Cannot manage groups via API when using AzureAuthenticator

JupyterHub Zero to JupyterHub on Kubernetes
1

I have deployed jupyterhub using the helmchart version 4.0.0. I am using azure as Authenticator and the config looks like this:

authenticator: |
                    import os
                    from oauthenticator.azuread import AzureAdOAuthenticator
    
                    c.AzureAdOAuthenticator.oauth_callback_url = "https://jupyterhub-test-dev/hub/oauth_callback"
                    c.AzureAdOAuthenticator.username_claim = "unique_name"
                    c.AzureAdOAuthenticator.enable_auth_state = True
                    c.AzureAdOAuthenticator.manage_groups = True
                    c.AzureAdOAuthenticator.auth_state_groups_key = "user.groups"
                    c.AzureAdOAuthenticator.allowed_groups = ["jupyterhub-test-admin", "jupyterhub-test-user"]
                    c.AzureAdOAuthenticator.admin_groups = ["jupyterhub-test-admin" ]
                    c.AzureAdOAuthenticator.scope =  ["GroupMember.Read.All", "User.Read", "User.Read.All", "email", "openid" ]

                    class subAzureAuthenticator(AzureAdOAuthenticator):
                    
                      def normalize_username(self, username):
 
                        username = username.lower().split('@')[0]
                        clean_username = username.replace('.', '')
                        clean_username =clean_username.replace('_', '')
                    
                        return clean_username
                    
                      
                    c.JupyterHub.authenticator_class = subAzureAuthenticator

The group sync works as expected. After I login, I can see the the groups created in the admin panel. However, as admin, I cannot delete or edit these groups.

logs from hub:

Checking access to /hub/api/groups/jupyterhub-test-admin via scope delete:groups!group=jupyterhub-test-admin
[W 2025-01-27 12:04:45.399 JupyterHub web:1873] 400 DELETE /hub/api/groups/jupyterhub-test-admin?_xsrf=token (95.90.206.235): Group management via API is disabled
[W 2025-01-27 12:04:45.399 JupyterHub log:192] 400 DELETE /hub/api/groups/jupyterhub-test-admin?_xsrf=[secret]

Is that the expected behaviour? I thought that having admin permission includes this role : ā€˜admin:groups!group=jupyterhub-test-adminā€™ and ā€˜admin:users!group=jupyterhub-test-adminā€™

I need to be able to delete the groups because sometimes we delete the user groups in azure app registration, but this is not synced in jupyterhub user management database. Even though the groups is delete in azure, it still remains in jupyterhub.

1 Like
2

Currently the API for managing groups is disabled when manage_groups = True:

Are the groups still present when you restart JupyterHub?

1 Like
3

yes, the group that is removed from azure app registration, is still appearing in group list.

1 Like
4

Is there any flag that can be set to refresh the groups to match with the ones specified in the app registration in azure?

1 Like
5

Unfortunately, there is currently no way to delete groups when the Authenticator is managing them. We set this up for roles to have the ability to re-initialize roles on startup, but havenā€™t done that for groups.

Weā€™ll have to think about what that config should look like, but I think the simplest fix is to actually change the ā€œGroup management via API is disabledā€ condition to only apply to group membership, and still permit group creation and deletion via the API.

We could also reconsider blocking group-management via the API altogether. Admins will have to realize that any changes they make via the API will be overridden when users login again, but this would allow manual reconciliation like the deletion here without any unnecessary frustration. But itā€™s not inherently wrong to allow group management via the API. It just may lead to surprise that admin changes may get lost since the Authenticator has priority. But if the admin changes are manually reconciling with upstream as is the case here, then everything will be as the admin expects. Iā€™m currently leaning toward this choice.

1 Like
6

allow group management API when managed_groups is True by minrk Ā· Pull Request #5004 Ā· jupyterhub/jupyterhub Ā· GitHub removes the manage_groups check, allowing admins full access to group membership. Thereā€™s a caveat that managed groups means that any changes you make manually could be clobbered by an authentication event, but that doesnā€™t mean you shouldnā€™t be allowed to ever make them (especially those that canā€™t be done by authentication events, such as group deletion).

7

@blinak

Is it possible to share the Azure side of AD things by masking the sensitive information.

I am pretty much stuck here c.AzureAdOAuthenticator.auth_state_groups_key = ā€œuser.groupsā€

Where in logs it says user.groups does not exists.

I would like to know how you have achieved it.

Thanks in advance.

8

This response might be late but I will add it here is case it still helps someone:

  • it is required you add the groups claim so that you avoid the user.groups missing in the token.

image
image1920Ɨ713 65 KB

  • Additionally enable the group API permissions in entraID app registration:
    GroupMember.Read.All and User.Read.All

  • And make sure that in Manage ā†’ Manifest you have the following configuration



ā€‹groups claim configuration : 
    "optionalClaims": {
        "accessToken": [
            {
                "additionalProperties": [
                    "cloud_displayname",
                    "sam_account_name"
                ],
                "essential": false,
                "name": "groups",
                "source": null
            }
        ],
        "idToken": [
            {
                "additionalProperties": [
                    "cloud_displayname",
                    "sam_account_name"
                ],
                "essential": false,
                "name": "groups",
                "source": null
            }
        ],
        "saml2Token": [
            {
                "additionalProperties": [
                    "cloud_displayname",
                    "sam_account_name"
                ],
                "essential": false,
                "name": "groups",
                "source": null
            }
        ]
    }
1 Like