GitHub OAuth allowed_organizations?

JupyterHub
1

Hello all,

I’m deploying a JupyterHub with Kubernetes and am trying to allow access to users based on GitHub organization membership, but am getting a 403 Forbidden error on login.

I’ve created the GitHub OAuth app and have added the following in my config file:

hub:
    GitHubOAuthenticator:
      client_id: "xxx"
      client_secret: "xxx"
      oauth_callback_url: "xxx"
      allowed_organizations:
        - "xxx"
      scope:
        - "read:org"
        - "read:user"
    JupyterHub:
      authenticator_class: github

The GitHub OAuth docs on allowed_organizations tells me all I need is the read:org scope. Of course, I am part of the GitHub org that I’ve added to the allow list.

I’m using the most recent helm chart version 4.1.0.

Is there something obvious that I’m missing?

Thanks,

ana v. e.

2

Could you share the logs of JupyterHub, if possible in debug mode? Does it work if you use allowed_users instead of allowed_organizations?

1 Like
3

Hello Mahendra,

The non-debug logs are what you might expect: I successfully authenticate with GitHub, but I am not authorized to access the JupyterHub.

However, once I’ve done as you suggest and looked at the debug logs, I think I see the problem:

[D 2025-03-06 16:08:35.760 JupyterHub github:313] Checking GitHub organization membership: ana-v-espinoza in <org>?
[D 2025-03-06 16:08:36.000 JupyterHub github:331] ana-v-espinoza does not appear to be a member of <org> (status=404): User does not exist or is not a ***public*** member of the organization
[W 2025-03-06 16:08:36.000 JupyterHub github:186] User ana-v-espinoza is not part of allowed_organizations
[W 2025-03-06 16:08:36.000 JupyterHub auth:732] User 'ana-v-espinoza' not allowed.

The emphasis on “public” is mine. Sure enough, it seems like my status as a member of that org isn’t public.

Thank you for the suggestion to take a look at the debug-level logs.

Best,

ana v. e.

1 Like
4

In case somebody is looking for a “full” solution to this problem, to change the visibility of my organization membership from private to public, I followed the official GitHub docs on the matter:

1 Like
5

It is not a great user experience to be asked to do these steps, but thankfully there is an option to it with the approval by an admin of the allowed github orgs permission.

Details on doing this are documented by @sgibson91 with 2i2c.org in GitHub Orgs and Teams — Infrastructure Guide !

It would be great to have that good documentation about this in the oauthenticator project!

2 Likes