Repository: jupyterhub/jupyterhub

Issue:
Allow setting `auto_login` only for OAuth2 authorization requests
### Proposed change

If you set `auto_login` to `True`, anyone landing on the hub home page is automatically redirected to the login page - the homepage isn't shown. I want to have this behavior but *only* if the endpoint being redirected to is `/hub/api/oauth2/authorize`. The use case is when JupyterHub is being used as an authentication *provider* for other services (including other JupyterHubs!). The home page of the hub provides no context to the user that it is being used as a pass through login service, and creates quite a bit of confusion.


### Alternative options

Modify the hub home page template to provide different information based on wether the user is trying to OAuth to a different application, or just logging in to JupyterHub. This can get complicated quickly though.


### Who would use this feature?

People using JupyterHub as a *source* of auth for other oauth2 enabled applications.


### (Optional): Suggest a solution

Add a `auto_login_oauth2_authorization` traitlet to `JupyterHub`?



Discussion:
> If you set auto_login to True, anyone landing on the hub home page is automatically redirected to the login page

I think you mean the hub *login* page (`/hub/login`)? To be precise, `auto_login` should affect only the `/hub/login` page, which is always is the login url for all Hub pages. So if you visit `/hub/home` and aren't logged in, you are always redirected to `/hub/login`. Assuming an external (usually oauth) login provider, if auto_login is False, this shows the "Login with $Service" button, requiring a click to start login. If auto_login is True, `GET /hub/login` automatically redirects directly to the same URL, equivalent to clicking the 'login with...' button for the user. Completion of auth should also send you back to the same home page whether auto_login is on or off. The only difference should be that one extra user click or not.

> Add a auto_login_oauth2_authorization traitlet to JupyterHub?

I think that's the simplest, and makes sense. Probably put it on Authenticator since it's login-related, even though it's for internal oauth. WDYT?

We'd need to add a `get_login_url` method to [OAuthAuthorizeHandler](https://github.com/jupyterhub/jupyterhub/blob/d4ae68267cbc5467413cd1a40ea9698e3939cd68/jupyterhub/apihandlers/auth.py#L187) with roughly the logic from [these two lines in LoginHandler](https://github.com/jupyterhub/jupyterhub/blob/d4ae68267cbc5467413cd1a40ea9698e3939cd68/jupyterhub/handlers/login.py#L122-L123) to return the Authenticator's login url `if Authenticator.auto_login_oauth2_authorization`, `super()` otherwise.

Resolving patch:
diff --git a/jupyterhub/apihandlers/auth.py b/jupyterhub/apihandlers/auth.py
--- a/jupyterhub/apihandlers/auth.py
+++ b/jupyterhub/apihandlers/auth.py
@@ -222,6 +222,14 @@ def needs_oauth_confirm(self, user, oauth_client):
         # default: require confirmation
         return True
 
+    def get_login_url(self):
+        """
+        Support automatically logging in when JupyterHub is used as auth provider
+        """
+        if self.authenticator.auto_login_oauth2_authorize:
+            return self.authenticator.login_url(self.hub.base_url)
+        return super().get_login_url()
+
     @web.authenticated
     async def get(self):
         """GET /oauth/authorization
diff --git a/jupyterhub/auth.py b/jupyterhub/auth.py
--- a/jupyterhub/auth.py
+++ b/jupyterhub/auth.py
@@ -646,6 +646,26 @@ def delete_user(self, user):
         """,
     )
 
+    auto_login_oauth2_authorize = Bool(
+        False,
+        config=True,
+        help="""
+        Automatically begin login process for OAuth2 authorization requests
+
+        When another application is using JupyterHub as OAuth2 provider, it
+        sends users to `/hub/api/oauth2/authorize`. If the user isn't logged
+        in already, and auto_login is not set, the user will be dumped on the
+        hub's home page, without any context on what to do next.
+
+        Setting this to true will automatically redirect users to login if
+        they aren't logged in *only* on the `/hub/api/oauth2/authorize`
+        endpoint.
+
+        .. versionadded:: 1.5
+
+        """,
+    )
+
     def login_url(self, base_url):
         """Override this when registering a custom login handler
 
@@ -952,8 +972,8 @@ def _default_executor(self):
         help="""
         Whether to check the user's account status via PAM during authentication.
 
-        The PAM account stack performs non-authentication based account 
-        management. It is typically used to restrict/permit access to a 
+        The PAM account stack performs non-authentication based account
+        management. It is typically used to restrict/permit access to a
         service and this step is needed to access the host's user access control.
 
         Disabling this can be dangerous as authenticated but unauthorized users may


Test patch: