Restrict Google Account signups
Too many users are getting their accounts confused, or will sign up with Google instead of university accounts. Very common problem in support. We need to do a better job at restricting this.
It looks like Jupyterlab gets openid, email, and org.cilogon.userinfo from cilogon, and it's the idp field in org.cilogon.userinfo that it uses to filter for allowed idps: https://github.com/jupyterhub/oauthenticator/blob/main/oauthenticator/cilogon.py#L302 Looks like we already get userinfo in our request, so shouldn't need to change anything on cilogon.
But I'm not seeing any way to filter at the cilogon level for free, but see Auth0 does this as a service and is a lot cheaper https://www.cilogon.org/auth0:
But I don't see Auth0 doing anything we can't do on the portal side.