{"action":"created","issue":{"url":"https://api.github.com/repos/jupyterhub/nullauthenticator/issues/2","repository_url":"https://api.github.com/repos/jupyterhub/nullauthenticator","labels_url":"https://api.github.com/repos/jupyterhub/nullauthenticator/issues/2/labels{/name}","comments_url":"https://api.github.com/repos/jupyterhub/nullauthenticator/issues/2/comments","events_url":"https://api.github.com/repos/jupyterhub/nullauthenticator/issues/2/events","html_url":"https://github.com/jupyterhub/nullauthenticator/issues/2","id":298534519,"number":2,"title":"Will this work as an 'external' service in a kubernetes context?","user":{"login":"Analect","id":4063815,"avatar_url":"https://avatars2.githubusercontent.com/u/4063815?v=4","gravatar_id":"","url":"https://api.github.com/users/Analect","html_url":"https://github.com/Analect","followers_url":"https://api.github.com/users/Analect/followers","following_url":"https://api.github.com/users/Analect/following{/other_user}","gists_url":"https://api.github.com/users/Analect/gists{/gist_id}","starred_url":"https://api.github.com/users/Analect/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Analect/subscriptions","organizations_url":"https://api.github.com/users/Analect/orgs","repos_url":"https://api.github.com/users/Analect/repos","events_url":"https://api.github.com/users/Analect/events{/privacy}","received_events_url":"https://api.github.com/users/Analect/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":4,"created_at":"2018-02-20T10:05:33Z","updated_at":"2018-02-21T19:35:30Z","closed_at":null,"author_association":"NONE","body":"@minrk  ... thanks for putting this tool together.\r\nI'm trying to use it in the following context, but having difficulties in getting it working properly.\r\n\r\nI have my own app which authenticates against firebase using JWT tokens.  It includes functionality requiring connecting to jupyterlab, and I wanted to avoid a user having to login twice to two separate systems and so the nullauthenticator fits my needs well, in that sense.\r\n\r\nIn my case, jupyterhub is using a similar set-up to the [zero-to-jupyterhub-k8s](https://github.com/jupyterhub/zero-to-jupyterhub-k8s) and runs on Google's GKE infrastructure. I have been able to setup nbviewer and nbdime as external services to the hub in this context, but setting up nullauthenticator the same way is not working and I can't figure out why.  This is my set-up as an external service in the `jupyterhub_config.py`:\r\n\r\n```\r\nc.JupyterHub.services = [{\r\n            'name': 'login',\r\n            'admin': True,\r\n            'url': 'http://' + os.environ['LOGIN_SERVICE_HOST'] + ':' + os.environ['LOGIN_SERVICE_PORT'],\r\n            'api_token': os.environ['LOGIN_JHUB_TOKEN']\r\n        }]\r\n```\r\nI have also tried setting things up as an internal service, but that is somehow also failing.\r\n\r\n```\r\nc.JupyterHub.services = [{\r\n            'name': 'login',\r\n            'admin': True,\r\n            'command': [sys.executable, '/srv/login-service.py'],\r\n            'url': 'http://127.0.0.1:4202',\r\n        }]\r\n```\r\nIn an effort to get the internal service working, I have hard-coded the env variable lookup in the `login-services.py` directly, since it's easier this way than trying to pass them to the kubernetes environment, for now at least.\r\n\r\n`env = {'JUPYTERHUB_API_URL':'http://127.0.0.1:8081/hub/api', 'JUPYTERHUB_BASE_URL': 'http://myhubserver.com/hub/', 'JUPYTERHUB_SERVICE_URL': 'http://127.0.0.1:4202', 'JUPYTERHUB_API_TOKEN': 'some-fixed-token'}`\r\n\r\nI continue to get a combination of `403` and `302` errors.\r\n\r\n```\r\n[I 2018-02-18 19:54:02.463 JupyterHub app:1528] Hub API listening on http://0.0.0.0:8081/hub/\r\n[I 2018-02-18 19:54:02.467 JupyterHub app:1538] Not starting proxy\r\n[I 2018-02-18 19:54:02.467 JupyterHub app:1544] Starting managed service login at http://127.0.0.1:4202\r\n[I 2018-02-18 19:54:02.468 JupyterHub service:266] Starting service 'login': ['/usr/bin/python3', '/srv/login-service.py']\r\n[I 2018-02-18 19:54:02.475 JupyterHub service:109] Spawning /usr/bin/python3 /srv/login-service.py\r\n[I 2018-02-18 19:54:02.911 JupyterHub app:1551] Adding external service nbdime at http://10.7.243.191:9000\r\n[I 2018-02-18 19:54:03.049 JupyterHub app:1551] Adding external service nbviewer at http://10.7.247.171:8080\r\n[I 2018-02-18 19:54:03.071 JupyterHub app:1581] JupyterHub is now running at http://10.7.xxx.xxx:80/\r\n[W 2018-02-18 20:05:04.928 JupyterHub base:351] Failed login for unknown user\r\n[W 2018-02-18 20:05:04.955 JupyterHub log:122] 403 GET /hub/login?next=%2Fhub%2Fuser%2Fmccoole%2F%3Ftoken%3Dsome-fixed-token (@10.4.0.1) 28.62ms\r\n[I 2018-02-18 20:05:36.646 JupyterHub log:122] 302 GET / \\u2192 /hub (@10.132.0.6) 0.70ms\r\n[I 2018-02-18 20:05:36.959 JupyterHub log:122] 302 GET /hub \\u2192 /hub/login (@10.132.0.6) 0.70ms\r\n[W 2018-02-18 20:05:37.272 JupyterHub base:351] Failed login for unknown user\r\n[W 2018-02-18 20:05:37.273 JupyterHub log:122] 403 GET /hub/login (@10.132.0.6) 1.84ms\r\n[W 2018-02-18 20:05:37.898 JupyterHub log:122] 405 POST /q.php (@10.132.0.6) 1.46ms\r\n[W 2018-02-18 20:05:38.521 JupyterHub log:122] 405 POST /s.php (@10.132.0.6) 1.43ms\r\n[W 2018-02-18 20:05:39.144 JupyterHub log:122] 405 POST /wuwu11.php (@10.132.0.6) 1.43ms\r\n[W 2018-02-18 20:05:39.766 JupyterHub log:122] 405 POST /slider.php (@10.132.0.6) 1.50ms\r\n[W 2018-02-18 20:05:40.389 JupyterHub log:122] 405 POST /sheep.php (@10.132.0.6) 1.61ms\r\n[W 2018-02-18 20:05:41.013 JupyterHub log:122] 405 POST /q.php (@10.132.0.6) 1.75ms\r\n[W 2018-02-18 20:05:41.637 JupyterHub log:122] 405 POST /xx.php (@10.132.0.6) 1.51ms\r\n[I 2018-02-18 20:07:00.796 JupyterHub log:122] 302 GET /hub/user/mccoole/?token=mccoole-token \\u2192 /hub/login?next=%2Fhub%2Fuser%2Fmccoole%2F%3Ftoken%3Dsome-fixed-token (@10.4.0.1) 1.21ms\r\n[W 2018-02-18 20:07:00.833 JupyterHub base:351] Failed login for unknown user\r\n[W 2018-02-18 20:07:00.835 JupyterHub log:122] 403 GET /hub/login?next=%2Fhub%2Fuser%2Fmccoole%2F%3Ftoken%3Dsome-fixed-token (@10.4.0.1) 1.93ms\r\n```\r\nLooking at those logs above, none of them show the base url .. just the part `/hub/login....` ... could it be that this base url part is not getting captured?\r\n\r\nDoes this solution somehow require that the port `4202` is exposed externally to the internet, or is it enough that it is just exposed internally within the kubernetes infrastructure?  Could that be the reason it is failing ... even to redirect me to the `login.html` page?"},"comment":{"url":"https://api.github.com/repos/jupyterhub/nullauthenticator/issues/comments/367444373","html_url":"https://github.com/jupyterhub/nullauthenticator/issues/2#issuecomment-367444373","issue_url":"https://api.github.com/repos/jupyterhub/nullauthenticator/issues/2","id":367444373,"user":{"login":"minrk","id":151929,"avatar_url":"https://avatars1.githubusercontent.com/u/151929?v=4","gravatar_id":"","url":"https://api.github.com/users/minrk","html_url":"https://github.com/minrk","followers_url":"https://api.github.com/users/minrk/followers","following_url":"https://api.github.com/users/minrk/following{/other_user}","gists_url":"https://api.github.com/users/minrk/gists{/gist_id}","starred_url":"https://api.github.com/users/minrk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/minrk/subscriptions","organizations_url":"https://api.github.com/users/minrk/orgs","repos_url":"https://api.github.com/users/minrk/repos","events_url":"https://api.github.com/users/minrk/events{/privacy}","received_events_url":"https://api.github.com/users/minrk/received_events","type":"User","site_admin":false},"created_at":"2018-02-21T19:35:30Z","updated_at":"2018-02-21T19:35:30Z","author_association":"OWNER","body":"The model of REMOTE_USER can be used no matter where the information comes from - query parameters, headers, cookies. Not the REMOTE_USER implementation itself, which assumes specific apache behavior, but writing your own Authenticator with a similar pattern, tailored to however you identify users, e.g. jwt from firebase."}}
{"actor":{"display_login":"minrk"}}