Repository: jupyterhub/zero-to-jupyterhub-k8s

Issue #521: If auth.whitelist.users is non-empty GitHub orgs are ignored
Created: 2018-02-22T11:36:11Z
Expected behaviour: If auth.whitelist.users is a non-empty list and auth.github.org_whitelist from #501 is set users should be able to login if they're in auth.whitelist.users or if they're a member of auth.github.org_whitelist
Observed behaviour: If auth.whitelist.users is a non-empty auth.github.org_whitelist is ignored
Relevant config
auth:
  whitelist:
    users:
    - nonexistent-dummy-user
  type: github
  github:
    clientId: "CLIENT_ID"
    clientSecret: "CLIENT_SECRET"
    callbackUrl: "http://10.0.17.150.xip.io/hub/oauth_callback"
    org_whitelist:
    - idr-contrib

I'm a public member of idr-contrib
kubectl logs -f deploy/hub:
[D 2018-02-21 12:04:36.986 JupyterHub proxy:552] Proxy: Fetching GET http://10.233.51.203:8001/api/routes
[I 2018-02-21 12:04:54.382 JupyterHub oauth2:82] OAuth redirect: 'http://10.0.17.150.xip.io/hub/oauth_callback'
[I 2018-02-21 12:04:54.383 JupyterHub log:122] 302 GET /hub/oauth_login?next= → https://github.com/login/oauth/authorize?redirect_uri=http%3A%2F%2F10.0.17.150.xip.io%2Fhub%2Foauth_callback&client_id=[CLIENT_ID]&response_type=code&state=[STATE]%3D%3D&scope=read%3Aorg (@134.36.162.197) 1.19ms
[W 2018-02-21 12:04:56.019 JupyterHub auth:249] User 'manics' not in whitelist.
[W 2018-02-21 12:04:56.019 JupyterHub base:351] Failed login for unknown user
[D 2018-02-21 12:04:56.020 JupyterHub base:633] No template for 403
[W 2018-02-21 12:04:56.024 JupyterHub log:122] 403 GET /hub/oauth_callback?code=5da9f5ee26ede539c294&state=[STATE]%3D%3D (@134.36.162.197) 1250.62ms
[D 2018-02-21 12:04:56.285 JupyterHub log:122] 304 GET /favicon.ico (@134.36.162.197) 0.65ms

Originally reported in #501 (comment)

Duplicate issue #1789: orgWhiteList not restricting users
Created: 2020-09-29T16:52:18Z
Bug description
I'm trying to set up Jupyterhub and restrict access to only the members of a specific organization, as detailed in the docs.
However, I'm finding that the whitelist is not working, as users not part of that organization are still able to authenticate (note: I am using GitHub Enterprise, not github.com).
I also had similar problems when using a whitelist of individual users, where anyone could authenticate, not just the users on the list.
Outside of the whitelist not working, the OAuth app seems to function as it should -- it shows up as an "Authorize OAuth App" for each user once that have given it permission (even those not in the org).
Expected behaviour
Only members of a specific organization would be able to authenticate to JupyterHub.
Actual behaviour
Users not in the specified organization are also able to authenticate to JupyterHub.
How to reproduce

Create JH instance on k8s
Set up ingress to access JH instance
Set up OAuth application in GHE

note: using <jh-hostname>/hub/oauth_callback as the callback URL


Update config.yaml (see configuration section below)
update JH via helm upgrade <release> jupyterhub/jupyterhub --version=0.8.2 --values config.yaml
Go to <hostname> and click "Sign in with GitHub" button

Your personal set up

Version:
0.8.2
Configuration:

proxy:
  secretToken: <token>
singleuser:
  memory:
    guarantee: 16G
  cpu:
    guarantee: 4
  image:
    name: jupyter/minimal-notebook
    tag: latest
  storage:
    extraVolumes:
      - name: jupyterhub-shared
        persistentVolumeClaim:
          claimName: shared-volume
    extraVolumeMounts:
      - name: jupyterhub-shared
        mountPath: /home/jovyan/shared
  profileList:
    - display_name: "Minimal Environment"
      description: "Base Python Environment"
      default: true
    - display_name: "Data Science Environment"
      description: "Enhanced Data Science environment supporting Python, R, and Julia"
      kubespawner_override:
        image: jupyter/datascience-notebook:latest
cull:
  timeout: 86400    
auth:
  type: github
  github:
    clientId: "<client-id>"
    clientSecret: "<client-secret>"
    callbackUrl: "<jh-hostname>/hub/oauth_callback"
    orgWhiteList:
      - "<org-name>"
  scopes:
    - "read:user"
  admin:
    users:
      - <id>
hub:
  extraEnv:
    GITHUB_HOST: "<ghe-hostname>"

Closing comment (2020-10-07T04:24:21Z): @psschwei first of all thank you soo much for such a clear issue report! I love it! ❤️
I spotted a syntax error that I think could cause trouble for your, note how you have written orgWhiteList instead of orgWhitelist?
Also, if that does not work, it would be great to have it verified that also the newest release, 0.9.0-n312.h82500044, is malfunctioning as well. For silly reasons, 0.9.1 is 311 commits more outdated than 0.9.0-n312.h82500044.
This is also tracked in #521 I believe.