How to set config.yaml for multiple OAuth providers

General
1

I’m following the JupyterHub authentication instructions (https://zero-to-jupyterhub.readthedocs.io/en/latest/authentication.html) and I can get one OAuth provider to work, but I’m stuck trying to get multiple to work at the same time (e.g. both Github and Google OAuth). If someone may share the correct way of setting multiple OAuth providers in config.yaml please let me know.
I think the problem is the syntax I’m trying to use in my config.yaml:

# config.yaml
auth:
 -  type: github
    github:
      clientId: "y0urg1thubc1ient1d"
      clientSecret: "an0ther1ongs3cretstr1ng"
      callbackUrl: "http://<your_jupyterhub_host>/hub/oauth_callback"
 -  type: google
    google:
      clientId: "yourlongclientidstring.apps.googleusercontent.com"
      clientSecret: "adifferentlongstring"
      callbackUrl: "http://<your_jupyterhub_host>/hub/oauth_callback"
      hostedDomain: "youruniversity.edu"
      loginService: "Your University"

The error I’m getting when running helm upgrade ... is:

Error: render error in "jupyterhub/templates/proxy/deployment.yaml": template: jupyterhub/templates/proxy/deployment.yaml:26:32: executing "jupyterhub/templates/proxy/deployment.yaml" at <include (print $.Template.BasePath "/hub/secret.yaml") .>: error calling include: template: jupyterhub/templates/hub/secret.yaml:16:16: executing "jupyterhub/templates/hub/secret.yaml" at <.Values.auth.state.enabled>: can't evaluate field state in type interface {}
Error: UPGRADE FAILED: render error in "jupyterhub/templates/proxy/deployment.yaml": template: jupyterhub/templates/proxy/deployment.yaml:26:32: executing "jupyterhub/templates/proxy/deployment.yaml" at <include (print $.Template.BasePath "/hub/secret.yaml") .>: error calling include: template: jupyterhub/templates/hub/secret.yaml:16:16: executing "jupyterhub/templates/hub/secret.yaml" at <.Values.auth.state.enabled>: can't evaluate field state in type interface {}
2

I don’t think it is possible to have multiple authenticators :-/

3

I see, thanks for that info Tim.

4

You could potentially have two authentication, but you would need to create you own authentication module and have one as the default, then the second as a backup.

For example, using GitHub as the first authentication method, when you get an authorisation error, it calls the second authentication method such as Google.

I haven’t done it, but in theory is sounds like something that could be done, right?

1 Like
5

I wouldn’t do that because it’ll provide a bad experience for the user- they’ll be directed and asked to login to each OAuth provider in turn. A nicer interface is to ask the user to choose which OAuth provider they wish to use- the discourse login page which has GitHub and Google OAuth options is a good example.

1 Like