This document discusses WMG's use of Cloud Foundry and UAA for authorization across multiple data centers. Key points include: - WMG uses Cloud Foundry and UAA for 100% of its development and to provide single sign-on across all apps and services. - UAA is used for authorization rather than authentication and is integrated with Active Directory. - A multi-data center architecture with Cassandra allows each data center to run independently while functioning as a single system. This improves functionality, load balancing, and failover. - Cloud Foundry and BOSH are used to deploy apps and services across separate Cloud Foundries with network separation between front-end apps and backend services.

1. Extending Cloud Foundry
UAA for Authorizations and
Multi-Data Center Deployments

2. Hello, I’m Brian.
Brian McClain
Lead of Infrastructure Engineering, WMG
@BrianMMcClain

3. WMG comprises an array of
businesses aimed at helping artists
achieve long-term creative and
financial success while providing
consumers with the highest-quality
music content available.
”
”

4. Jonathan Murray
CTO, WMG @adamalthus
Michael Michaelides
VP of Engineering, WMG
www.wmg.com // @WMGEngineering

5. ✓ Involved with Cloud Foundry since 2011 (Aug 8th)
✓ Involved with BOSH since 2012 (April 11th)
✓ At WMG for 2 years (since start of new org)
I’VE BEEN…

6. globally distributed enterprise
100% of development is on Cloud Foundry
WHY WMG

7. We’ve been busy…we want to share!

8. UAA MODIFICATIONS

9. ✓ Two deployments
✓ SSO across all WMG apps/services
✓ Authorization—not Authentication
UAA USAGE
Application/Service
OAuth UAA
Internal CF UAA

10. ACTIVE DIRECTORY INTEGRATION
✓ Active Directory for SSO across all WMG apps
✓ Users expect this to be the case

11. CASSANDRA INTEGRATION
✓ Cassandra is our main datastore
✓ Globally distributed cluster
✓ Allows multiple instances to run and serve requests

12. PUBLIC / PRIVATE DECOMPOSITION
✓ Frontend SSO Application
✓ Backend Identity Service
✓ Frontend is a subset of the backend
✓ Allows full network separation between public-facing
backend

13. MULTI-DATA CENTER
ARCHITECTURE

14. Data Persistance
Messaging Bus
Caching Layer
Front-End Apps
Local Load Balancer
Data Persistance
Messaging Bus
Caching Layer
Local Load Balancer
Global Load Balancer
Front-End Apps Front-End AppsFront-End Apps
Service
Apps
Service
Apps
Service
Apps
Service
Apps
Service
Apps
Service
Apps
MULTI-DATA CENTER
ARCHITECTURE

15. ✓ Allows for failover on networking failure
FUNCTIONAL AS ONE—BETTER AS MANY
✓ Each datacenter can run independently
Spread load for long-running batch processing
Send users to local datacenters
✓ Everything functions better as one-of-many

16. CASSANDRA
Local reads and global writes
Stays up after network partition between DCs
✓ Multi-datacenter as a core concept
✓ Improved functionality with one-of-many:

17. ✓ Multiple Cassandra clusters
✓ Started with placing large app in its own cluster
✓ Moving to one cluster per app
CASSANDRA

18. ✓ Recently migrated from CFv1 to CFv2
✓ Little code change to apps
✓ Removed minor app complexity (Logging)
✓ Managed by BOSH
CLOUD FOUNDRY

19. ✓ Apps and Services get separate CFs
✓ Network separation from front-end apps and data
✓ Backend services present data via REST
CLOUD FOUNDRY

20. ✓ Multiple app/servicer layer CFs
✓ Spun up as needed
CLOUD FOUNDRY
Network separation
Public vs. Internal vs. Private (apps used by devs)

22. TIRED OFTYPING?

23. N
O
M
O
RETERM
IN
AL

27. QUESTIONS?
@BrianMMcClain

28. THANK YOU.
Brian McClain
Lead of Infrastructure Engineering, WMG
@BrianMMcClain