jhub-remote-login

Jupyterhub Authenticators

Authenticate to Jupyterhub using an authenticating proxy that can set the Remote-User header. Also supports for passing additional information to the jupyter user. This includes a list of user defined /data headers.

Architecture and Security Recommendations

This type of authentication relies on an HTTP header, and a malicious client could spoof the REMOTE_USER header. The recommended architecture for this type of authentication requires that an authenticating proxy be placed in front of your Jupyterhub. Your Jupyerhub should only be accessible from the proxy and never directly accessible by a client.

This type of access is typically enforced with network access controls. E.g. in a simple case, the host on which the Jupyterhub service accepts incoming requests has its host based firewall configured to only accept incoming connections from the proxy host.

Further, the authenticating proxy should make sure it removes any REMOTE_USER headers from incoming requests and only applies the header to proxied requests that have been properly authenticated.

Installation

This package can be installed with pip either from a local git repository or from PyPi.

Installation from local git repository:

cd jhub_remote_login
pip install .

Installation from PyPi:

pip install jhub-remote-login

Alternately, you can add the local project folder must be on your PYTHONPATH.

Configuration

You should edit your jupyterhub_config.py config file to set the authenticator class:

c.JupyterHub.authenticator_class = 'jhub_remote_login.RemoteUserAuthenticator'

You should be able to start jupyterhub. The “/login” resource will look for the authenticated user name in the HTTP header “Remote-User”. If found, and not blank, you will be logged in as that user.

Alternatively, you can use RemoteUserLocalAuthenticator:

c.JupyterHub.authenticator_class = 'jhub_remote_login.RemoteUserLocalAuthenticator'

This provides the same authentication functionality but is derived from LocalAuthenticator and therefore provides features such as the ability to add local accounts through the admin interface if configured to do so.

Dummy Authentication

Provides an option for testing JupyterHub authentication with a dummy authenticator that can have a global preset password for any account:

c.JupyterHub.authenticator_class = 'jhub_remote_login.DummyAuthenticator'
c.DummyAuthenticator.password = 'password'

Note! Don’t use in production.

Remote User Authentication extended with user-defined headers

Provides the capability to supply the jupyterhub user with additional state information via the /data path. This adds two base request paths to the jupyterhub web application:

'/login' -> requires a non empty Remote-User header
'/data' -> requires both an authenticated request and a valid configured header

Before information can be passed to the user via the ‘/data’ path, a list of valid headers is required. These preset valid headers are then upon a POST request to the ‘/data’ URl appended to the current authenticated jupyterhub user data dictionary. I.e. user.data[Header] = HeaderValue

The extended authenticator can be activated by setting the following option in the jupyterhub config file:

c.JupyterHub.authenticator_class = 'jhub_remote_login.DataRemoteUserAuthenticator'
# Making 'State' a valid header to pass to /data
c.DataRemoteUserAuthenticator.data_headers = ['State']

Beyond providing the custom header possibility, the authenticator also by default encodes the Remote-User header with ‘b32encode’. The authenticator therefore also provides the possibility of storing the actual value for debugging purposes in the user.real_name variable via the jupyterhub auth_state mechanism of passing information to the spawner as noted at Authenticators.

Metadata

Release files for jhub-remote-login 0.2.119

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Source distribution (sdist)

Source distribution for jhub-remote-login 0.2.119
File	Size	Uploaded
jhub_remote_login-0.2.119.tar.gz	7.4 kB	Feb 19, 2019	Details

Built distribution (wheel)

Table of built distributions (wheels) for jhub-remote-login 0.2.119
File	Interpreter	ABI	Platform	Reset
jhub_remote_login-0.2.119-py3-none-any.whl 7.5 kB Feb 19, 2019	Python 3	none	any	Details

Total release size: 14.9 kB

Release files / jhub_remote_login-0.2.119.tar.gz

Download URL	jhub_remote_login-0.2.119.tar.gz
Size	7.4 kB
Tags	Source
SHA-256 checksum How to use checksums	`c5975f72645f43fd4236a02fce552171dc76ee03b1fad71ca72fde726268daa7`
BLAKE2b-256 checksum How to use checksums	`586eab09bce6f8b94b0edb25fca627a7c91e937308bd33b5ae417580c96827b1`
Upload date	Feb 19, 2019
Uploaded using Trusted Publishing? What is trusted publishing?	No
Uploaded via	`twine/1.12.1 pkginfo/1.4.2 requests/2.20.0 setuptools/40.6.3 requests-toolbelt/0.9.1 tqdm/4.28.1 CPython/3.6.5`

Release files / jhub_remote_login-0.2.119-py3-none-any.whl

Download URL	jhub_remote_login-0.2.119-py3-none-any.whl
Size	7.5 kB
Tags	Python 3
SHA-256 checksum How to use checksums	`1d0950fec1bd1707f19a1e1b633af8eb1ce9bb1552e25c80c842c4f36e075987`
BLAKE2b-256 checksum How to use checksums	`86126f7188f7a233bc1740066c3c031234c99fbf9ab37834c6c1a0204c60ae3b`
Upload date	Feb 19, 2019
Uploaded using Trusted Publishing? What is trusted publishing?	No
Uploaded via	`twine/1.12.1 pkginfo/1.4.2 requests/2.20.0 setuptools/40.6.3 requests-toolbelt/0.9.1 tqdm/4.28.1 CPython/3.6.5`