add a little more information here, if you are trying to use a service account, then your use case is a perfect fit for the SDK's Usage Patterns docs, specifically the section on Service Accounts. (Please confirm that you really want a service account at all.)

It might also be worth checking over the Getting Started section, which is the lowest-friction way of getting a native app up and running.

In general, we've seen a lot of users benefit from the GlobusApp tooling we've built out, which automatically handles a lot of token manipulations and authentication requirements for you.

If you see documentation about using the Python SDK with NativeAppAuthClient or ConfidentialAppAuthClient and it does not at least mention GlobusApp, it's quite likely that the doc is something older which we haven't gotten around to updating yet.

Cheers,

-Stephen