Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Protect jupyterhub behind twitcher authentication #358

Merged
merged 21 commits into from
Oct 31, 2023
Merged
Show file tree
Hide file tree
Changes from 18 commits
Commits
Show all changes
21 commits
Select commit Hold shift + click to select a range
88bf4f9
jupyter attempt
mishaschwartz May 1, 2023
5f63070
add permissions to all-public-access
mishaschwartz Jun 2, 2023
1474cfa
user twitcher verify path for auth
mishaschwartz Jun 2, 2023
8ef780f
get current user from magpie
mishaschwartz Jun 2, 2023
f419328
Merge branch 'master' into jupyter-behind-twitcher
mishaschwartz Jul 14, 2023
4165c8e
set magpie cookies when logging in
mishaschwartz Jul 14, 2023
292004a
logout from magpie on jupyterhub logout
mishaschwartz Jul 24, 2023
0453561
fix logout from magpie
mishaschwartz Jul 25, 2023
216f273
use updated pavics/jupyterhub image
mishaschwartz Jul 31, 2023
9136c82
update CHANGES.md to include logout info
mishaschwartz Jul 31, 2023
3ef85a7
Merge branch 'master' into jupyter-behind-twitcher-keep-magpie-login
mishaschwartz Aug 16, 2023
4240a27
update tests
mishaschwartz Aug 16, 2023
f275268
Merge remote-tracking branch 'origin/master' into jupyter-behind-twit…
tlvu Aug 28, 2023
d4775b6
Merge branch 'master' into jupyter-behind-twitcher-keep-magpie-login
mishaschwartz Sep 25, 2023
e1e1443
authorize access to jupyterhub at login time only
mishaschwartz Sep 26, 2023
e964b8c
update pavics/jupyterhub version to add new authorization feature
mishaschwartz Oct 2, 2023
1e6b98b
add toggle for authorization setting
mishaschwartz Oct 30, 2023
ba58c3a
Merge branch 'master' into jupyter-behind-twitcher-keep-magpie-login
mishaschwartz Oct 30, 2023
dcedf80
Bump version: 1.35.2 → 1.36.0
mishaschwartz Oct 31, 2023
532ee8b
update changes.md
mishaschwartz Oct 31, 2023
35defe3
update changes.md
mishaschwartz Oct 31, 2023
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions CHANGES.md
Original file line number Diff line number Diff line change
Expand Up @@ -125,6 +125,10 @@
------------------------------------------------------------------------------------------------------------------

## Changes
- Protect jupyterhub behind twitcher authentication

- Sets magpie cookies whenever a user logs in or out through jupyterhub so that they are automatically logged in
or out through magpie as well.

- Add public WPS outputs directory to Cowbird and add corresponding volume mount to JupyterHub.
- Update `cowbird` service from [1.2.0](https://github.com/Ouranosinc/cowbird/tree/1.2.0)
Expand Down
1 change: 1 addition & 0 deletions birdhouse/config/jupyterhub/.gitignore
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@ custom_templates/login.html
jupyterhub_config.py
config/proxy/conf.extra-service.d/jupyterhub.conf
config/canarie-api/canarie_api_monitoring.py
config/magpie/providers.cfg
service-config.json

# Old paths. Keep these so that old config files remain uncommittable after updates.
Expand Down
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
version: "3.4"
services:
magpie:
volumes:
- ./config/jupyterhub/config/magpie/providers.cfg:${MAGPIE_PROVIDERS_CONFIG_PATH}/jupyter.cfg:ro
Original file line number Diff line number Diff line change
@@ -0,0 +1,10 @@
providers:
jupyterhub:
# below URL is only used to fill in the required location in Magpie
# actual auth validation is performed with Twitcher 'verify' endpoint without accessing this proxied URL
url: http://proxy:80
title: Jupyter
public: true
c4i: false
type: api
sync_type: api
8 changes: 7 additions & 1 deletion birdhouse/config/jupyterhub/default.env
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@
# are applied and must be added to the list of DELAYED_EVAL.

export JUPYTERHUB_DOCKER=pavics/jupyterhub
export JUPYTERHUB_VERSION=4.0.2-20230816
export JUPYTERHUB_VERSION=4.0.2-20231002

# Jupyter single-user server images, can be overriden in env.local to have a space separated list of multiple images
export DOCKER_NOTEBOOK_IMAGES="pavics/workflow-tests:230601"
Expand Down Expand Up @@ -59,6 +59,11 @@ export JUPYTER_IDLE_KERNEL_CULL_INTERVAL=0
# config/jupyterhub/jupyterhub_config.py.template.
export JUPYTERHUB_CONFIG_OVERRIDE=""

# URL used to verify that a logged in user has permission to access Jupyterhub
# To disable this feature, unset this variable. However, disabling this feature is NOT
# recommended as it may permit unauthorized users from accessing jupyterhub.
export JUPYTERHUB_AUTHENTICATOR_AUTHORIZATION_URL='http://twitcher:8000/ows/verify/jupyterhub'

export DELAYED_EVAL="
$DELAYED_EVAL
JUPYTERHUB_USER_DATA_DIR
Expand All @@ -80,6 +85,7 @@ OPTIONAL_VARS="
\$JUPYTERHUB_CONFIG_OVERRIDE
\$JUPYTERHUB_DOCKER
\$JUPYTERHUB_VERSION
\$JUPYTERHUB_AUTHENTICATOR_AUTHORIZATION_URL
\$JUPYTER_IDLE_SERVER_CULL_TIMEOUT
\$JUPYTER_IDLE_KERNEL_CULL_TIMEOUT
\$JUPYTER_IDLE_KERNEL_CULL_INTERVAL
Expand Down
2 changes: 2 additions & 0 deletions birdhouse/config/jupyterhub/jupyterhub_config.py.template
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,8 @@ c.JupyterHub.hub_ip = 'jupyterhub'

c.JupyterHub.authenticator_class = 'jupyterhub_magpie_authenticator.MagpieAuthenticator'
c.MagpieAuthenticator.magpie_url = "http://magpie:2001"
c.MagpieAuthenticator.public_fqdn = "${PAVICS_FQDN_PUBLIC}"
c.MagpieAuthenticator.authorization_url = "${JUPYTERHUB_AUTHENTICATOR_AUTHORIZATION_URL}"

c.JupyterHub.cookie_secret_file = '/persist/jupyterhub_cookie_secret'
c.JupyterHub.db_url = '/persist/jupyterhub.sqlite'
Expand Down
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
version: "3.4"
services:
magpie:
volumes:
- ./optional-components/all-public-access/config/jupyterhub/permissions.cfg:${MAGPIE_PERMISSIONS_CONFIG_PATH}/all-public-access-jupyterhub-permissions.cfg:ro
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
permissions:
- service: jupyterhub
permission: read
group: anonymous
action: create
- service: jupyterhub
permission: write
group: anonymous
action: create
1 change: 1 addition & 0 deletions tests/test_read_configs_include.py
Original file line number Diff line number Diff line change
Expand Up @@ -209,6 +209,7 @@ class TestCreateComposeConfList:
"./config/twitcher/config/proxy/docker-compose-extra.yml",
"./config/jupyterhub/docker-compose-extra.yml",
"./config/jupyterhub/config/canarie-api/docker-compose-extra.yml",
"./config/jupyterhub/config/magpie/docker-compose-extra.yml",
"./config/jupyterhub/config/proxy/docker-compose-extra.yml",
]

Expand Down
Loading