jupyterhub / jupyterhub/nativeauthenticator
Allow admin to create/signup users with password
- Dominant language
- Python
- Stars
- 81
- Forks
- 68
- PR merge metrics
- No merged PRs in 30d
Description
### Proposed change
* Allow the admin (in the `/authorize` page for instance) to signup new users
* This action should be the equivalent of when a new user would signup
* ie, a new entry is created in the `users_info` table, and the user can go straight to the `/login` page, and login with the password the admin created, without having to signup.
### Alternative options
* Having the `/signup` option and page open is vulnerable to attack/spam
* Closing the signup option removes the ability to dynamically add or remove users as necessary.
* *infact, I'm confused how users are to be created at all when the signup page is closed*
### Who would use this feature?
* Anyone running a jupyterhub server that wants minimal hassle for their users, who simply receive an email with a URL and a password for instance, but wants to retain admin control over credentials,
* who wants an easy to maintain authentication setup
* without the vulnerability to attack/spam
* that is potentially easy to automate the creation or removal of new users
*I note that this has been previously raised in #23, but without any discussion at all, so sorry for the duplication, but I thought this a decent enough idea that it was worth raising again*
### (Optional): Suggest a solution
* Add a signup form to the `/authorize` page
* have the form hit the same endpoint as the signup page (ie, `POST` to `hub_url/signup`), or
* because that might create some interference with some of the other config options (eg captcha), make a simple `admin_signup` endpoint that uses the underlying `self.authenticator.create_user()` (which should hopefully be simple as the admin's choices should be trust worthy) ... and hit this endpoint with the form instead.
* This could be always available or dependent on config.
Contributor guide
Assessment
This issue has not been assessed yet.