cloudbank: revision of auth config #3232
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This comment was marked as resolved.
This comment was marked as resolved.
consideRatio
commented
Oct 5, 2023
There was a problem hiding this comment.
@sean-morris I wrote some comments to help you understand the motivation behind the different kinds of changes I'm making in this PR
This was referenced Oct 5, 2023
|
@sean-morris do you approve merging this PR at this point? Since last review, I've added the admin user you added as part of #3239 that I closed in favor of this, and I've reduced the demo hub access to just the listed admin users for now but ensured its easy to enable ~public access temporarily when needed in the future. |
In oauthenticator 16, users can be authorized in multiple separate ways. If they are part of `allowed_domains`, they can be authorized like that, but if they aren't they still can be authorized by being listed in `allowed_users` or `admin_users`. This enables us to not list 2i2c.org and berkeley.edu in `allowed_domains` since its just meant to allow a few specific users really.
Both berkeley and google has been configured as identity providers, where the berkeley idp was meant to provide access for admin users at berkeley and google idp was meant to provide access for admin users at 2i2c. Since the admin users of berkeley have google accounts as well, we can rely soley on the google idp instead to grant access to all admins.
consideRatio
force-pushed
the
pr/cloudbank-auth-revision
branch
from
11902ff to
fc94659
Compare
|
🎉🎉🎉🎉 Monitor the deployment of the hubs here 👉 https://github.com/2i2c-org/infrastructure/actions/runs/6506417947 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR updates cloudbank cluster's hubs configuration of CILogonOAuthenticator, and various changes made here should also be made in other hubs in other clusters but this PR is scoped for cloudbank specifically for now.
PR changes
Now authorized either by ...
With oauthenticator v16, a user can be authorized by different config and doesn't have to be authorized by all config. For example,
allowed_domainspreviously rejected admin users signing in if it was configured, but in oauthenticator v16 you can be authorized by being part of eitherallowed_domainsoradmin_users.berkeley.edu and 2i2c.org users access reduced
Previously any user with a berkeley.edu email or 2i2c.org email was granted access by many hubs configurations via
allowed_domains. This is now tightened to only allow specific berkeley.edu usernames and 2i2c.org usernames.Berkeley idp removed, Google idp is sufficient
Both berkeley and google has been configured as identity providers, where the berkeley idp was meant to provide access for admin users at berkeley and google idp was meant to provide access for admin users at 2i2c. Since the admin users of berkeley have google accounts as well, we can rely soley on the google idp instead to grant access to all admins.
To reduce the complexity of auth config and help us avoid granting more access than wanted, the berkeley idp is removed entirely.
csum open access tightened
I saw that the csum hub was configured to grant access to all google users, this access is now reduced. This resolves the comment in #3231 (review).
Reordered entries allowed_idps entries
I moved the user relevant idp to the top, and the admin relevant idp to the bottom. This was done for consistency and in preparation for a future improvement about pre-selecting a choice in a CILogon dropdown list. This needs jupyterhub/oauthenticator#690 to be resolved first though.
Related