Thanks for detailed clarifications @minrk!
Does it mean that the rules for the default token scope as documented here also apply for tokens issued by the jupyter-collaboration plugin? I was under impression that the lab tokens are not related to hub tokens since the jupyter-collaboration plugin can work even without the hub. Perhaps the warning message should be rephrased to make it clear that the issued token inherits all permissions of the user in the hub, in particular, access to other user servers.
Just to make it clear with a concrete example, lets say I use this config from the documentation. B.t.w., it does not seem to work for the latest jupyterhub as capital letters are not permitted in group names. Also the group members should be now written under the âusersâ key. So I modified this example accordingly:
c.JupyterHub.load_groups = {
'class-a': {'users': ['johan', 'student1', 'student2']},
'class-b': {'users': ['student3', 'student4']},
}
c.JupyterHub.load_roles = [
{
'name': 'class-a-student',
'description': 'Grants access to information about the group',
'scopes': ['read:groups!group=class-a'],
'groups': ['class-a']
},
{
'name': 'class-b-student',
'description': 'Grants access to information about the group',
'scopes': ['read:groups!group=class-b'],
'groups': ['class-b']
},
{
'name': 'teacher',
'description': 'Allows for accessing information about teacher group members and starting/stopping their servers',
'scopes': [ 'read:users!group=class-b', 'servers!group=class-b'],
'users': ['johan']
}
]
Does it mean that the token created in the share link for the user johan should allow listing the members of groups class-a and class-b? This did not seem to work for me:
curl -X GET -H "Authorization: token MbyR3LoozIX3GKjPwLDaPSOFc05NcO" "http://127.0.0.1:8000/hub/api/groups/class-a"
{"status": 403, "message": "Action is not authorized with current scopes; requires any of [read:groups, read:groups:name, read:roles:groups]"}%
Whereas, if I use the token created through the hub interface, I can list the members:
curl -X GET -H "Authorization: token 1a400aa4715d461592162b592657498c" "http://127.0.0.1:8000/hub/api/groups/class-a"
{"properties": {}, "kind": "group", "name": "class-a", "users": ["johan", "student1", "student2"]}%
Strangely, trying to list the members of the class-b with the same token results in a 404 error, which seems like a bug to me:
curl -X GET -H "Authorization: token 1a400aa4715d461592162b592657498c" "http://127.0.0.1:8000/hub/api/groups/class-b"
{"status": 404, "message": "No access to resources or resources not found"}%
If I use a token with admin permissions, this works without problems:
curl -X GET -H "Authorization: token fa4cbcba43613c0246f00db62176b6e66419162b7e5896bf00834bd6f58372cc" "http://127.0.0.1:8000/hub/api/groups/class-b"
{"properties": {}, "roles": ["class-b-student"], "name": "class-b", "users": ["student3", "student4"], "kind": "group"}%
The admin token was added using a service as follows:
c.JupyterHub.services = [
{
"name": "service-token",
"admin": True,
"api_token": "fa4cbcba43613c0246f00db62176b6e66419162b7e5896bf00834bd6f58372cc",
},
]
The hub version is: 4.0.2 (from same docker image as above).
