Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Change use_lookup_dn_username default value to False #280

Merged

Conversation

consideRatio
Copy link
Member

@consideRatio consideRatio commented Sep 23, 2024

This default change (only relevant if lookup_dn=True) makes JupyterHub usernames end up what was entered into the login form, as compared to end up what was looked up from a found user's value of the attribute which name was configured via use_lookup_dn_username.

In practice, this can be the difference between getting JupyterHub usernames like philip j. fry (normalized from Philips J. Fry) and fry when entering the username fry when logging in.

I propose this breaking change because:

  • I think its more intuitive behavior to have users with the username they write when logging in
  • It would make toggling between using bind_dn_template to lookup_dn configs less likely to change existing jupyterhub users' usernames.
  • I think its less risky from a security perspective, as the usernames provided in the login form are checked to be lowercase for example, and that means jupyterhub's normalization of usernames wont change much later, which means that a single username given in the login form becomes guaranteed unique no matter if LDAP is case sensitive or not etc. We want to avoid multiple users get overlapping jupyterhub account names, as possibly could happen after normalization of something picked via a lookup based on the login forms username.
    Overall, I'm not sure if there is a security risk or not related to this, but since I've not ruled it out I figure this is the safer default.

@consideRatio
Copy link
Member Author

consideRatio commented Sep 23, 2024

(force push was a rebase for #281)

@consideRatio
Copy link
Member Author

Rebased again, I'll go for this and cut a beta2 updating and updating the changelog

@consideRatio consideRatio merged commit a3c8b9d into jupyterhub:main Sep 26, 2024
5 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant