Use Hub for authentication services
JetBrains Hub supports most popular auth modules. Follow the procedures below to run Hub for Datalore.
Run Hub for Docker
Add following volumes to your docker-compose file:
volumes: hub-data: { } hub-conf: { } hub-logs: { } hub-backups: { }Add following service to your docker-compose file:
services: ... hub: image: jetbrains/hub:2022.2.15039 ports: - "8082:8080" networks: - datalore-backend-network volumes: - "hub-data:/data/hub/data" - "hub-conf:/data/hub/conf" - "hub-logs:/data/hub/logs" - "hub-backups:/data/hub/backups"Run
docker compose up hub
to run Hub only (we assume that Datalore is not running at the moment).
If you have already installed Hub, go to the Configuration procedure. You can find more details about the Hub installation process here.
Install Hub
Configure persistent storage by setting the
volumes
orvolumeClaimTemplates
helm parameter.Install the Hub Helm chart using the
helm install
command.(Optional) It is assumed that you can access Hub at http://localhost:8082. For it to work, forward the port with the following command:
kubectl port-forward --address 0.0.0.0 service/hub 8082Check the container output using the
kubectl logs service/hub
command. It should contain a line like this:JetBrains Hub 2021.1 Configuration Wizard will listen inside the container on {0.0.0.0:8080}/ after start and can be accessed by this URL: [http://<put-your-docker-HOST-name-here>:<put-host-port-mapped-to-container-port-8080-here>/?wizard_token=pPXTShp4NXceXqGYzeAq].Copy the
wizard_token
value to the clipboard.Go to http://localhost:8082/ and insert the token from the previous step into the Token field.
Click the Log in button.
Click the Set Up link.
Generate a URL (referred to as
HUB_ROOT_URL
later) to access Hub from Datalore. Consider the following:The URL must be accessible from both the cluster pods and the browser (by the end users of your Datalore installation).
The URL must point to the
/
path of your Hub installation, i.e. http://127.0.0.1:8080/ inside the container where Hub is launched (by default, the hub-0) pod.How you set up your cluster to serve such a URL depends on the specifics of your cluster configuration.
In Base URL, enter
HUB_ROOT_URL
. Do not change the Application Listen Port setting.Click the Next button.
Configure the admin account (set the admin password).
Click the Finish button and wait for Hub to start.
Configure Hub
Go to HUB_ROOT_URL and log into Hub via admin account.
Configure the Datalore service
Create one more URL (referred to as DATALORE_ROOT_URL later) to access Datalore. Consider the following:
The URL must be accessible from the browser (by the end users of your Datalore installation).
The URL must point to the / path of your Datalore installation, i.e. http://127.0.0.1:8080/ inside the container where Datalore will be launched (by default, it is pod datalore-on-premise-0).
How you set up your cluster to serve such a URL depends on the specifics of your cluster configuration.
Go to Services(
${HUB_ROOT_URL}/hub/services
) and click the New service button. Use the namedatalore
and enterDATALORE_ROOT_URL
in Home URL.Copy the ID field value and save it somewhere: it is used when configuring Datalore (
$HUB_DATALORE_SERVICE_ID
property).Click the Change... button next to the Secret label.
Copy the generated secret and save it somewhere: it will be used when configuring Datalore (
$HUB_DATALORE_SERVICE_SECRET
property).Click the Change secret button.
Enter
DATALORE_ROOT_URL
in the Base URLs field.Enter the line
/api/hub/openid/login
in the Redirect URIs field.Click the Trust Service button in the upper right corner.
Click the Save button.
Create a Hub token
Go to Users (
${HUB_ROOT_URL}/hub/users
).Click your admin username.
Go to the Authentication tab.
Click the New token... button.
Add Hub and Datalore into Scope. You can use any Name. Click the Create button. Copy the token (with the perm: prefix) and save it somewhere. It will be used when configuring Datalore (
$HUB_PERM_TOKEN
property).
(Optional) Force email verification
Datalore uses user emails from Hub; so it is recommended to force email verification in Hub. Users with unverified emails will not be able to use Datalore.
Configure the SMTP server:
Go to SMTP (
${HUB_ROOT_URL}/hub/smtp-settings
).Click the Configure SMTP server... button.
Configure your SMTP server parameters.
Click the Save button.
Click the Enable notifications button.
(Optional) To make sure your configuration is working, click the Send Test message button.
Enable email verification:
Go to Auth Modules (
${HUB_ROOT_URL}/hub/authmodules
).Open the Common settings page.
Enable the Email verification option.
Click the Save button.
Set and verify an admin user email:
Go to Users (
${HUB_ROOT_URL}/hub/users
).Click your admin username.
Set an email in the Email field.
Click the Save button.
Click the Send verification email link.
Find the verification email in your inbox and click the Verify email address button.
(Optional) Ban a guest user
Go to Users (
${HUB_ROOT_URL}/hub/users
).Select a guest user.
Click the Ban button.
(Optional) Enable auth modules
Go to Auth Modules (
${HUB_ROOT_URL}/hub/authmodules
).Add or remove auth modules (for example, Google auth, GitHub auth, LDAP, and so on). Find more details here.
Configure the Datalore service
Edit the docker-compose file (for Docker) or values under the dataloreEnv
key in the datalore (for Helm).
Define the following environment values:
| Base public (accessible via browser) URL of your Hub installation ( |
| ID of the Datalore service in Hub (see Configure the Datalore service). |
| Token of the Datalore service in Hub (see Configure the Datalore service). |
| Token for accessing Datalore and Hub scopes (see Create a Hub token). |
| Used to specify whether email verification is required from the Datalore user. |
Example (Docker):