Repository: jupyterhub/jupyterhub

Issue:
Cannot sign out when using Google OAuth
Torubleshoot:

> [I 2017-01-30 11:51:07.771 JupyterHub app:1528] JupyterHub is now running at http://127.0.0.1:8000/jupyterhub/
> [I 2017-01-30 11:51:09.586 JupyterHub log:100] 302 GET /jupyterhub/hub/ (bdelwood@::ffff:127.0.0.1) 4.44ms
> [I 2017-01-30 11:51:09.799 JupyterHub log:100] 200 GET /jupyterhub/hub/home (bdelwood@::ffff:127.0.0.1) 51.62ms
> [I 2017-01-30 11:51:14.976 JupyterHub login:19] User logged out: bdelwood
> [I 2017-01-30 11:51:14.985 JupyterHub log:100] 302 GET /jupyterhub/hub/logout (bdelwood@::ffff:127.0.0.1) 6.62ms
> [I 2017-01-30 11:51:15.008 JupyterHub log:100] 302 GET /jupyterhub/hub/ (@::ffff:127.0.0.1) 1.16ms
> [I 2017-01-30 11:51:15.028 JupyterHub log:100] 302 GET /jupyterhub/oauth_login (@::ffff:127.0.0.1) 1.07ms
> [I 2017-01-30 11:51:15.043 JupyterHub google:35] redirect_uri: 'https://my.domain/jupyterhub/hub/oauth_callback'
> [I 2017-01-30 11:51:15.048 JupyterHub log:100] 302 GET /jupyterhub/hub/oauth_login (@::ffff:127.0.0.1) 1.47ms
> [I 2017-01-30 11:51:15.653 JupyterHub google:57] google: username: "bdelwood"
> [I 2017-01-30 11:51:15.664 JupyterHub log:100] 302 GET /jupyterhub/hub/oauth_callback?code=<authcode> (@::ffff:127.0.0.1) 336.78ms

I am using the LocalGoogleOAuth, and authorization works fine. I have my gmail mapped to a local user. However, signing out does not work. Looking at the console when signing out, jupyterhub uses PAM to correctly sign out of the user, but then redirects the browser to the login page, which then automatically redirects to Google, and since the token is still valid, logs me right back in.  It appears that the logout button does not revoke the token from Google, so the local user signs out but Google authenticates the login automatically. 

Snippet of relevant config file:


> import os
> c.JupyterHub.authenticator_class = 'oauthenticator.google.LocalGoogleOAuthenticator'
> c.GoogleOAuthenticator.client_id = os.environ['OAUTH_CLIENT_ID']
> c.GoogleOAuthenticator.client_secret = os.environ['OAUTH_CLIENT_SECRET']
> c.GoogleOAuthenticator.oauth_callback_url = os.environ['OAUTH_CALLBACK_URL']
> ...
> c.Authenticator.username_map = {'username@gmail.com':'user'}
> 

Additionally, although I don't think this is the issue, I am running jupyterhub behind apache2.4.7 using reverse proxy. Here is a snippit of the conf file for the site:
```

<Location /jupyterhub/>
           ProxyPass http://localhost:8000/jupyterhub/
         ProxyPassReverse http://localhost:8000/jupyterhub/
</Location>


<LocationMatch "/jupyterhub/(user/[^/]*)/(api/kernels/[^/]+/channels|terminals/websocket)(.*)">
         ProxyPassMatch ws://localhost:8000/jupyterhub/$1/$2$3
         ProxyPassReverse ws://localhost:8000/jupyterhub/$1/$2$3
</LocationMatch>
```




Discussion:
@minrk Do you have any idea why the logout doesn't seem to be happening? It's working fine with GitHubOAuth on my instance. Are there additional steps needed for the GoogleOAuth?
Hi @bdelwood,

Hmm...I haven't seen this with logout before. Yet, I'm sure that we'll figure it out. Which version of JupyterHub `jupyterhub --version` are you using?
0..8.0.dev
Didn't realize I had the dev version.

Resolving patch:
diff --git a/jupyterhub/handlers/login.py b/jupyterhub/handlers/login.py
--- a/jupyterhub/handlers/login.py
+++ b/jupyterhub/handlers/login.py
@@ -8,6 +8,7 @@
 from tornado.escape import url_escape
 from tornado import gen
 
+from ..utils import url_path_join
 from .base import BaseHandler
 
 
@@ -22,7 +23,8 @@ def get(self):
                 self.clear_login_cookie(name)
             user.other_user_cookies = set([])
             self.statsd.incr('logout')
-        self.redirect(self.hub.server.base_url, permanent=False)
+
+        self.redirect(url_path_join(self.hub.server.base_url, 'login'), permanent=False)
 
 
 class LoginHandler(BaseHandler):
diff --git a/jupyterhub/handlers/pages.py b/jupyterhub/handlers/pages.py
--- a/jupyterhub/handlers/pages.py
+++ b/jupyterhub/handlers/pages.py
@@ -52,7 +52,7 @@ def get(self):
                 url = url_path_join(self.hub.server.base_url, 'home')
                 self.log.debug("User is not running: %s", url)
         else:
-            url = self.authenticator.login_url(self.base_url)
+            url = url_path_join(self.hub.server.base_url, 'login')
         self.redirect(url)
 
 


Test patch: