Merge pull request #3113 from consideRatio/pr/revoke-access

Restrict access to staging hubs and imagebuilding-demo hub
2i2c-org · Sep 9, 2023 · 45fe23b · 45fe23b
2 parents 3b0fd49 + 07ca6e4
commit 45fe23b
Show file tree

Hide file tree

Showing 4 changed files with 20 additions and 14 deletions.
diff --git a/config/clusters/2i2c-uk/staging.values.yaml b/config/clusters/2i2c-uk/staging.values.yaml
@@ -38,10 +38,12 @@ jupyterhub:
       JupyterHub:
         authenticator_class: cilogon
       CILogonOAuthenticator:
-        scope:
-          - "profile"
-        username_claim: "preferred_username"
         oauth_callback_url: "https://staging.uk.2i2c.cloud/hub/oauth_callback"
-        # Only show the option to login with GitHub
         shown_idps:
-          - http://github.com/login/oauth/authorize
+          - http://google.com/accounts/o8/id
+        allowed_idps:
+          http://google.com/accounts/o8/id:
+            username_derivation:
+              username_claim: "email"
+            allowed_domains:
+              - "2i2c.org"
diff --git a/config/clusters/2i2c/dask-staging.values.yaml b/config/clusters/2i2c/dask-staging.values.yaml
@@ -48,16 +48,11 @@ basehub:
             - "email"
             - "profile"
           oauth_callback_url: "https://dask-staging.2i2c.cloud/hub/oauth_callback"
-          # Only show the option to login with Google
           shown_idps:
             - http://accounts.google.com/o/oauth2/auth
-            - http://github.com/login/oauth/authorize
           allowed_idps:
             http://google.com/accounts/o8/id:
               username_derivation:
                 username_claim: "email"
               allowed_domains:
                 - "2i2c.org"
-            http://github.com/login/oauth/authorize:
-              username_derivation:
-                username_claim: "preferred_username"
diff --git a/config/clusters/2i2c/imagebuilding-demo.values.yaml b/config/clusters/2i2c/imagebuilding-demo.values.yaml
@@ -66,10 +66,15 @@ jupyterhub:
         authenticator_class: cilogon
       CILogonOAuthenticator:
         oauth_callback_url: "https://imagebuilding-demo.2i2c.cloud/hub/oauth_callback"
-        username_claim: "email"
-        # Only show the option to login with Google
         shown_idps:
           - http://google.com/accounts/o8/id
+        allowed_idps:
+          http://google.com/accounts/o8/id:
+            username_derivation:
+              username_claim: "email"
+            allowed_domains:
+              - "2i2c.org"
+
     extraConfig:
       enable-prototype-UI: |
         from kubespawner_dynamic_building_ui import TEMPLATE_PATHS, STATIC_HANDLER_TUPLE

diff --git a/config/clusters/2i2c/staging.values.yaml b/config/clusters/2i2c/staging.values.yaml
@@ -56,7 +56,11 @@ jupyterhub:
         authenticator_class: cilogon
       CILogonOAuthenticator:
         oauth_callback_url: "https://staging.2i2c.cloud/hub/oauth_callback"
-        username_claim: "email"
-        # Only show the option to login with Google
         shown_idps:
           - http://google.com/accounts/o8/id
+        allowed_idps:
+          http://google.com/accounts/o8/id:
+            username_derivation:
+              username_claim: "email"
+            allowed_domains:
+              - "2i2c.org"