Protect jupyterhub behind twitcher authentication #358
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
github-actions
bot
added
component/jupyterhub
E2E Test ResultsDACCS-iac Pipeline ResultsBuild URL : http://daccs-jenkins.crim.ca:80/job/DACCS-iac-birdhouse/1825/Result : failure BIRDHOUSE_DEPLOY_BRANCH : jupyter-behind-twitcher-keep-magpie-login DACCS_CONFIGS_BRANCH : master PAVICS_E2E_WORKFLOW_TESTS_BRANCH : master PAVICS_SDI_BRANCH : master DESTROY_INFRA_ON_EXIT : true PAVICS_HOST : https://host-140-133.rdext.crim.ca PAVICS-e2e-workflow-tests Pipeline ResultsTests URL : http://daccs-jenkins.crim.ca:80/job/PAVICS-e2e-workflow-tests/job/master/1219/NOTEBOOK TEST RESULTS |
E2E Test ResultsDACCS-iac Pipeline ResultsBuild URL : http://daccs-jenkins.crim.ca:80/job/DACCS-iac-birdhouse/1870/Result : failure BIRDHOUSE_DEPLOY_BRANCH : jupyter-behind-twitcher-keep-magpie-login DACCS_CONFIGS_BRANCH : master PAVICS_E2E_WORKFLOW_TESTS_BRANCH : master PAVICS_SDI_BRANCH : master DESTROY_INFRA_ON_EXIT : true PAVICS_HOST : https://host-140-69.rdext.crim.ca PAVICS-e2e-workflow-tests Pipeline ResultsTests URL : http://daccs-jenkins.crim.ca:80/job/PAVICS-e2e-workflow-tests/job/master/1227/NOTEBOOK TEST RESULTS |
|
@tlvu When that one is pulled in, I will update this one to reflect the changes. |
E2E Test ResultsDACCS-iac Pipeline ResultsBuild URL : http://daccs-jenkins.crim.ca:80/job/DACCS-iac-birdhouse/1872/Result : failure BIRDHOUSE_DEPLOY_BRANCH : jupyter-behind-twitcher-keep-magpie-login DACCS_CONFIGS_BRANCH : master PAVICS_E2E_WORKFLOW_TESTS_BRANCH : master PAVICS_SDI_BRANCH : master DESTROY_INFRA_ON_EXIT : true PAVICS_HOST : https://host-140-69.rdext.crim.ca PAVICS-e2e-workflow-tests Pipeline ResultsTests URL : http://daccs-jenkins.crim.ca:80/job/PAVICS-e2e-workflow-tests/job/master/1228/NOTEBOOK TEST RESULTS |
mishaschwartz
added a commit
to Ouranosinc/jupyterhub
that referenced
this pull request
Jul 31, 2023
This unifies the login/logout capabilities of jupyterhub and magpie so that when logging in to jupyterhub, the user is simultaneously logged in to magpie. Similarly, when logging out of jupyterhub, the user is also logged out of magpie. This change requires that one additional parameter be set: - `c.MagpieAuthenticator.public_fqdn` which is the publicly available FQDN where magpie is running (this is required when setting the domain on cookies) Note: - the `@gen.coroutine` decorator is replaced with the (now recommended) `async` syntax This change was first proposed here: bird-house/birdhouse-deploy#358
E2E Test ResultsDACCS-iac Pipeline ResultsBuild URL : http://daccs-jenkins.crim.ca:80/job/DACCS-iac-birdhouse/1904/Result : failure BIRDHOUSE_DEPLOY_BRANCH : jupyter-behind-twitcher-keep-magpie-login DACCS_CONFIGS_BRANCH : master PAVICS_E2E_WORKFLOW_TESTS_BRANCH : master PAVICS_SDI_BRANCH : master DESTROY_INFRA_ON_EXIT : true PAVICS_HOST : https://host-140-216.rdext.crim.ca PAVICS-e2e-workflow-tests Pipeline ResultsTests URL : http://daccs-jenkins.crim.ca:80/job/PAVICS-e2e-workflow-tests/job/master/1238/NOTEBOOK TEST RESULTS |
github-actions
bot
added
ci/operations
E2E Test ResultsDACCS-iac Pipeline ResultsBuild URL : http://daccs-jenkins.crim.ca:80/job/DACCS-iac-birdhouse/1959/Result : failure BIRDHOUSE_DEPLOY_BRANCH : jupyter-behind-twitcher-keep-magpie-login DACCS_CONFIGS_BRANCH : master PAVICS_E2E_WORKFLOW_TESTS_BRANCH : master PAVICS_SDI_BRANCH : master DESTROY_INFRA_ON_EXIT : true PAVICS_HOST : https://host-140-216.rdext.crim.ca Infrastructure deployment failed. Instance has not been destroyed. @matprov |
E2E Test ResultsDACCS-iac Pipeline ResultsBuild URL : http://daccs-jenkins.crim.ca:80/job/DACCS-iac-birdhouse/1960/Result : failure BIRDHOUSE_DEPLOY_BRANCH : jupyter-behind-twitcher-keep-magpie-login DACCS_CONFIGS_BRANCH : master PAVICS_E2E_WORKFLOW_TESTS_BRANCH : master PAVICS_SDI_BRANCH : master DESTROY_INFRA_ON_EXIT : true PAVICS_HOST : https://host-140-133.rdext.crim.ca Infrastructure deployment failed. Instance has not been destroyed. @matprov |
…cher-keep-magpie-login
Super! I think this should fix the performance problem. Does it still set Magpie cookie as before? And the reverse scenario, someone already logged into Magpie will not need to login again for JupyterHub?
I am not sure I follow this one. Right now, before this PR, this situation can not happen? How can this situation happen now with this PR? |
Yes it still sets the Magpie cookie.
It could happen before this PR as well. A user could log in to juptyerhub with one set of credentials and then go over to magpie and log in with another. This PR makes the situation slightly better because if a user logs in to Magpie first as user1 and then to jupyterhub as user2, they will be logged into magpie as user2 at the same time (because it sets the Magpie session cookie to user2's cookie). |
Look! (using current
|
This has now been updated. This PR is now ok to merge |
E2E Test ResultsDACCS-iac Pipeline ResultsBuild URL : http://daccs-jenkins.crim.ca:80/job/DACCS-iac-birdhouse/2127/Result : failure BIRDHOUSE_DEPLOY_BRANCH : jupyter-behind-twitcher-keep-magpie-login DACCS_CONFIGS_BRANCH : master PAVICS_E2E_WORKFLOW_TESTS_BRANCH : master PAVICS_SDI_BRANCH : master DESTROY_INFRA_ON_EXIT : true PAVICS_HOST : https://host-140-216.rdext.crim.ca PAVICS-e2e-workflow-tests Pipeline ResultsTests URL : http://daccs-jenkins.crim.ca:80/job/PAVICS-e2e-workflow-tests/job/master/1350/NOTEBOOK TEST RESULTS |
|
I will redo the performance test and report back. |
@tlvu have you had a chance to do this? I'd like to get this PR merged in soon if possible |
Opps, sorry, this one felt through the cracks with too many interruptions. Will try to re-test this week for you. |
|
In the spirit of quickly merging this PR and to future-proof any unforeseen future problems in production because production is always full of surprises and we can never anticipate everything, can you add a toogle to disable this Jupyterhub behind Twitcher? The same kind of toogle as in PR #348. This way, if something happen in production, we can toogle this off immediately to avoid breaking users. Then we have time for further investigations. The toogle would allow the previous behavior before this PR. |
|
I've added a toggle here: 1e6b98b I have not added this variable to the However, you know about it now so Ouranos can always disable it if necessary. |
E2E Test ResultsDACCS-iac Pipeline ResultsBuild URL : http://daccs-jenkins.crim.ca:80/job/DACCS-iac-birdhouse/2190/Result : failure BIRDHOUSE_DEPLOY_BRANCH : jupyter-behind-twitcher-keep-magpie-login DACCS_CONFIGS_BRANCH : master PAVICS_E2E_WORKFLOW_TESTS_BRANCH : master PAVICS_SDI_BRANCH : master DESTROY_INFRA_ON_EXIT : true PAVICS_HOST : https://host-140-90.rdext.crim.ca Infrastructure deployment failed. Instance has not been destroyed. @matprov |
E2E Test ResultsDACCS-iac Pipeline ResultsBuild URL : http://daccs-jenkins.crim.ca:80/job/DACCS-iac-birdhouse/2191/Result : failure BIRDHOUSE_DEPLOY_BRANCH : jupyter-behind-twitcher-keep-magpie-login DACCS_CONFIGS_BRANCH : master PAVICS_E2E_WORKFLOW_TESTS_BRANCH : master PAVICS_SDI_BRANCH : master DESTROY_INFRA_ON_EXIT : true PAVICS_HOST : https://host-140-35.rdext.crim.ca Infrastructure deployment failed. Instance has not been destroyed. @matprov |
@mishaschwartz great thanks. I do not see a change to the proxy to make the verify path always return 200 (http success), like the other Geoserver behind Twitcher PR #348 I pulled out the full diff of this PR and there is no proxy change to add the verify path either. Could you quickly remind me how this one perform the access control differently than other Geoserver behind Twitcher PR? How come it does not need a verify path added to the proxy? Because I won't deploy this PR for manual testing this time, I just want to make sure the deactivation works as intended the day I actually need it.
That's perfect. Not every settings in |
That's right. In this case, the proxy does not do any verification for us. The MagpieAuthenticator is the one that checks whether a user is authorized or not by querying twitcher's verify endpoint directly. If the proxy does the check then every request to jupyterhub is checked which causes a bottleneck as you discovered (#358 (comment) #358 (comment)) We implemented a solution so that access is checked when the user logs in to jupyterhub (#358 (comment)) and we will add another feature in the future to check periodically as well (#358 (comment)) |
E2E Test ResultsDACCS-iac Pipeline ResultsBuild URL : http://daccs-jenkins.crim.ca:80/job/DACCS-iac-birdhouse/2197/Result : failure BIRDHOUSE_DEPLOY_BRANCH : jupyter-behind-twitcher-keep-magpie-login DACCS_CONFIGS_BRANCH : master PAVICS_E2E_WORKFLOW_TESTS_BRANCH : master PAVICS_SDI_BRANCH : master DESTROY_INFRA_ON_EXIT : true PAVICS_HOST : https://host-140-149.rdext.crim.ca Infrastructure deployment failed. Instance has not been destroyed. @matprov |
E2E Test ResultsDACCS-iac Pipeline ResultsBuild URL : http://daccs-jenkins.crim.ca:80/job/DACCS-iac-birdhouse/2199/Result : failure BIRDHOUSE_DEPLOY_BRANCH : jupyter-behind-twitcher-keep-magpie-login DACCS_CONFIGS_BRANCH : master PAVICS_E2E_WORKFLOW_TESTS_BRANCH : master PAVICS_SDI_BRANCH : master DESTROY_INFRA_ON_EXIT : true PAVICS_HOST : https://host-140-104.rdext.crim.ca PAVICS-e2e-workflow-tests Pipeline ResultsTests URL : http://daccs-jenkins.crim.ca:80/job/PAVICS-e2e-workflow-tests/job/master/1388/NOTEBOOK TEST RESULTS |
E2E Test ResultsDACCS-iac Pipeline ResultsBuild URL : http://daccs-jenkins.crim.ca:80/job/DACCS-iac-birdhouse/2198/Result : failure BIRDHOUSE_DEPLOY_BRANCH : jupyter-behind-twitcher-keep-magpie-login DACCS_CONFIGS_BRANCH : master PAVICS_E2E_WORKFLOW_TESTS_BRANCH : master PAVICS_SDI_BRANCH : master DESTROY_INFRA_ON_EXIT : true PAVICS_HOST : https://host-140-67.rdext.crim.ca PAVICS-e2e-workflow-tests Pipeline ResultsTests URL : http://daccs-jenkins.crim.ca:80/job/PAVICS-e2e-workflow-tests/job/master/1387/NOTEBOOK TEST RESULTS |
Merged
1 task
mishaschwartz
added a commit
that referenced
this pull request
Nov 30, 2023
…permission to access (#402) ## Overview By setting the `JUPYTERHUB_CRYPT_KEY` environment variable in the `env.local` file, jupyterhub will store user's authentication information (session cookie) in the database. This allows jupyterhub to periodically check whether the user still has permission to access jupyterhub (the session cookie is not expired and the permission have not changed). The minimum duration between checks can be set with the `JUPYTERHUB_AUTHENTICATOR_REFRESH_AGE` variable which is an integer (in seconds). Note that users who are already logged in to jupyterhub will need to log out and log in for these changes to take effect. To forcibly log out all users currently logged in to jupyterhub you can run the following command to force the recreation of the cookie secret: ```shell docker exec jupyterhub rm /persist/jupyterhub_cookie_secret && docker restart jupyterhub ``` First discussed here: #358 (comment) ## Changes **Non-breaking changes** - Adds two new environment variables to configure additional jupyterhub authentication - New jupyterhub version pavics/jupyterhub:4.0.2-20231024 **Breaking changes** ## Related Issue / Discussion Related to #334 - [x] Note that this PR requires Ouranosinc/jupyterhub#23 to be merged in first and the jupyterhub version updated to match. ## Additional Information <!-- The test suite can be run using a different DACCS config with ``birdhouse_daccs_configs_branch: branch_name`` in the PR description. To globally skip the test suite regardless of the commit message use ``birdhouse_skip_ci: true`` in the PR description. --> birdhouse_daccs_configs_branch: master birdhouse_skip_ci: false
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Overview
Sets magpie cookies whenever a user logs in or out through jupyterhub so that they are automatically logged in or out through magpie as well.
Ensures that the user has permission to access jupyterhub according to magpie when logging in.
Changes
Non-breaking changes
Breaking changes
Related Issue / Discussion
Additional Information
TODO: