All users are disallowed with empty allowed_users

JupyterHub
1

I have a JupyterHub following the Zero to JupyterHub with Kubernetes, using Keycloak for authentication.

Everything worked fine, until recently, when users were no authorized any more (they got 403 : Forbidden Sorry, you are not currently authorized to use this hub. Please contact the hub administrator.). I can circumvent this by manually authorizing them through hub.config.Authenticator.allowed_users in the helm config, but as far as I understand, leaving allowed_user empty should also work and simply authorize all authenticated user (which it did until recently).

Has anybody an idea what might be the issue? Iā€™m using Helm chart version 3.0.3 with JupyterHub version 4.0.2, but everything worked well with the same versions before. Thank you for your help!

2

This was a breaking change to improve security in OAuthenticator- not everyone realised that for example using Github with no further restrictions would allow any GitHub user to log in by default
https://oauthenticator.readthedocs.io/en/stable/reference/changelog.html#breaking-changes
Setting OAuthenticator.allow_all to True should restore the old behaviour

1 Like
3

Thank you very much! That was indeed it.

4

Hi @jschwab,
I have been facing this same issue for days now. Could you please share snippet of your values file where you fixed this issue?
Below if my config.

hub:
  config:
    Authenticator:
      enable_auth_state: true
      allowed_users: 
      - '*'
    GenericOAuthenticator:
      client_id: hub
      client_secret: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
      oauth_callback_url: https://hub.mydomain.net/hub/oauth_callback
      authorize_url: https://keycloak.mydomain.net/auth/realms/myrealm/protocol/openid-connect/auth
      token_url: https://keycloak.mydomain.net/auth/realms/myrealm/protocol/openid-connect/token
      userdata_url: https://keycloak.mydomain.net/auth/realms/myrealm/protocol/openid-connect/userinfo
      login_service: keycloak
      username_claim: preferred_username
      userdata_params:
        state: state
      claim_groups_key: roles
      allowed_groups:
        - user
      admin_groups:
        - admin
    JupyterHub:
      authenticator_class: generic-oauth
      admin_access: true
5

I finally got this working. See below config when integrating jupyterhub with keycloak for Authentication

hub:
  config:
    Authenticator:
      enable_auth_state: true
      allow_all: true   ## Add this to allow all users
    GenericOAuthenticator:
      client_id: hub
      client_secret: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
      oauth_callback_url: https://hub.mydomain.net/hub/oauth_callback
      authorize_url: https://keycloak.mydomain.net/auth/realms/myrealm/protocol/openid-connect/auth
      token_url: https://keycloak.mydomain.net/auth/realms/myrealm/protocol/openid-connect/token
      userdata_url: https://keycloak.mydomain.net/auth/realms/myrealm/protocol/openid-connect/userinfo
      login_service: keycloak
      username_claim: preferred_username
    JupyterHub:
      authenticator_class: generic-oauth
      admin_access: true