Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Get JupyterHub groups from Keycloak, support oauthenticator 16.3+ #2361

Merged
merged 4 commits into from
Apr 4, 2024
Merged

Get JupyterHub groups from Keycloak, support oauthenticator 16.3+ #2361

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
da83e35
Get JupyterHub `groups` from Keycloak, support `oauthenticator` 16.3+
krassowski Mar 27, 2024
36ff361
Lint
krassowski Mar 27, 2024
d04724c
Change `allowed_groups` and `admin_groups` to Keycloak groups
krassowski Mar 29, 2024
6cb02ab
Merge branch 'develop' into keycoak-groups-and-oauthenticator-16.3
aktech Apr 4, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
31 changes: 19 additions & 12 deletions ...nebari/stages/kubernetes_services/template/modules/kubernetes/services/jupyterhub/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -150,18 +150,25 @@ resource "helm_release" "jupyterhub" {
enable_auth_state = true
}
GenericOAuthenticator = {
client_id = module.jupyterhub-openid-client.config.client_id
client_secret = module.jupyterhub-openid-client.config.client_secret
oauth_callback_url = "https://${var.external-url}/hub/oauth_callback"
authorize_url = module.jupyterhub-openid-client.config.authentication_url
token_url = module.jupyterhub-openid-client.config.token_url
userdata_url = module.jupyterhub-openid-client.config.userinfo_url
login_service = "Keycloak"
username_key = "preferred_username"
claim_groups_key = "roles"
allowed_groups = ["jupyterhub_admin", "jupyterhub_developer"]
admin_groups = ["jupyterhub_admin"]
tls_verify = false
client_id = module.jupyterhub-openid-client.config.client_id
client_secret = module.jupyterhub-openid-client.config.client_secret
oauth_callback_url = "https://${var.external-url}/hub/oauth_callback"
authorize_url = module.jupyterhub-openid-client.config.authentication_url
token_url = module.jupyterhub-openid-client.config.token_url
userdata_url = module.jupyterhub-openid-client.config.userinfo_url
login_service = "Keycloak"
username_claim = "preferred_username"
claim_groups_key = "groups"
Comment on lines +160 to +161
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Side note:
It's quite weird on oauthenticator side, that one of them is called: username_claim and other one is called: claim_groups_key instead of consistent names.

allowed_groups = ["/analyst", "/developer", "/admin"]
admin_groups = ["/admin"]
aktech marked this conversation as resolved.
Show resolved Hide resolved
manage_groups = true
refresh_pre_spawn = true
validate_server_cert = false

# deprecated, to be removed (replaced by validate_server_cert)
tls_verify = false
# deprecated, to be removed (replaced by username_claim)
username_key = "preferred_username"
}
}
}
Expand Down
Loading