jupyterlab: github authenticator

[hunterowens]

Is your feature request related to a problem? Please describe.
Users should be able to use their github account to login to jupyterlab

Describe the solution you'd like
https://github.com/jupyterhub/oauthenticator

Describe alternatives you've considered
assign usernames / PW manually.

Additional context
Add any other context or screenshots about the feature request here.

[ccjarvus]

The jupyterhub helm chart will allow for a Github OAuth flow where Cal ITP org users can sign into Cal ITP's JupyterHub by signing in with Github

[machow]

TODO: robot user to generate github token for oauth app

[ccjarvus]

To build on @machow's comment. We need:

1. Someone needs to generate the Github token for OAuth (ideally the Robot User, but literally Github user can do this)
   a. Homepage URL: https://jupyterhub.k8s.calitp.jarv.us
   b. Authorization Callback URL: https://jupyterhub.k8s.calitp.jarv.us/hub/oauth_callback
2. The above app needs to request and be granted access as an OAuth App for the Cal-ITP org (directions here)

Once this is complete, the app's client id and a client secret should be shared with me so I can proceed.

[thekaveman]

@machow @ccjarvus confirming the URLs are:

• https://hub.k8s.calitp.jarv.us
• https://hub.k8s.calitp.jarv.us/hub/oauth_callback

Will this matter if/when we update to a *.calitp.org domain? Should we do that first?

[hunterowens]

requesting jupyterhub.calitp.org as the subdomain

[ccjarvus]

@thekaveman - The application itself only needs to be created in GitHub once. The Github application's Homepage URL and Authorization callback URL can be afterwards as needed. So if we switch to a *.calitp.org domain later on, we should be able to switch the Github application's Homepage URL and Authorization callback URL without an issue.

The most important bit is to have a consistent Github application client ID and client secret.

[thekaveman]

I registered an org-owned OAuth app under Cal-ITP and sent the details over to @ccjarvus, who has confirmed receipt.

[ccjarvus]

We have working auth using the org-owned OAuth app.

Currently, only users in the Cal-ITP organization can log into Jupyterhub. It would also be possible now to restrict JupyterHub access to specific teams within the Cal-ITP organization.

[ccjarvus]

Update - we have made it so that only users in the warehouse-users group of the cal-itp org can sign in with Github