Configured oauth_consumer_key not known

[BenGig]

Bug description

I am testing PR #48 with Helm chart zero-to-jupyterhub-k8s 1.1.1 as follows:

1. I use the Docker image jupyterhub/k8s-hub:1.1.1 as base. This is working fine with the configuration below.
2. install the latest ltiauthenticator
3. configure the authenticator in values.yml

hub:
  config:
    LTIAuthenticator:
      consumers: {
        "aaaaaaaaaaaaaaaaaaaaaaa": "bbbbbbbbbbbbbbbbb"
        }
    JupyterHub:
      authenticator_class: ltiauthenticator.LTIAuthenticator

Expected behaviour

Authentication is working as with ltiauthenticator 1.0.0

Actual behaviour

Authentication fails. The issue raises here:

        if args["oauth_consumer_key"] not in self.consumers:
            raise HTTPError(401, "unknown oauth_consumer_key")

I think the LTI11Authenticator does not get the configuration items from the values.yml (content is {} at initialization); the attribute args["oauth_consumer_key"] contains the correct value.

I tried then to find where the configuration values are read, but I could not find that piece of code here or in JupyterHub.

Your personal set up

Kubernetes setup is straight forward. For testing, my Dockerfile to build the test environment looks like (forked the repo to add additional debugging output only):

FROM jupyterhub/k8s-hub:1.1.1

USER 0
RUN git clone https://github.com/bengig/ltiauthenticator.git && cd ltiauthenticator && git checkout jhub-integration && pip3 install .

USER 1000
CMD ["jupyterhub", "--config", "/usr/local/etc/jupyterhub/jupyterhub_config.py"]

[welcome]

Thank you for opening your first issue in this project! Engagement like this is essential for open source projects! 🤗

If you haven't done so already, check out Jupyter's Code of Conduct. Also, please try to follow the issue template as it helps other other community members to contribute more effectively.

You can meet the other Jovyans by joining our Discourse forum. There is also an intro thread there where you can stop by and say Hi! 👋

Welcome to the Jupyter community! 🎉

[yuvipanda]

Thanks for reporting this! Can you try LTI11Authenticator rather than LTIAuthenticator

[BenGig]

Changing the configuration to

  config:
    LTI11Authenticator:
      consumers: {
        "aaaaaaaaaaa": "bbbbbbbbbbbb"
        }
    JupyterHub:
      authenticator_class: ltiauthenticator.LTI11Authenticator

lead to the log message

Bad config encountered during initialization: The 'authenticator_class' trait of <jupyterhub.app.JupyterHub object at 0x7fceb42ca1c0> 
instance must be a type, but 'ltiauthenticator.LTI11Authenticator' could not be imported

I found in init.py that the name exposed is still LTIAuthenticator

from ltiauthenticator.lti11.auth import LTI11Authenticator as LTIAuthenticator

I changed this to ... as LTI11Authenticator. The auth process now passes. I run into another error:

custom_canvas_user_id did not match any of the launch request arguments

I have to investigate if this is a configuration issue on my side or a bug, not falling back to the old default user_id. But it has certainly nothing to do with this issue.

[jgwerner]

@BenGig thanks for reporting this error. I will try to replicate this issue soon. In the meantime, would you happen to have a copy of the request from the JupyterHub logs?

[jgwerner]

General Comments

LTIAuthenticator Alias

@BenGig I did some preliminary testing. It seems that this error is related specifically to the K8s configuration. The Tests section below demonstrates how we can still use the LTIAuthenticator alias with the more standard jupyterhub/jupyterhub:1.4.2 image that allows local testing with a docker container.

As a workaround, what you could do is add an extraConfig section to your custom config to dynamically import the LTIAuthenticator class and assign it to the authenticator_class configurable like so:

...
extraConfig:
  myAuthConfig: |
    from ltiauthenticator import LTIAuthenticator

    c.JupyterHub.authenticator_class = LTIAuthenticator
...

@yuvipanda wouldn't we have to add an entry point to the setup so that the K8s version supports these custom entry points?

Error with canvas_custom_user_id

It looks to me like this is a bug. The exception is raised before falling back to the custom user_id, so will send a PR to fix this bug and update tests.

Tests

1. Pull the jupyterhub/jupyterhub:1.4.2 image:

docker pull jupyterhub/jupyterhub:1.4.2

2. Run the image and exec into it:

docker run -it --rm -p 8000:8000 jupyterhub/jupyterhub:1.4.2 /bin/bash

3. Install the ltiauthenticator package:

cd /tmp
git clone https://github.com/jupyterhub/ltiauthenticator
cd ltiauthenticator
pip install .

4. Open a Python shell and test the import with the LTIAuthenticator alias:

...
Successfully built jupyterhub-ltiauthenticator
Installing collected packages: escapism, jupyterhub-ltiauthenticator
Successfully installed escapism-1.0.1 jupyterhub-ltiauthenticator-1.0.1.dev0
WARNING: Running pip as the 'root' user can result in broken permissions and conflicting behaviour with the system package manager. It is recommended to use a virtual environment instead: https://pip.pypa.io/warnings/venv
root@5ed70fb64fee:/tmp/ltiauthenticator# python3
Python 3.8.10 (default, Jun  2 2021, 10:49:15)
[GCC 9.4.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> from ltiauthenticator import LTIAuthenticator
>>>
root@5ed70fb64fee:/tmp/ltiauthenticator#

5. Start the JupyterHub service with a standalone docker container with a custom jupyterhub_config.py using the import alias:

""" Configuration file for jupyterhub. This version is used primarily for testing. """

# Set port and IP
c.JupyterHub.ip = "0.0.0.0"
c.JupyterHub.port = 8000

# Set log level
c.Application.log_level = "DEBUG"

# Header settings for iFrame and SameSite
c.JupyterHub.tornado_settings = {
    "headers": {"Content-Security-Policy": "frame-ancestors 'self' *"},
    "cookie_options": {"SameSite": "None", "Secure": True},
}

# Set the authenticator
c.JupyterHub.authenticator_class = 'ltiauthenticator.LTIAuthenticator'

6. Verify that the authenticator class is using the LTI11Authenticator class by checking the JuptyterHub logs:

root@5ed70fb64fee:/tmp/ltiauthenticator# jupyterhub --config=jupyterhub_config.py
[I 2021-07-24 03:00:12.206 JupyterHub app:2459] Running JupyterHub version 1.4.2
[I 2021-07-24 03:00:12.207 JupyterHub app:2489] Using Authenticator: ltiauthenticator.lti11.auth.LTI11Authenticator
[I 2021-07-24 03:00:12.207 JupyterHub app:2489] Using Spawner: jupyterhub.spawner.LocalProcessSpawner-1.4.2

[BenGig]

Latest version works well, with the extraConfig added. I'll do further testing with non default user names, but this issue has been solved. Many thanks!