Default Globus Config Requires Identity from Globus ID

[rpwagner]

Hey @NickolausDS,

The default configuration for the Globus authenticator requires the user to have a linked identity with Globus ID, even if the client registration doesn't require it.

Because users are not required to have a Globus ID (globusid.org) account, I'd suggest making this optional, so that by default, anyone with a Globus account can login. The username should instead be pulled from their primary identity.

This option could be configured as part of the sessions login as the required IdP, or to avoid username collisions along with some code to grab the user's identity from that IdP.

In the interim, is there a way to disable this so that anyone can log in?

Credit to @kayavila for spotting this.

Thanks

--Rick

[welcome]

Thank you for opening your first issue in this project! Engagement like this is essential for open source projects! 🤗

If you haven't done so already, check out Jupyter's Code of Conduct. Also, please try to follow the issue template as it helps other other community members to contribute more effectively.

You can meet the other Jovyans by joining our Discourse forum. There is also an intro thread there where you can stop by and say Hi! 👋

Welcome to the Jupyter community! 🎉

[NickolausDS]

Hi Rick!

In the interim, is there a way to disable this so that anyone can log in?

Yes, set the following in your config:

c.GlobusOAuthenticator.identity_provider = ''

This changed in #337 and #357 to be default in future versions, but hasn't been released as a stable OAuthenticator version, so setting identity_provider explicitly will be needed in the mean time. Once version 0.12.x is released, that line won't be needed.

That doesn't solve the problem of username collisions across identity providers, but can be fixed by overriding the get_username method of the new OAuthenticator. See #357 for an example of how to override that method for universal usernames across identity providers.

Globus Sessions are a bit difficult to use with OAuthenticator at the moment, so I wouldn't advise it. But there may be some new features in Globus Auth that change that.

It looks like the docs don't mention setting idenity_provider to '', I'll look at updating the docs.

[rpwagner]

@NickolausDS I think the updated docs helps to clear this up. I'll close this issues.