About Globus Authentication
Why We Use Globus
The UW Biotechnology Center uses Globus as the login system for this portal. Rather than creating yet another username and password for you to manage, Globus lets you sign in using credentials you already have — your home university, research institution, or national lab login.
This matters for scientific collaboration: a researcher at Mayo Clinic, a student at UW–Madison, and a collaborator at a national lab can all authenticate securely without any of them needing a UWBC-specific account. Globus handles identity verification through your institution's own systems, and then passes a secure token to our portal — we never see or store your password.
Beyond authentication, Globus provides the same trusted infrastructure for high-performance data transfer between institutions, which is why it is the standard for moving large research datasets across the scientific community.
Institutional Login
Most universities, hospitals, and research organizations in the United States and internationally are members of the InCommon Federation — a trust network for academic and research identity management. If your institution is an InCommon member, you can log in to Globus using your existing institutional credentials, the same username and password you use for email, library access, or campus systems.
When you click Login with Globus, you will be prompted to search for your institution. Select it, and you will be redirected to your institution's own login page. Your credentials are entered there — never on our portal or Globus's servers.
Other Login Options
If your organization is not affiliated with InCommon, you still have several options:
-
Google: If your work or personal email is hosted by Google, you can use it as
your Globus identity right away.
- ORCiD: If you have an ORCiD account, you can use it to authenticate with Globus.
- Github: If you have a Github account, you can use it to authenticate with Globus.
-
Globus ID: You can create a free Globus identity directly at globusid.org. If your organization adds Globus support later, you can link your Globus ID to your institutional account at any time without losing access.
Security & Your Credentials
Globus uses the OAuth 2.0 protocol — the same standard used by "Sign in with Google" and "Sign in with Microsoft" across the web. When you authenticate, your institution's identity provider issues a secure, time-limited token. Our portal receives that token and never handles your password directly.
This architecture means that if you change your institutional password, your portal access is unaffected. It also means UWBC has no ability to recover or reset your institutional credentials — your home institution remains solely responsible for your login security.
Globus for Data Transfer
The same identity and trust infrastructure that powers your login also enables secure data transfer between institutions. Once authenticated, you can move data directly from the UWBC Globus collection to an endpoint at your home institution, a national computing facility, or your own computer — all without re-entering credentials and without the data passing through a web browser.
Transfers are monitored, retried automatically on interruption, and can be scheduled. This makes Globus the standard mechanism for delivering large genomics, imaging, and computational datasets across the research community. After logging in, visit the Data Management section to browse your group's data and find transfer instructions.
Information for IT Administrators
If your organization restricts outbound network access and a colleague needs to access or transfer data through this portal, the following information will help you add Globus to your approved resource list.
About Globus
Globus is a not-for-profit service operated by the University of Chicago, co-developed with Argonne National Laboratory. It is not a commercial product — it is research cyberinfrastructure funded by the National Science Foundation and used by over 2,600 institutions in 80+ countries, including NIH, DOE national labs, and hundreds of universities.
Globus never stores user passwords. Authentication is delegated entirely to your institution's existing identity provider via OAuth 2.0. A Business Associate Agreement (BAA) for HIPAA-covered workflows is available from the University of Chicago.
What Globus Does on Your Network
Globus Connect Personal (the application your colleague installs) makes outbound-only connections. No inbound firewall rules are required. All authentication and control traffic uses standard HTTPS (port 443). Data transfers to institutional endpoints like ours use TCP 50000–51000 outbound and can fall back to port 443 relay if those ports are blocked, though with reduced throughput.
If your organization already permits outbound HTTPS to the internet, Globus Connect Personal will work with no additional configuration. The rules below cover more restricted environments.
Minimum Firewall Rules — Globus Connect Personal (Outbound Only)
| Destination | Port(s) | Protocol | Purpose |
|---|---|---|---|
auth.globus.org |
443 | TCP | Authentication and Transfer API |
app.globus.org |
443 | TCP | Globus web application |
downloads.globus.org |
443 | TCP | Software installer and update checks |
cilogon.org |
443 | TCP | Federated authentication via InCommon/CILogon |
54.237.254.192/29 (IPv4)2600:1f28:14:4::/62 (IPv6) |
443, 2223 | TCP | Globus Transfer service control channel; certificate exchange |
| Any | 50000–51000 | TCP | Data transfer to/from institutional Globus endpoints (e.g., UWBC) |
Encryption in Transit
- All control and authentication traffic: TLS 1.2
- Data channel: authenticated; encryption is optional per-transfer (AES-256) or enforced on High Assurance collections
- Globus never stores or transmits user passwords — only short-lived OAuth tokens
Compliance & Support
- HIPAA Business Associate Agreement available from the University of Chicago
- Operated under University of Chicago not-for-profit structure
- IP ranges subject to change — subscribe to admin-discuss@globus.org for notices
Official references: Globus Connect Personal firewall configuration · Globus Security FAQ · Protected Data & HIPAA
Frequently Asked Questions
Yes. Use Google (if your work email is Google-hosted), ORCiD, Github, or create a free Globus ID. If your organization adds Globus or InCommon support later, you can link your existing login to your organizational account without losing any access or history.
Contact storagesupport@biotech.wisc.edu if you are unsure which login option to use.
Globus can link multiple identities to the same account, so you can sign in with any supported login method and still access everything associated with your primary Globus account. Instructions for linking a new identity are in the Globus account management documentation.
No. Passwords are entered on your institution's own login page and are never transmitted to or stored by UWBC or Globus. Our portal only ever receives a short-lived access token that confirms your identity.
No. Log in with Globus using the email address associated with your existing UWBC account and the portal will recognize you automatically. If you have trouble, contact webmaster@biotech.wisc.edu.
Ready to get started?
Log in with your institutional, Google, or ORCiD credentials.
Login with Globus