Set Up Access to AmSC Resources

NDIP can use American Science Cloud (AmSC) computing resources to run demanding analysis jobs remotely. Currently, this includes submitting jobs to NERSC Perlmutter and retrieving their results; support for running jobs on OLCF Frontier is planned for a later release.

NDIP uses the AmSC IRI and Data Transfer APIs to stage job inputs, access the remote service, and transfer results back on your behalf. Before using these resources, generate an IRI refresh token and a Globus Transfer refresh token, then save both tokens in your NDIP user preferences.

Work in progress

This access workflow is still under development. The current Globus tokens will be replaced with AmSC tokens, and a simpler way to generate the required tokens will be provided.

Generate the Globus tokens

Download get_globus_token.py from the NDIP Platform repository. You can also download it directly from a terminal:

curl --fail --location \
  --output get_globus_token.py \
  https://code.ornl.gov/ndip/platform/-/raw/main/scripts/get_globus_token.py

If the globus_sdk module is not installed, install it first:

python -m pip install globus-sdk

Run the downloaded script:

python get_globus_token.py

The script prints a Globus authorization URL. Open the URL in a browser, sign in, and approve the requested permissions. Globus then provides an authorization code; paste that code into the terminal when prompted.

At the end of the run, the script prints the requested scopes followed by a JSON token response similar to this shortened example:

{
  "resource_server": "transfer.api.globus.org",
  "refresh_token": "<Globus Transfer refresh token>",
  "other_tokens": [
    {
      "scope": "https://auth.globus.org/scopes/ed3e577d-f7f3-4639-b96e-ff5a8445d699/iri_api",
      "refresh_token": "<Globus IRI refresh token>"
    }
  ]
}

Copy the two values as follows:

• The top-level refresh_token is the Globus Transfer refresh token.
• The refresh_token inside the other_tokens entry whose scope ends in /iri_api is the Globus IRI refresh token.

The script also saves the complete response to ~/.globus/transfer_tokens.json. If needed, use the following commands to display the saved refresh tokens:

Globus IRI refresh token

jq -r '.other_tokens[] | select(.scope | contains("/iri_api")) | .refresh_token' \
  ~/.globus/transfer_tokens.json

Globus Transfer refresh token

jq -r '.refresh_token' ~/.globus/transfer_tokens.json

If jq is not installed, open ~/.globus/transfer_tokens.json in a text editor. The Transfer refresh token is the top-level refresh_token. The IRI refresh token is the refresh_token in the other_tokens entry whose scope contains /iri_api.

danger

Refresh tokens are credentials. Do not share them, commit them to source control, or include them in screenshots or support requests.

Add the tokens to NDIP

1. Go to ndip.ornl.gov and sign in.
2. Open User Preferences.
3. Select Manage Information.
4. Enter the following values:

Field	Value
Globus client ID	dbd89243-4ac3-40a5-9c24-3b6c16c239e0
Globus IRI refresh token	The refresh token from the /iri_api entry
Globus transfer refresh token	The top-level Transfer refresh token

5. Save your changes.

NDIP can now use your Globus authorization to submit jobs to supported AmSC computing resources and retrieve the resulting data.