Does RBAC control access to the JupyterLab endpoints?

[adpatter]

Something I’m not clear on regarding RBAC is if it has any control over the JupyterLab endpoints or if only offers authorization to JupyterHub endpoints. (JupyterHub RBAC — JupyterHub 2.3.1 documentation) Does anyone have any guidance on that?

[manics]

It’s JupyterHub only.

However there’s some ongoing work to support RBAC across components:

• allow user-defined custom scopes by minrk · Pull Request #3713 · jupyterhub/jupyterhub · GitHub
• Add authorization layer to server request handlers by Zsailer · Pull Request #165 · jupyter-server/jupyter_server · GitHub

[adpatter]

@manics Thanks again. I’m really grateful for your guidance.

[krassowski]

FYI, the authorization handlers would likely need to be added in both jupyterlab and jupyterlab-server` packages. There is also an issue tracking RBAC for JupyterLab: Add RBAC support to JupyterLab · Issue #11355 · jupyterlab/jupyterlab · GitHub

Some packages (e.g. jupyter-lsp) already have resource identifiers for server endpoints, but there was not a strong push for more granular endpoint identification yet.