Figure out Authentication for BinderHubs (specifically CILogon)

[sgibson91]

Context

We had cryptominers on the binder-staging deployment. First of all, I attempted to deploy CILogon to only allow those with a 2i2c.org Google account access in PR #1579 - but that failed. So instead I deleted the proxy-public service to make the hub unreachable. The incident is over, but this issue is to track our understanding of why that PR didn't work and what work needs to happen to get CILogon (or any form of auth) working on a BinderHub deployment.

I think this problem is mostly documentation-related in two separate places:

• 1. The recommended config for deploying CILogon here is outdated (though I believe @GeorgianaElena is aware and working on a fix?): https://infrastructure.2i2c.org/en/latest/howto/configure/auth-management.html#jupyterhub-cilogonoauthenticator
  • Addressed by Upgrade oauthenticator version and docs #1583
• 2. I suspect the recommended config for enabling authentication for BinderHub here is also out-dated, since I'm not sure the hub.auth key exists anymore?: https://binderhub.readthedocs.io/en/latest/authentication.html#enabling-authentication
  • I can't find a reference to hub.auth in z2jh's reference: https://zero-to-jupyterhub.readthedocs.io/en/latest/resources/reference.html#hub

Proposal

No response

Updates and actions

No response

[sgibson91]

binder-staging now uses CILogon