[DISCUSS] Pluggable user token creation/validation

[echarles]

The user token generation/validation is done in various methods of https://github.com/jupyter/jupyter_server/blob/master/jupyter_server/auth/login.py

There is no way for an jupyter admin to change that and use for example an external token provider such as e.g. an OpenID Connect provider.

Is there an interest for such usecase, and how could this be implemented in a pluggable way?

[rolweber]

An admin can configure a different LoginHandler class:
https://github.com/jupyter/jupyter_server/blob/master/jupyter_server/serverapp.py#L1007-L1012

I'm not sure if there's a point in refactoring the default LoginHandler just to change token generation. Then again, it wouldn't hurt to generate the token in a single place that can be easily overwritten in a derived class.

[echarles]

@rolweber I am still feeling a temptation to factor-out a TokenProvider with methods like get, validate, renew, discard...

[rolweber]

Go ahead, if you like to. Just don't make it a configurable class for a configurable class :-)