JupyterHub PAM integration - specify a particular PAM service

JupyterHub
#1

Hi,

For other applications PAM bindings are mediated by a distinct PAM service hard coded into that application. For example for R Studio it is “rstudio” and PAM configurations are specified in /etc/pam.d/rstudio. Other applications may allow the admin to specify the name of a PAM service explicitly. It looks as if Jupyter Hub’s defacto way to integrate with PAM is via the PAM “login” facility which has system wide scope. We have an existing PAM based account provisioning workflow and so would need to have that in a separate PAM facility, and no the default “login” one.

Is there a way to specify a separate PAM facility for use by Jupyter Hub? e.g. do the PAM config via /etc/pam.d/jupyterhub or similar?

Thanks!

– Bob

#2

The PAMAuthenticator has a service parameter:
https://jupyterhub.readthedocs.io/en/stable/api/auth.html#jupyterhub.auth.PAMAuthenticator.service

If that doesn’t do what you need JupyterHub is designed to be very extensible, so you could implement your own authenticator by subclassing an existing one.

#3

Absolutely fantastic! I’m not sure how I missed that, I am usually a LOT better at the RTFM. Thanks!

– Bob

2 Likes