Explain the security model for cylc 8

[jarich]

Explain the architecture, security principles and processes for cylc 8.

Include:

• current architecture
• JupyterHub security page link and security model
• Link to JupyterHub's authentication plugins
• Hub - UI Server
• UI server to workflows to jobs
• ZeroMQ security section
• certificates
• web sockets & HTTPS connections

[hjoliver]

(From Riot post by @kinow )

Will check if they have updated their docs with this info, but Min RK (main maintainer of jupyterhub/pyzmq/etc) posted some months ago on their discourse details about the cookies used in jupyterhub: https://discourse.jupyter.org/t/how-to-force-re-login-for-users/1998/6

It shows both which cookies are created, by which parts of the system, when they are created, how they are secured (bound to paths... but there's also https/secure/and other flags for browsers).

(Note that there is also a connection from hub to UI Server via http, to validate the oauth authentication. Handled by the same JupyterHub class used with notebooks for auth: https://github.com/cylc/cylc-uiserver/blob/5637c1a40f94123c47cc1e5c33704102a75ffaf4/cylc/uiserver/main.py#L163)

[oliver-sanders]

(On hold until cylc/cylc-uiserver#219 and cylc/cylc-uiserver#204 are completed)

[hjoliver]

See also #116 (review)

[oliver-sanders]

See also #285 which covers the Jupyter side of things.