# How to assign roles/scopes in the post\_auth\_hook

**URL:** <https://discourse.jupyter.org/t/how-to-assign-roles-scopes-in-the-post-auth-hook/25739>\
**Category:** JupyterHub\
**Created:** [May 16, 2024, 10:27am UTC](https://discourse.jupyter.org/t/how-to-assign-roles-scopes-in-the-post-auth-hook/25739 "2024-05-16T10:27:04Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ayush\_Singla](https://yyz1.discourse-cdn.com/flex031/user_avatar/discourse.jupyter.org/ayush_singla/32/13313_2.png) [@Ayush\_Singla](https://discourse.jupyter.org/u/Ayush_Singla)\
**Post date:** [May 16, 2024, 10:27am UTC](https://discourse.jupyter.org/t/how-to-assign-roles-scopes-in-the-post-auth-hook/25739/1 "2024-05-16T10:27:05Z")

</div>

I am using `GenericOAuthenticator` along with a OIDC provider (OIDCP) to provide authentication. I want to implement Authorization based on the scopes and role defined in my OIDCP. I am able to get the `auth_state` in the `pre_auth_hook` , i want to be able to use that data to hit the OIDCP API to fetch the user data and then set the roles and scopes defined in the OIDCP.  
Currently i was setting the roles/scopes by using `c.JupyterHub.load_roles` in `post_auth_hook` but the user is not getting the desired access. Any help is really appreciated !

---

<div class="post-metadata">

**Author:** ![krassowski](https://yyz1.discourse-cdn.com/flex031/user_avatar/discourse.jupyter.org/krassowski/32/1685_2.png) [@krassowski](https://discourse.jupyter.org/u/krassowski)\
**Post date:** [May 16, 2024, 12:08pm UTC](https://discourse.jupyter.org/t/how-to-assign-roles-scopes-in-the-post-auth-hook/25739/2 "2024-05-16T12:08:05Z")

</div>

Changing `c.JupyterHub.load_roles` on runtime has no effect. I think what you may want is the authenticator-managed roles which were added for JupyterHub 5.0 (not yet released, currently in beta), see

> <https://github.com/jupyterhub/jupyterhub/pull/4748>
>
> :wave: I would greatly appreciate any feedback on whether the approach taken loo…ks like the right way forward. I'm happy to rework the PR if it needs to be changed.
> 
> \- addresses https://github.com/jupyterhub/jupyterhub/issues/3858
> \- builds upon and closes https://github.com/jupyterhub/jupyterhub/pull/4050
> 
> Compared to #4050:
> \- using both \`manage\_roles\` and \`load\_roles\` to assign roles is disallowed (tests were added)
> \- documentation was added
> \- \`sync\_roles\` was rewritten to always grant/strip roles to the current user and to update all role attributes for each rule
> \- the existing \`create\_role\` function is used (over direct ORM manipulation) which checks for validity of the role name, and guards against overwriting the admin role
> 
> To be done:
> \- \[x\] rework tests carried over from #4050
> \- \[x\] add more tests for granting/stripping roles
> \- \[x\] maybe add a method to sync all roles from the Authenticator on startup

---

<div class="post-metadata">

**Author:** ![Ayush\_Singla](https://yyz1.discourse-cdn.com/flex031/user_avatar/discourse.jupyter.org/ayush_singla/32/13313_2.png) [@Ayush\_Singla](https://discourse.jupyter.org/u/Ayush_Singla)\
**Post date:** [May 16, 2024, 12:50pm UTC](https://discourse.jupyter.org/t/how-to-assign-roles-scopes-in-the-post-auth-hook/25739/3 "2024-05-16T12:50:12Z")

</div>

ohk. Thanks for the info.  
Is there any work around that you might know to add new roles or scopes on runtime?

---

<div class="post-metadata">

**Author:** ![manics](https://yyz1.discourse-cdn.com/flex031/user_avatar/discourse.jupyter.org/manics/32/85_2.png) [@manics](https://discourse.jupyter.org/u/manics)\
**Post date:** [May 16, 2024, 12:59pm UTC](https://discourse.jupyter.org/t/how-to-assign-roles-scopes-in-the-post-auth-hook/25739/4 "2024-05-16T12:59:58Z")

</div>

You can test the beta:

> [@\[ANN\] JupyterHub 5.0 beta](https://discourse.jupyter.org/t/ann-jupyterhub-5-0-beta/25290):
>
> We’ve just published the first prerelease of JupyterHub 5, which you can get with: pip install --upgrade --pre jupyterhub This is a major release because some defaults have changed, the minimum Python version is raised to 3.8, and it requires a database upgrade, but hopefully not a too-disruptive version to upgrade to. JupyterHub 5 introduces [user-initiated sharing](https://jupyterhub.readthedocs.io/en/latest/tutorial/sharing.html) and [authenticator-managed roles](https://jupyterhub.readthedocs.io/en/latest/reference/authenticators.html#authenticator-managed-roles) Check out the new [migration documentation](https://jupyterhub.readthedocs.io/en/latest/howto/upgrading-v5.html) and the [changelog](https://jupyterhub.readthedocs.io/en/latest/reference/changelog.html#beta-2024) for more details. Give it a test, e…