I’m trying to update the default auth_refresh_age of 300 seconds for the refresh_user function. My understanding of auth_refresh_age is that if changed to say 30 seconds the refresh_user function will be ran every 30 seconds in the background - but what I’m experiencing is that auth_refresh_age is changing how often refresh_user is ran when doing UI activities (i.e http requests to JupyterHub)
I.e when I refresh the JupyterHub page I see in the Hub logs that refresh_user has been ran. Then if I refresh again nothing will happen till 30 seconds goes by - once that time is up I can refresh the JupyterHub page and refresh_user is once again ran.
Is this the expected functionality? If so then how could I update how often refresh_user is ran in the background.
Some more information
Within refresh_user I’m printing the handler.class. Every 5 minutes the following handlers are seen ActivityAPIHandler/SelfAPIHandler
Hub image → FROM jupyterhub/k8s-hub:1.1.3-n285.h30f2255b
refresh_user is not run in the background. It is run only when a user makes an authenticated request, to refresh their authenticated info in case it has become stale (e.g. they have become no-longer admin, or an access token may have expired). It’s more like a cache expiration date than a background task.
The idea is basically:
when a user makes an authenticated request, check how old their auth info is (last time they authenticated, or refresh_user was called)
if it’s older than auth_refresh_age, refresh the auth info, to re-sync with the identity provider (call refresh_user()) in case things have changed in the meantime
refresh_pre_spawn allows this check to occur at spawn time, regardless of the age of auth info
My followup question would then be why are the two handlers seen in refresh_user every 5 minutes? ActivityAPIHandler/SelfAPIHandler
Something is causing refresh_user to be ran every 5 minutes.
= = =
The goal is to have refresh_user automatically run or be triggered somehow within the Lab environment. So if the user’s token is invalid I can log that user out or terminate the lab
ActivityAPIHandler is the /users/{name}/activity endpoint, used by the singleuser server (e.g. JupyterLab) to tell JupyterHub the server is still active. For example, this can be used by JupyterHub to automatically shutdown unused servers.
Is ActivityAPIHandler supposed to trigger refresh_user? I guess since it’s an authenticated call it can trigger refresh_user
Is lowering the hub_activity_interval value an ok way to have refresh_user be ran more often? From what I read hub_activity_interval could cause some performance issues depending how low of a value is set since it has to write to a DB
= = =
One more question as well. I’ve noticed that when I generate a JupyterHub API key for another user to use my session, it takes an extra 5 minutes for the user to be kicked out of the session. I.e I generate a token that expires in 15m - but the user will actually be kicked out after 20m. Do you have any idea what check in the backgorund doing this?
I’ve checked, and setting c.SingleUserNotebookAppMixin.hub_activity_interval = 10 in the singleuser server configuration (not the hub configuration) should work. Database performance will depend on how many users you have, try it and keep an eye on your resource usage.
Hmm. I set the values in extraConfig & nothing seemed to have changed. Not seeing the Activity handler any sooner than 300 seconds.You’d think that’d be the right configuration field to modify it
This sets the interval on which the Hub checks with the proxy for last activity.
This is the right config, but to have an effect, it needs to be set in the user environment where the single user app runs, not the Hub environment. That means it needs to be in e.g. singleuser.extraFiles
It’s also worth noting that this should only be called every hub_activity_interval if there has been new activity on the server during that time. If the server is running but idle, it shouldn’t make any activity requests.