documentation for authentication

[bitnik]

I am also working on an example repo: https://github.com/gesiscss/auth-binderhub

ref: #691

[bitnik]

I deployed that example repo on our staging. It uses github oauth with "gesiscss", "jupyter", "jupyterhub", "pangeo-data" in org whitelist. If you like, you can check it. I deployed it with config.yaml and jhub_user.yaml, so if your repo doesn't install JupyterHub, your binder won't launch.

[jhamman]

@bitnik - thanks for putting this together. We'll certainly use this soon. Can you point me to your staging cluster? I'd like to see how it all works from user perspective.

[bitnik]

@jhamman sorry, i totally forgot sharing the url :) https://notebooks-test.gesis.org/services/binder/

[choldgraf]

this is a really nice start - @jhamman were you able to give these instructions a shot? Would love to hear about your experiences

[bitnik]

@jhamman @choldgraf It would be perfect if someone could try this documentation out by deploying it on Google Cloud and help me to update the documentation. Because we deploy everything on bare metal and we mostly use NodePort services, I have very little experience with configuring services in k8s.

I am not sure but I think when auth is enabled, binder service type should be changed to ClusterIP (default is LoadBalancer) and then hub.services.binder.url can be set to http://<cluster ip of binder service>:port. But this requires 2 steps to finish deployment, similar to connecting bhub and jhub with hub_url.

[jhamman]

@bitnik - it may be a few weeks before I get to this. Still very much on our radar though.

[choldgraf]

@consideRatio is helping set up a BinderHub for neurips, but I'm not sure if the plan is to use authentication or not...

[betatim]

If you have a moment to reenable this on https://notebooks-test.gesis.org/services/binder/ that would be great. I will be deploying a BinderHUb with auth on GKE this week so I can be the guinea pig.

[bitnik]

@betatim done. and thank you.

This week I will also try to find time to update the documentation.

[betatim]

First hurdle: what link should I visit to get a binder to launch?

I was assuming that https://notebooks-test.gesis.org/v2/gh/binder-examples/requirements/master would work but that gives a 404 after redirecting me to https://notebooks-test.gesis.org/hub/v2/gh/binder-examples/requirements/master (there is a extra "hub" in the URL now)

[betatim]

The answer is: https://notebooks-test.gesis.org/services/binder/v2/gh/binder-examples/requirements/master is the link that will start a build.

[bitnik]

yes, exactly because JupyterHub is under / and its service (binder) is running under /services/binder/.

[betatim]

What is the thinking behind exposing binder from the /services/binder instead of the root of the domain? Is that just how you set it up for your deployment or is it required for authentication?

Currently Binder acts like a service towards JupyterHub in the sense that it has a secret that let's it authenticate itself towards the hub to create users and launch servers for them. It doesn't live at /services/binder though, which is why I am wondering if this change is related to auth or your setup.

[bitnik]

Currently (with JupyterHub 0.9.4) hub authenticated services can run only under <jhub_url>/services/<service_name>, it is required for authentication with JupyterHub. To run binder at other urls, changes in JupyterHub are required. -> wrong

[bitnik]

@betatim really sorry for misleading you. I will think about this issue tomorrow and update my test deployment.

[bitnik]

@betatim i updated the documentation.

i also updated my test deployment:

• now bhub is running at: https://notebooks-test.gesis.org
• and jhub is running at: https://notebooks-test.gesis.org/jupyter/

[bitnik]

Hi, sorry for long break. I was sick for a while and then on holidays. I think I am done with this documentation for now and it would be really nice to get some feedback.

I also have a new repo (https://github.com/gesiscss/example-binderhub-deployments) to try out different binderhub deployments such as with authentication or with custom templates. Soon I will continue with persistent storage. @betatim once you mentioned that you want to work on persistent storage too, have you made any progress? It would be really nice if we could share ideas and collaborate.

And finally I just deployed BinderHub with authentication enabled on our staging server (https://notebooks-test.gesis.org).

[choldgraf]

just giving a shot at this...I added in the config that you mentioned but got some unexpected behavior. When I tried to go to the binder URL after adding the auth config (I'm just using a whitelist), the binder URL now points me to a JupyterHub "403 forbidden"

Here's my config

config:
  BinderHub:
    use_registry: true
    image_prefix: gcr.io/binder-sandbox-194621/binderauth-
    hub_url: http://35.222.116.172
    auth_enabled: true

jupyterhub:
  cull:
    # don't cull authenticated users
    users: False

  hub:
    services:
      binder:
        oauth_redirect_uri: "35.238.243.184/oauth_callback"
        oauth_client_id: "binder-oauth-client-test"
    extraConfig:
      binder: |
        from kubespawner import KubeSpawner

        class BinderSpawner(KubeSpawner):
          def start(self):
              if 'image' in self.user_options:
                # binder service sets the image spec via user options
                self.image_spec = self.user_options['image']
              return super().start()
        c.JupyterHub.spawner_class = BinderSpawner

  singleuser:
    # to make notebook servers aware of hub
    cmd: jupyterhub-singleuser

  auth:
    whitelist:
      users:
        - choldgraf
        - user2

Here's the URL of the binder: http://35.238.243.184
Here's the URL of the JupyterHUb: http://35.222.116.172
I'm using the latest BinderHub image

any idea what could be up?

[consideRatio]

Note, kubespawners image_spec was recently deprecated, to be renamed to image

[bitnik]

@choldgraf you are defining a whitelist but not which authenticator you want to use. So JupyterHub still uses NullAuthenticator and that's why you still get 403. Can you instead try with DummyAuthenticator:

auth:
  type: dummy
  dummy:
    password: 'dummy'
  whitelist:
    users:
      - choldgraf
      - user2

And also you should add "http://" to beginning of hub.services.binder.oauth_redirect_uri config: "http://35.238.243.184/oauth_callback"

@consideRatio thanks! I updated it.

[choldgraf]

Nice catch - I'll make a PR in the Z2JH docs to try and clarify the whitelist thing a bit.

Some more UX feedback from me:

The configuration you gave works! I successfully set up a dummy authenticator.

However, when I go to the vanilla BinderHub URL and type in my credentials, I'm then taken to a JupyterHub "server loading" page:

This then resulted in a live jupyter session after it loaded, but there was no "binder" experience in there.

I was expecting to be taken to the BinderHub landing page. Is that your thinking as well? Perhaps I am not understanding something about the user flow through authentication? (e.g. is authenticated BinderHub use only possible via the BinderHub REST API?)

Thanks for your help on this!

[bitnik]

@choldgraf you are right, i also expected bhub landing page.

I just tried to login too, to me it looks like you didnt update hub.services.binder.oauth_redirect_uri to "http://35.238.243.184/oauth_callback", did you?

Can you also try adding this extra config (this is to prevent server start when user comes to jhub home page):

  hub:
    extraConfig:
      hub_extra: |
        c.JupyterHub.redirect_to_server = False

[choldgraf]

@bitnik ah hah, that got it! Is the extraConfig something new? I'll suggest it as additions to the PR

[choldgraf]

A couple of quick suggestions to clarify things after I gave this a shot and finally got it working!

[bitnik]

@choldgraf thanks a lot for trying it out and for the review!

[choldgraf]

restarting travis to see if he's happy after a restart...if that's green, then @bitnik are you ready to merge?

[choldgraf]

Travis is happy, so I'm happy. @bitnik say the word and we can 🚢 it

[bitnik]

@choldgraf let's merge it :)

[choldgraf]

woooo! thanks so much @bitnik 🎉

[jhamman]

Thanks @choldgraf and @bitnik for putting these together. We'll make use of them soon. Cheers!

[choldgraf]

@jhamman please do open some PRs if you see opportunities for improvements! The binderhub docs could definitely use some love