{"action":"created","issue":{"url":"https://api.github.com/repos/jupyterhub/jupyterhub/issues/2261","repository_url":"https://api.github.com/repos/jupyterhub/jupyterhub","labels_url":"https://api.github.com/repos/jupyterhub/jupyterhub/issues/2261/labels{/name}","comments_url":"https://api.github.com/repos/jupyterhub/jupyterhub/issues/2261/comments","events_url":"https://api.github.com/repos/jupyterhub/jupyterhub/issues/2261/events","html_url":"https://github.com/jupyterhub/jupyterhub/issues/2261","id":374061371,"node_id":"MDU6SXNzdWUzNzQwNjEzNzE=","number":2261,"title":"Authenticator/Spawner configuration cooperation","user":{"login":"vilhelmen","id":5308250,"node_id":"MDQ6VXNlcjUzMDgyNTA=","avatar_url":"https://avatars1.githubusercontent.com/u/5308250?v=4","gravatar_id":"","url":"https://api.github.com/users/vilhelmen","html_url":"https://github.com/vilhelmen","followers_url":"https://api.github.com/users/vilhelmen/followers","following_url":"https://api.github.com/users/vilhelmen/following{/other_user}","gists_url":"https://api.github.com/users/vilhelmen/gists{/gist_id}","starred_url":"https://api.github.com/users/vilhelmen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vilhelmen/subscriptions","organizations_url":"https://api.github.com/users/vilhelmen/orgs","repos_url":"https://api.github.com/users/vilhelmen/repos","events_url":"https://api.github.com/users/vilhelmen/events{/privacy}","received_events_url":"https://api.github.com/users/vilhelmen/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2018-10-25T17:53:29Z","updated_at":"2018-10-26T19:17:17Z","closed_at":null,"author_association":"CONTRIBUTOR","body":"I'm looking at developing some tighter integration between the authenticator and the spawner and wondering if it fits within the scope of the main project contribution-wise. I'd hate to hide useful features away in custom forks.\r\n\r\nWhat I'm proposing is a designated section of `auth_state` for storing user profile data relevant to the more complex spawners that aids in user configuration for things like mounted homedir disk permissions.\r\n\r\nIn particular, I'm looking at the interaction between PAMAuthenticator/LDAPAuthenticator, and the Kubernetes (or Docker) spawner. At the moment, PAM/LDAP authenticator has easy access to information such as UID, primary GID, and secondary groups that at the moment has to be looked up all over again even though the authenticator most likely already did and discarded the results.\r\n\r\nThe current Docker/Kubernetes documentation seems to suggest that all files for all users be set to 1000:1000 and rely on container mount isolation, but this isn't feasible when users need to work on a shared machine with mounted homedirs.\r\n\r\nThis could be achieved by, for example, `Authenticator.build_profile` (`build_spawn_profile`?) which, like `is_admin` #2244, is called during `get_authenticated_user` and returns this designated `auth_state` subdict and merges it with any `auth_state` generated by `authenticate`. From there, any spawner updated to be made aware of this data can use it for spawning. This would cost likely need to be gated by config options like `c.Authenticator.generate_spawn_profile` and `c.Spawner.use_spawn_profile` or something.\r\n\r\nI was thinking something along the lines of UID, primary GID, and a GID map laid out like so:\r\n```\r\nauth_state = {\r\n  'spawn_profile': {\r\n    'uid': 1001,\r\n    'primary_gid': [2000, 'jh_user']\r\n    'groups': {\r\n      2000: 'jh_user',\r\n      3000: 'jh_admin',\r\n      4000: 'postgres_user',\r\n      5000: 'stats_3050'\r\n    },\r\n}\r\n```\r\n\r\nThen Docker/kubernetes spawners and containers can use this information for things like prepopulating the container with the user's groups and things like `c.KubeSpawner.uid` or `c.KubeSpawner.fs_gid`"},"comment":{"url":"https://api.github.com/repos/jupyterhub/jupyterhub/issues/comments/433515451","html_url":"https://github.com/jupyterhub/jupyterhub/issues/2261#issuecomment-433515451","issue_url":"https://api.github.com/repos/jupyterhub/jupyterhub/issues/2261","id":433515451,"node_id":"MDEyOklzc3VlQ29tbWVudDQzMzUxNTQ1MQ==","user":{"login":"vilhelmen","id":5308250,"node_id":"MDQ6VXNlcjUzMDgyNTA=","avatar_url":"https://avatars1.githubusercontent.com/u/5308250?v=4","gravatar_id":"","url":"https://api.github.com/users/vilhelmen","html_url":"https://github.com/vilhelmen","followers_url":"https://api.github.com/users/vilhelmen/followers","following_url":"https://api.github.com/users/vilhelmen/following{/other_user}","gists_url":"https://api.github.com/users/vilhelmen/gists{/gist_id}","starred_url":"https://api.github.com/users/vilhelmen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vilhelmen/subscriptions","organizations_url":"https://api.github.com/users/vilhelmen/orgs","repos_url":"https://api.github.com/users/vilhelmen/repos","events_url":"https://api.github.com/users/vilhelmen/events{/privacy}","received_events_url":"https://api.github.com/users/vilhelmen/received_events","type":"User","site_admin":false},"created_at":"2018-10-26T19:17:17Z","updated_at":"2018-10-26T19:17:17Z","author_association":"CONTRIBUTOR","body":"I completely agree. It is certainly hard to keep things generic with the kind of integration I'm talking about. Hopefully we can at least expand the use of `auth_state` and suggest at integrations such as an addition to the container startup scripts that can create and configure groups inside the container.\r\n\r\nI haven't used `pre_spawn_hook` for much more than a homedir check, but it sounds like a very good place to put an `auth_state` consumer in this case.\r\n\r\nI'll move some of my files around and put together a WIP/POC PR to track things. Right now I'm focusing on an LDAP authenticator since our org seems to be moving in a direction that makes PAM difficult (though I'm considering the [dark arts of AD via PAM in a container](https://jhrozek.wordpress.com/2015/03/31/authenticating-a-docker-container-against-hosts-unix-accounts/)). The way the current LDAPAuthenticator works comes off as really strange to me and I'm hesitant to spend time modifying it or creating a new one that has to keep backwards compatibility. A problem for later."}}
{"actor":{"display_login":"vilhelmen"}}