TIBCO ModelOps Instances using External Authentication

auth_state: {
    "id_token": "a-valid-id-token",
    "access_token": "a-valid-access-token"
}

import os
import json
from base64 import b64encode
from jupyterhub.auth import LocalAuthenticator
from oauthenticator.generic import GenericOAuthenticator

# custom authenticator class to get required tokens
class TMOAuthenticator(GenericOAuthenticator):

    # override GenericOAuthenticator's _create_auth_state
    # method to make sure tokens are present in the 
    # authentication state
    @staticmethod
    def _create_auth_state(token_response, user_data_response):
        access_token = token_response['access_token']
        id_token = token_response.get('id_token', None)
        scope = token_response.get('scope', '')
        if isinstance(scope, str):
            scope = scope.split(' ')

        return {
            'access_token': access_token,
            'id_token': id_token,
            'oauth_user': user_data_response,
            'scope': scope,
        }


class LocalTMOAuthenticator(LocalAuthenticator, TMOAuthenticator):
    """A version that mixes in local system user creation"""
    pass

# use custom authenticator class
c.JupyterHub.authenticator_class = TMOAuthenticator

# configuration-section: begin
# ----------------------------

# configure the authenticator to use desired OAuth 2.0 provider
c.TMOAuthenticator.oauth_callback_url = 'a-jupyterhub-callback-url'
c.TMOAuthenticator.client_id = 'a-valid-client-id'
c.TMOAuthenticator.client_secret = 'a-valid-client-secret'

c.TMOAuthenticator.login_service = 'login-service-name'
c.TMOAuthenticator.username_key = 'user-name-key-in-response'
c.TMOAuthenticator.authorize_url = 'a-valid-authorize-url'
c.TMOAuthenticator.token_url = 'a-valid-token-url'
c.TMOAuthenticator.userdata_url = 'a-valid-userdata-url'

c.TMOAuthenticator.scope = ['openid', 'profile']

def custom_auth_state_hook(spawner, auth_state):
    spawner.environment = {
        'auth_state': json.dumps(auth_state),
        # by default the 'access_token' key will be used
        # use 'TMO_TOKEN_NAME' to indicate which key to use
        # "TMO_TOKEN_NAME": "id_token"
    }

# --------------------------
# configuration-section: end

# wire up auth-state hook
c.Spawner.auth_state_hook = custom_auth_state_hook

# ensure auth state is up-to-date
# https://jupyterhub.readthedocs.io/en/stable/api/auth.html
c.Authenticator.refresh_pre_spawn = True

# ensure auth state is encrypted and persisted
# https://jupyterhub.readthedocs.io/en/stable/api/auth.html
c.Authenticator.enable_auth_state = True

# ensure user servers shutdown on logout
# this is to make sure servers with stale 
# auth state in their environments are not used
# https://jupyterhub.readthedocs.io/en/stable/reference/urls.html#hub-logout
c.JupyterHub.shutdown_on_logout = True

# ensure JUPYTERHUB_CRYPT_KEY contains an encryption key
if 'JUPYTERHUB_CRYPT_KEY' not in os.environ:
    os.environ['JUPYTERHUB_CRYPT_KEY'] = b64encode(os.urandom(32)).decode('utf-8')