User part of multiple groups in keycloak is denied access to Jupyterhub #761
Labels
Comments
|
This seems like a config issue because of the leading |
|
thanks @consideRatio for the reply. No, it works with the We found a workaround which works now, but not sure if this is best practice: extraConfig:
00-custom-authenticator: |
from oauthenticator.generic import GenericOAuthenticator
class CustomAuthenticator(GenericOAuthenticator):
allowed_group = '/jupyter_users' # Specify your allowed group
admin_group = '/jupyter_admin' # Specify your admin group
async def authenticate(self, handler, data):
user_info = await super().authenticate(handler, data)
if user_info:
# Get the groups from the token
groups = user_info.get('auth_state', {}).get('oauth_user', {}).get('groups', [])
print(f"---------{groups}")
# Check if the user belongs to the allowed group
if self.allowed_group in groups or self.admin_group:
return user_info # Allow login if in allowed group
else:
return None # Deny access if not in allowed group
c.JupyterHub.authenticator_class = CustomAuthenticator
c.GenericOAuthenticator.scope = ['openid', 'profile', 'email', 'groups'] |
# for free
to join this conversation on GitHub.
Already have an account?
# to comment
Bug description
I am installing jupyterhub using
HelmandKeycloakfor authentication. When a user is part of one group (ex:jupyter_users) and I declared in:It works, but if I add that same user to another group (ex: he is part of
jupyter_usersandfoogroup in keycloak) then he get denied access to jupyterhub.How to reproduce
jupyterhub_usersjupyterhub_usersfoofooLogs
The text was updated successfully, but these errors were encountered: