Authenticate users with GitHub Teams membership in Pangeo Hub

[choldgraf]

Description

The Pangeo project currently uses GitHub Team-based authentication (so you add a user to a GitHub Team, and that person automatically now gains access to the hub). We should support this workflow on the Pangeo Hub.

Currently, we use the auth0 authenticator to support all our auth providers (github, google, etc). It doesn't support restricting auth based on team or org membership. We should find a way around that.

Benefit

This primarily benefits the Pangeo project, which is reason enough to do this. However, the process of using GitHub Teams for authentication is probably generally useful across many communities, so this will be more broadly applicable.

Implementation details

There are two potential ways to do this:

1. Use Auth0 for our authentication. This would be the simplest if we could get it working. Here is the Pangeo configuration for Auth0. Issue to track this in the future Investigate authenticating GitHub Orgs/Teams through Auth0 #698
2. Support plain OAuthenticator in our deployment, activate it for the Pangeo Hub, and configure it to use GitHub Teams (Support OAuthenticator for our hubs #625). This is more complex because now we are deviating from the standard Auth0 pipeline we've used elsewhere.

Tasks to complete

• Support OAuthenticator for our hubs #625
• Document this setup for how we could deploy this for a general hub. Done in Recovering PR #706: Supporting native JupyterHub OAuthenticator alongside Auth0 for our hubs #726

[sgibson91]

The OAuthenticator bump in z2jh-k8s happened here: jupyterhub/zero-to-jupyterhub-k8s#2350 Bump this is not yet a release

[yuvipanda]

We don't support using anything other than auth0 via OAuthenticator right now. #625 tracks additional work that needs to happen before we can do this.

[choldgraf]

Note that this is currently blocked on #625 if we end up needing OAuthenticator and not Auth0 for this

[sgibson91]

This is unblocked now that #706 #726 and #728 have been successfully deployed

[sgibson91]

I aim to merge #707 tomorrow morning unless I receive an approving review before then

[damianavila]

unless I receive an approving review before then

Approved 😉