TLJH upgrade breaks ldapauthenticator

JupyterHub The Littlest JupyterHub
1

I tried to upgrade my TLJH instance today, per Upgrade TLJH — The Littlest JupyterHub documentation. No errors or warnings appeared when running the upgrade program, but now the jupyterhub service fails to start, reporting this problem:

ValueError: LDAPAuthenticator requires either lookup_dn or bind_dn_template to be configured

My (slightly redacted) /opt/tljh/config/config.yaml file looks like this:

users:
  admin:
  - jhadmin
https:
  enabled: true
  tls:
    key: /usr/local/etc/ssl/private/wildcard_example.edu.key
    cert: /usr/local/etc/ssl/certs/STAR_example_edu.crt
auth:
  type: ldapauthenticator.LDAPAuthenticator
  LDAPAuthenticator:
    server_address: ldap.example.edu
    bind_dn_template: ['uid={username},ou=Staff,ou=People,dc=example,dc=edu', 'uid={username},ou=Students,ou=People,dc=example,dc=edu']
    allowed_groups: ['cn=jupyter,ou=Groups,dc=example,dc=edu', 'cn=math,ou=Groups,dc=example,dc=edu',
      'cn=sysadmin,ou=Groups,dc=example,dc=edu']
    use_ssl: true
limits:
  memory: 400G

tljh-config show does not report any validation error.

What should I do?

2

I did create a jupyterhub_config.py file in /opt/tljh/config/jupyterhub_config.d with this:

c.JupyterHub.authenticator_class = 'ldap'

but it made no difference.

I’ve read over ldapauthenticator/CHANGELOG.md at dde10a80ed35d64d7d41895e2d0d54c616fcf00a · jupyterhub/ldapauthenticator · GitHub and can’t work out what I might need to change. I know the use_ssl parameter is deprecated, but setting tls_strategy instead makes no difference in the fatal error above.

3

It sounds like the LDAP configuration isn’t being picked up for some unknown reason. Can you turn on debug logging and show us your full hub logs?

4

I added the following to my config.yaml, but I don’t then see any additional log output or log files. Am I doing it wrong?

debug:
  enabled: true

I’ve tried running both under systemctl as a service (as installed) and from the command line. When running as a service I watched journalctl output.

5

When I run under strace I can see /opt/tljh/config/config.yaml being opened. If I introduce a typo in the config.yaml content I see a corresponding warning in the python output. So I’m sure it’s reading the file.

6

This is actually a bug introduced in this commit. The LDAP authenticator is ignoring bind_dn_template when it is a list.

I wrote a quick PR to fix it. @manics Could you take a look at it please?

Cheers!

3 Likes
7

2.0.1 has been released!

2 Likes
8

That’s great! Thanks for the prompt action. Will I get that new version of ldapauthenticator if I do the upgrade from scratch again? Or is there some other procedure for getting that version with the fix?

9

Redoing the upgrade works, or you can update the version of ldapauthenticator within the hub python evironment and restart jupyterhub

1 Like