99 lines
3.9 KiB
YAML
99 lines
3.9 KiB
YAML
hub:
|
|
config:
|
|
Authenticator:
|
|
auto_login: true
|
|
enable_auth_state: true
|
|
JupyterHub:
|
|
tornado_settings:
|
|
headers: { 'Content-Security-Policy': "frame-ancestors *;" }
|
|
db:
|
|
pvc:
|
|
storageClassName: csi-sc-cinderplugin
|
|
extraConfig:
|
|
oauthCode: |
|
|
import time
|
|
from oauthenticator.generic import GenericOAuthenticator
|
|
def post_auth_hook(authenticator, handler, authentication):
|
|
user = authentication['auth_state']['oauth_user']['ocs']['data']['id']
|
|
auth_state = authentication['auth_state']
|
|
auth_state['token_expires'] = time.time() + auth_state['token_response']['expires_in']
|
|
authenticator.user_dict[user] = auth_state
|
|
return authentication
|
|
class NextcloudOAuthenticator(GenericOAuthenticator):
|
|
def __init__(self, *args, **kwargs):
|
|
super().__init__(*args, **kwargs)
|
|
self.user_dict = {}
|
|
|
|
def pre_spawn_start(self, user, spawner):
|
|
super().pre_spawn_start(user, spawner)
|
|
access_token = self.user_dict[user.name]['access_token']
|
|
spawner.environment['NEXTCLOUD_ACCESS_TOKEN'] = access_token
|
|
|
|
async def refresh_user(self, user, handler=None):
|
|
try:
|
|
access_token = self.user_dict[user.name]['access_token']
|
|
refresh_token = self.user_dict[user.name]['refresh_token']
|
|
token_response = self.user_dict[user.name]['token_response']
|
|
now = time.time()
|
|
expires = self.user_dict[user.name]['token_expires']
|
|
if now >= expires:
|
|
print(f'Time is: {now}, token expired: {expires}')
|
|
return False
|
|
print(f'Time is: {now}, token expires: {expires}')
|
|
return True
|
|
except KeyError:
|
|
return False
|
|
|
|
c.JupyterHub.authenticator_class = NextcloudOAuthenticator
|
|
c.NextcloudOAuthenticator.client_id = os.environ['NEXTCLOUD_CLIENT_ID']
|
|
c.NextcloudOAuthenticator.client_secret = os.environ['NEXTCLOUD_CLIENT_SECRET']
|
|
c.NextcloudOAuthenticator.login_service = 'Sunet Drive'
|
|
c.NextcloudOAuthenticator.username_claim = lambda r: r.get('ocs', {}).get('data', {}).get('id')
|
|
c.NextcloudOAuthenticator.userdata_url = 'https://' + os.environ['NEXTCLOUD_HOST'] + '/ocs/v2.php/cloud/user?format=json'
|
|
c.NextcloudOAuthenticator.authorize_url = 'https://' + os.environ['NEXTCLOUD_HOST'] + '/index.php/apps/oauth2/authorize'
|
|
c.NextcloudOAuthenticator.token_url = 'https://' + os.environ['NEXTCLOUD_HOST'] + '/index.php/apps/oauth2/api/v1/token'
|
|
c.NextcloudOAuthenticator.oauth_callback_url = 'https://' + os.environ['JUPYTER_HOST'] + '/hub/oauth_callback'
|
|
c.NextcloudOAuthenticator.allow_all = True
|
|
c.NextcloudOAuthenticator.refresh_pre_spawn = True
|
|
c.NextcloudOAuthenticator.enable_auth_state = True
|
|
c.NextcloudOAuthenticator.auth_refresh_age = 3600
|
|
c.NextcloudOAuthenticator.post_auth_hook = post_auth_hook
|
|
|
|
extraEnv:
|
|
NEXTCLOUD_HOST: sunet.drive.test.sunet.se
|
|
JUPYTER_HOST: jupyter.drive.test.sunet.se
|
|
NEXTCLOUD_CLIENT_ID:
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: nextcloud-oauth-secrets
|
|
key: client-id
|
|
NEXTCLOUD_CLIENT_SECRET:
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: nextcloud-oauth-secrets
|
|
key: client-secret
|
|
networkPolicy:
|
|
enabled: false
|
|
|
|
singleuser:
|
|
image:
|
|
name: docker.sunet.se/drive/jupyter-custom
|
|
tag: lab-4.0.10
|
|
storage:
|
|
dynamic:
|
|
storageClass: csi-sc-cinderplugin
|
|
extraEnv:
|
|
JUPYTER_ENABLE_LAB: "yes"
|
|
extraFiles:
|
|
jupyter_notebook_config:
|
|
mountPath: /home/jovyan/.jupyter/jupyter_server_config.py
|
|
stringData: |
|
|
import os
|
|
c = get_config()
|
|
c.NotebookApp.allow_origin = '*'
|
|
c.NotebookApp.tornado_settings = {
|
|
'headers': { 'Content-Security-Policy': "frame-ancestors *;" }
|
|
}
|
|
os.system('/usr/local/bin/nc-sync')
|
|
mode: 0644
|