Hi,
I read the "Cloud Bursting Galaxy" paper (https://doi.org/10.1101/506238). It
helped a lot with my understanding, but I still have some basic questions about
how to set up the AWS trust relationship. The paper has this example:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Federated": "accounts.google.com"
},
"Action": "sts:AssumeRoleWithWebIdentity",
"Condition": {
"StringEquals": {
"accounts.google.com:aud": "8936...apps.googleusercontent.com"
}
}
}
]
}
I think it means that Galaxy can assume the role for anyone who logs in to
Galaxy with a Google account (because the id_token audience matches the Galaxy
client_id registered with Google). Shouldn't the role be restricted to a
specific set of Google accounts via a condition on "accounts.google.com:sub" or
do we trust Galaxy to manage per-user access to that role?
To configure the role to accept CILogon/Custos/Keycloak id_tokens,
https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-idp_oidc.html
makes me think we just replace "accounts.google.com:aud" with
"cilogon.org:aud" or "iamdev.scigap.org:aud" following the
"server.example.com:aud" pattern. Anyone want to help me test that scenario? Do
I need a Galaxy install to test it, or could I just use
https://github.com/galaxyproject/cloudauthz directly?
Thanks,
Jim
