Add external auth contract integration

Author: ns-mkusper

config/jupyterhub/01-spawner.py

@@ -8,13 +8,19 @@
 import urllib.error
 import urllib.request
 from pathlib import Path
-from urllib.parse import urlencode
+from urllib.parse import quote, urlencode
 from urllib.request import Request, urlopen
 
 from z2jh import get_config
 
 log = logging.getLogger(__name__)
 
+external_auth_enabled = "__EXTERNAL_AUTH_ENABLED__".lower() == "true"
+external_auth_broker_url = "__EXTERNAL_AUTH_BROKER_URL__".strip()
+external_auth_providers = json.loads(r'''__EXTERNAL_AUTH_PROVIDERS_JSON__''')
+external_auth_env_var_map = json.loads(r'''__EXTERNAL_AUTH_ENV_VAR_MAP_JSON__''')
+external_auth_timeout_seconds = int("__EXTERNAL_AUTH_TIMEOUT_SECONDS__" or "10")
+
 
 # ---------------------------------------------------------------------------
 # Storage
@@ -726,6 +732,54 @@ async def _setup_nss_wrapper(spawner, username, groups):
     log.info("nss-wrapper: postStart lifecycle hook registered for %s", username)
 
 
+# ---------------------------------------------------------------------------
+# External auth pack integration
+# ---------------------------------------------------------------------------
+
+def _external_auth_provider_token(broker_url, provider, bearer_token):
+    """Fetch one provider token from the external-auth broker."""
+    req = Request(
+        f"{broker_url.rstrip('/')}/external-auth/{quote(provider)}/token",
+        headers={"Authorization": f"Bearer {bearer_token}", "Accept": "application/json"},
+        method="GET",
+    )
+    with urlopen(req, timeout=external_auth_timeout_seconds) as resp:
+        return json.loads(resp.read().decode("utf-8"))
+
+
+async def _external_auth_pre_spawn_hook(spawner, auth_state):
+    """Deliver external-auth provider tokens from configured contract fields."""
+    if not external_auth_enabled or not external_auth_broker_url:
+        return
+    access_token = (auth_state or {}).get("access_token")
+    if not access_token:
+        log.debug("external-auth: no access_token for %s; skipping", spawner.user.name)
+        return
+
+    providers = external_auth_providers or list(external_auth_env_var_map)
+    for provider in providers:
+        try:
+            payload = await asyncio.to_thread(
+                _external_auth_provider_token,
+                external_auth_broker_url,
+                provider,
+                access_token,
+            )
+        except urllib.error.HTTPError as exc:
+            log.debug("external-auth: token request failed provider=%s status=%s", provider, exc.code)
+            continue
+        except Exception as exc:
+            log.debug("external-auth: token request failed provider=%s error=%s", provider, exc)
+            continue
+
+        token = str(payload.get("access_token", "")).strip()
+        if payload.get("status") != "token_valid" or not token:
+            continue
+
+        env_var = str(external_auth_env_var_map.get(provider) or f"{provider.upper()}_TOKEN").strip()
+        spawner.environment = {**spawner.environment, env_var: token}
+
+
 # ---------------------------------------------------------------------------
 # Pre-spawn hook orchestrator
 # ---------------------------------------------------------------------------
@@ -791,6 +845,12 @@ async def _pre_spawn_hook(spawner):
     except Exception:
         log.exception("pre-spawn: NSS wrapper setup FAILED for %s", username)
 
+    # 5. External auth provider tokens (non-fatal)
+    try:
+        await _external_auth_pre_spawn_hook(spawner, auth_state)
+    except Exception:
+        log.exception("pre-spawn: external-auth setup FAILED for %s", username)
+
     log.info("pre-spawn: hook complete for user %s", username)
 
 

templates/hub-config.yaml

@@ -9,7 +9,7 @@ data:
   00-gateway-auth.py: |
 {{ .Files.Get "config/jupyterhub/00-gateway-auth.py" | indent 4 }}
   01-spawner.py: |
-{{ .Files.Get "config/jupyterhub/01-spawner.py" | replace "__SINGLEUSER_CONFIG_CM__" (include "nebari-data-science-pack.singleuser-config" .) | indent 4 }}
+{{ .Files.Get "config/jupyterhub/01-spawner.py" | replace "__SINGLEUSER_CONFIG_CM__" (include "nebari-data-science-pack.singleuser-config" .) | replace "__EXTERNAL_AUTH_ENABLED__" (toString .Values.externalAuth.enabled) | replace "__EXTERNAL_AUTH_BROKER_URL__" .Values.externalAuth.brokerURL | replace "__EXTERNAL_AUTH_PROVIDERS_JSON__" (toJson .Values.externalAuth.providers) | replace "__EXTERNAL_AUTH_ENV_VAR_MAP_JSON__" (toJson .Values.externalAuth.envVarMap) | replace "__EXTERNAL_AUTH_TIMEOUT_SECONDS__" (toString .Values.externalAuth.timeoutSeconds) | indent 4 }}
   02-jhub-apps.py: |
 {{ .Files.Get "config/jupyterhub/02-jhub-apps.py" | indent 4 }}
   03-nebi-envs.py: |

values.yaml

@@ -128,6 +128,15 @@ sharedStorage:
     # of `/` is broken — see shared-pvc.yaml for details.
     mountOptions: []
 
+# External auth pack integration. Copy these values from the
+# ExternalAuthIntegration contract rendered by nebari-external-auth-pack.
+externalAuth:
+  enabled: false
+  brokerURL: ""
+  providers: []
+  envVarMap: {}
+  timeoutSeconds: 10
+
 # =============================================================================
 # Nebi Integration
 # =============================================================================