Auth_state from authenticator always null

Hi,

we are using Keycloak for auth and GenericAuthenticator. The auth_state is enabled, for auth and global, and JUPYTERHUB_CRYPT_KEY is set. It all starts correct and auth works.

We are trying to get the access token and refresh token inside notebook.
But auth state is null if I use

if auth_info:
    print("\nAuth Info:")
    print(json.dumps(auth_info, indent=2))
    
    print("\nOAuth Details:")
    print(f"Client ID: {os.environ.get('JUPYTERHUB_CLIENT_ID')}")
    print(f"OAuth Scopes: {os.environ.get('JUPYTERHUB_OAUTH_SCOPES')}")

I even tried custom authenticator

from oauthenticator.generic import GenericOAuthenticator

class KeycloakAuthenticator(GenericOAuthenticator):
    enable_auth_state = True

    async def authenticate(self, handler, data=None):
        userdict = await super().authenticate(handler, data)
        if userdict:
            auth_state = {
                'access_token': userdict.get('access_token'),
                'refresh_token': userdict.get('refresh_token'),
                'token_response': userdict.get('token_response', {}),
                'oauth_user': userdict.get('oauth_user', {})
            }
            userdict['auth_state'] = auth_state
        return userdict

    async def pre_spawn_start(self, user, spawner):
        auth_state = await user.get_auth_state()
        if not auth_state:
            return
        spawner.environment['OAUTH_ACCESS_TOKEN'] = auth_state['access_token']
        if 'refresh_token' in auth_state:
            spawner.environment['OAUTH_REFRESH_TOKEN'] = auth_state['refresh_token']

I configure in config this custom auth, it works fine, but the auth_state still does not seem to work.

But even that does not return auth_state, it is null. How can I make it so that the token can be accessed in the notebook. The API we have to call from notebook will use same token since it is same auth.

Am I missing something or doing something wrong?

Are you using the latest versions of JupyterHub and OAuthenticator?

Can you add some logging to your custom authenticator to output userdict after every line (when sharing the output redact any secrets)?