Use CAS for authentication

[jtpio]

The setup should support using CAS for authentication.

The CASAuthenticator for JupyterHub is listed in https://github.com/jupyterhub/jupyterhub/wiki/Authenticators.

This setup could support using either PAM or CAS for authentication (so it's semi-flexible for other setups), and have the configuration and the steps in the documentation.

However multi-auth methods for the same JupyterHub instance is not supported by default (at the time of writing). Related to:

• Would it be possible to have multiple authentication methods simultaneously? jupyterhub/oauthenticator#136
• https://github.com/zhiyuli/oauthenticator/blob/hydroshare/oauthenticator/multioauthenticator.py
• https://github.com/CityOfLosAngeles/citywide-jupyterhub/issues/62

[pierrepo]

In our local setup, afaik, it is a SAML authentication, also supported by JupyterHub.

If multi-auth methods are not yet supported in JupyterHub, are you aware of any "tool/addon" to handle local users (with PAM auth) at the JupyterHub level?

[jtpio]

In our local setup, afaik, it is a SAML authentication, also supported by JupyterHub.

OK I thought that it was CAS (from an old email), and that CAS is commonly used within universities.
Either way, we could instead go for the SAML authenticator if needed.

If multi-auth methods are not yet supported in JupyterHub, are you aware of any "tool/addon" to handle local users (with PAM auth) at the JupyterHub level?

You mean so that users could authenticate with both SAML/CAS and PAM? Or just to manage a set of users on the host using PAM auth?

[pierrepo]

You mean so that users could authenticate with both SAML/CAS and PAM? Or just to manage a set of users on the host using PAM auth?

Sorry that should be another issue. Since SAML/CAS and PAM are not possible in the same time, I was wondering if could easily manager users (auth with PAM only) with JupyterHub, i.e. graphically.

[jtpio]

Admins can add and remove users via the admin panel in JupyterHub:

However the passwords would need to be set using passwd and distributed to the users.

What would be the benefit of using PAM only instead of an external SAML/CAS authenticator?

[pierrepo]

Thanks @jtpio

What would be the benefit of using PAM only instead of an external SAML/CAS authenticator?
The actual authenticator might evolved very soon (not sure to what exactly). Also, I am not sure the actual authenticator allows to select group of students since I do not want the entire university to gain access to the hub.

[jtpio]

Maybe a whitelist could be useful in this case? (although this list would have to be maintained)

https://jupyterhub.readthedocs.io/en/stable/getting-started/authenticators-users-basics.html#create-a-whitelist-of-users

[jtpio]

Closing as going with PAM for now to keep things simple.