oauthenticator 16.2.0__tar.gz → 16.3.0__tar.gz

{oauthenticator-16.2.0/oauthenticator.egg-info → oauthenticator-16.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: oauthenticator
-Version: 16.2.0
+Version: 16.3.0
 Summary: OAuthenticator: Authenticate JupyterHub users with common OAuth providers
 Home-page: https://jupyter.org
 Author: Jupyter Development Team
@@ -19,13 +19,12 @@ Requires-Python: >=3.8
 Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: jsonschema
-Requires-Dist: jupyterhub>=1.2
+Requires-Dist: jupyterhub>=2.2
+Requires-Dist: pyjwt>=2
 Requires-Dist: requests
 Requires-Dist: ruamel.yaml
 Requires-Dist: tornado
 Requires-Dist: traitlets
-Provides-Extra: azuread
-Requires-Dist: pyjwt>=2; extra == "azuread"
 Provides-Extra: googlegroups
 Requires-Dist: google-api-python-client; extra == "googlegroups"
 Requires-Dist: google-auth-oauthlib; extra == "googlegroups"
@@ -33,10 +32,9 @@ Provides-Extra: mediawiki
 Requires-Dist: mwoauth>=0.3.8; extra == "mediawiki"
 Provides-Extra: test
 Requires-Dist: pytest>=2.8; extra == "test"
-Requires-Dist: pytest-asyncio; extra == "test"
+Requires-Dist: pytest-asyncio<0.23,>=0.17; extra == "test"
 Requires-Dist: pytest-cov; extra == "test"
 Requires-Dist: requests-mock; extra == "test"
-Requires-Dist: pyjwt>=2; extra == "test"
 Requires-Dist: google-api-python-client; extra == "test"
 Requires-Dist: google-auth-oauthlib; extra == "test"
 Requires-Dist: mwoauth>=0.3.8; extra == "test"

{oauthenticator-16.2.0 → oauthenticator-16.3.0}/oauthenticator/_version.py

@@ -1,7 +1,7 @@
 # __version__ should be updated using tbump, based on configuration in
 # pyproject.toml, according to instructions in RELEASE.md.
 #
-__version__ = "16.2.0"
+__version__ = "16.3.0"
 
 # version_info looks like (1, 2, 3, "dev") if __version__ is 1.2.3.dev
 version_info = tuple(int(p) if p.isdigit() else p for p in __version__.split("."))

{oauthenticator-16.2.0 → oauthenticator-16.3.0}/oauthenticator/auth0.py

@@ -1,6 +1,7 @@
 """
 A JupyterHub authenticator class for use with Auth0 as an identity provider.
 """
+
 import os
 
 from jupyterhub.auth import LocalAuthenticator

{oauthenticator-16.2.0 → oauthenticator-16.3.0}/oauthenticator/azuread.py

@@ -1,6 +1,7 @@
 """
 A JupyterHub authenticator class for use with Azure AD as an identity provider.
 """
+
 import os
 
 import jwt
@@ -21,6 +22,16 @@ class AzureAdOAuthenticator(OAuthenticator):
     def _username_claim_default(self):
         return "name"
 
+    user_groups_claim = Unicode(
+        "groups",
+        config=True,
+        help="""
+        Name of claim containing user group memberships.
+
+        Will populate JupyterHub groups if Authenticator.manage_groups is True.
+        """,
+    )
+
     tenant_id = Unicode(
         config=True,
         help="""
@@ -44,6 +55,15 @@ class AzureAdOAuthenticator(OAuthenticator):
     def _token_url_default(self):
         return f"https://login.microsoftonline.com/{self.tenant_id}/oauth2/token"
 
+    async def update_auth_model(self, auth_model, **kwargs):
+        auth_model = await super().update_auth_model(auth_model, **kwargs)
+
+        if getattr(self, "manage_groups", False):
+            user_info = auth_model["auth_state"][self.user_auth_state_key]
+            auth_model["groups"] = user_info[self.user_groups_claim]
+
+        return auth_model
+
     async def token_to_user(self, token_info):
         id_token = token_info['id_token']
         decoded = jwt.decode(

{oauthenticator-16.2.0 → oauthenticator-16.3.0}/oauthenticator/bitbucket.py

@@ -1,6 +1,7 @@
 """
 A JupyterHub authenticator class for use with Bitbucket as an identity provider.
 """
+
 import os
 
 from jupyterhub.auth import LocalAuthenticator

{oauthenticator-16.2.0 → oauthenticator-16.3.0}/oauthenticator/cilogon.py

@@ -1,6 +1,7 @@
 """
 A JupyterHub authenticator class for use with CILogon as an identity provider.
 """
+
 import os
 from fnmatch import fnmatch
 from urllib.parse import urlparse

{oauthenticator-16.2.0 → oauthenticator-16.3.0}/oauthenticator/generic.py

@@ -1,6 +1,7 @@
 """
 A JupyterHub authenticator class for use with any OAuth2 based identity provider.
 """
+
 import os
 from functools import reduce
 
@@ -25,6 +26,10 @@ class GenericOAuthenticator(OAuthenticator):
 
         Can be a string key name (use periods for nested keys), or a callable
         that accepts the returned json (as a dict) and returns the groups list.
+
+        This configures how group membership in the upstream provider is determined
+        for use by `allowed_groups`, `admin_groups`, etc. If `manage_groups` is True,
+        this will also determine users' _JupyterHub_ group membership.
         """,
     )
 
@@ -56,20 +61,6 @@ class GenericOAuthenticator(OAuthenticator):
         """,
     )
 
-    username_claim = Union(
-        [Unicode(os.environ.get('OAUTH2_USERNAME_KEY', 'username')), Callable()],
-        config=True,
-        help="""
-        When `userdata_url` returns a json response, the username will be taken
-        from this key.
-
-        Can be a string key name or a callable that accepts the returned
-        userdata json (as a dict) and returns the username.  The callable is
-        useful e.g. for extracting the username from a nested object in the
-        response.
-        """,
-    )
-
     @default("http_client")
     def _default_http_client(self):
         return AsyncHTTPClient(
@@ -109,17 +100,6 @@ class GenericOAuthenticator(OAuthenticator):
         """,
     )
 
-    def user_info_to_username(self, user_info):
-        """
-        Overrides OAuthenticator.user_info_to_username to support the
-        GenericOAuthenticator unique feature of allowing username_claim to be a
-        callable function.
-        """
-        if callable(self.username_claim):
-            return self.username_claim(user_info)
-        else:
-            return super().user_info_to_username(user_info)
-
     def get_user_groups(self, user_info):
         """
         Returns a set of groups the user belongs to based on claim_groups_key
@@ -150,15 +130,22 @@ class GenericOAuthenticator(OAuthenticator):
         the user isn't part of `admin_users` or `admin_groups`. Note that
         leaving it at None makes users able to retain an admin status while
         setting it to False makes it be revoked.
+
+        Also populates groups if `manage_groups` is set.
         """
+        if self.manage_groups or self.admin_groups:
+            user_info = auth_model["auth_state"][self.user_auth_state_key]
+            user_groups = self.get_user_groups(user_info)
+
+        if self.manage_groups:
+            auth_model["groups"] = sorted(user_groups)
+
         if auth_model["admin"]:
             # auth_model["admin"] being True means the user was in admin_users
             return auth_model
 
         if self.admin_groups:
             # admin status should in this case be True or False, not None
-            user_info = auth_model["auth_state"][self.user_auth_state_key]
-            user_groups = self.get_user_groups(user_info)
             auth_model["admin"] = bool(user_groups & self.admin_groups)
 
         return auth_model

{oauthenticator-16.2.0 → oauthenticator-16.3.0}/oauthenticator/github.py

@@ -1,6 +1,7 @@
 """
 A JupyterHub authenticator class for use with GitHub as an identity provider.
 """
+
 import json
 import os
 import warnings

{oauthenticator-16.2.0 → oauthenticator-16.3.0}/oauthenticator/gitlab.py

@@ -1,6 +1,7 @@
 """
 A JupyterHub authenticator class for use with GitLab as an identity provider.
 """
+
 import os
 import warnings
 from urllib.parse import quote

{oauthenticator-16.2.0 → oauthenticator-16.3.0}/oauthenticator/globus.py

@@ -1,6 +1,7 @@
 """
 A JupyterHub authenticator class for use with Globus as an identity provider.
 """
+
 import base64
 import os
 import pickle

{oauthenticator-16.2.0 → oauthenticator-16.3.0}/oauthenticator/google.py

@@ -1,6 +1,7 @@
 """
 A JupyterHub authenticator class for use with Google as an identity provider.
 """
+
 import os
 
 from jupyterhub.auth import LocalAuthenticator
@@ -110,19 +111,26 @@ class GoogleOAuthenticator(OAuthenticator, GoogleOAuth2Mixin):
         help="""
         This config has two functions.
 
-        1. Restrict sign-in to a list of email domain names, such as
-           `["mycollege.edu"]` or `["college1.edu", "college2.edu"]`.
-        2. If a single domain is specified, the username will be stripped to exclude the `@domain` part.
+        1. Restrict sign-in to users part of Google organizations/workspaces
+           managing domains, such as `["mycollege.edu"]` or `["college1.edu",
+           "college2.edu"]`.
+        2. If a single domain is specified, usernames with that domain will be
+           stripped to exclude the `@domain` part.
 
-        Note that users with email domains in this list must still be allowed
-        via another config, such as `allow_all`, `allowed_users`, or
-        `allowed_google_groups`.
+        Users not restricted by this configuration must still be explicitly
+        allowed by a configuration intended to allow users, like `allow_all`,
+        `allowed_users`, or `allowed_google_groups`.
+
+        .. warning::
+
+           Changing this config either to or from having a single entry is a
+           disruptive change as the same Google user will get a new username,
+           either without or with a domain name included.
+
+        .. versionchanged:: 16.1
 
-        ```{warning} Disruptive config changes
-        Changing this config either to or from having a single entry is a
-        disruptive change as the same Google user will get a new username,
-        either without or with a domain name included.
-        ```
+           Now restricts sign-in based on the hd claim, not the domain in the
+           user's email.
         """,
     )
 
@@ -173,8 +181,19 @@ class GoogleOAuthenticator(OAuthenticator, GoogleOAuth2Mixin):
         user_email = user_info["email"]
         user_domain = user_info["domain"] = user_email.split("@")[1].lower()
 
-        if len(self.hosted_domain) == 1 and self.hosted_domain[0] == user_domain:
-            # unambiguous domain, use only base name
+        # NOTE: This is not an authorization check, it just about username
+        #       derivation. Decoupling hosted_domain from this is considered in
+        #       https://github.com/jupyterhub/oauthenticator/issues/733.
+        #
+        # NOTE: This code is written with without knowing for sure if the user
+        #       email's domain could be different from the domain in hd, so we
+        #       assume it could be even though it seems like it can't be. If a
+        #       Google organization/workspace manages users in a "primary
+        #       domain" and a "secondary domain", users with respective email
+        #       domain have their hd field set respectively.
+        #
+        if len(self.hosted_domain) == 1 and user_domain == self.hosted_domain[0]:
+            # strip the domain in this situation
             username = username.split("@")[0]
 
         return username
@@ -213,6 +232,28 @@ class GoogleOAuthenticator(OAuthenticator, GoogleOAuth2Mixin):
 
         return auth_model
 
+    def check_blocked_users(self, username, auth_model):
+        """
+        Overrides `Authenticator.check_blocked_users` to not only block users in
+        `Authenticator.blocked_users`, but to also enforce
+        `GoogleOAuthenticator.hosted_domain` if its configured.
+
+        When hosted_domain is configured, users are required to be part of
+        listed Google organizations/workspaces.
+
+        Returns False if the user is blocked, otherwise True.
+        """
+        user_info = auth_model["auth_state"][self.user_auth_state_key]
+
+        # hd ref: https://developers.google.com/identity/openid-connect/openid-connect#id_token-hd
+        hd = user_info.get("hd", "")
+
+        if self.hosted_domain and hd not in self.hosted_domain:
+            self.log.warning(f"Blocked {username} with 'hd={hd}' not in hosted_domain")
+            return False
+
+        return super().check_blocked_users(username, auth_model)
+
     async def check_allowed(self, username, auth_model):
         """
         Overrides the OAuthenticator.check_allowed to also allow users part of
@@ -235,19 +276,6 @@ class GoogleOAuthenticator(OAuthenticator, GoogleOAuth2Mixin):
             self.log.warning(message)
             raise HTTPError(403, message)
 
-        # NOTE: If hosted_domain is configured as ["a.com", "b.com"], and
-        #       allowed_google_groups is declared as {"a.com": {"a-group"}}, a
-        #       "b.com" user won't be authorized unless allowed in another way.
-        #
-        #       This means that its not possible to allow all users of a given
-        #       domain if one wants to restrict another.
-        #
-        if self.hosted_domain:
-            if user_domain not in self.hosted_domain:
-                message = f"Login with domain @{user_domain} is not allowed"
-                self.log.warning(message)
-                raise HTTPError(403, message)
-
         if await super().check_allowed(username, auth_model):
             return True
 

{oauthenticator-16.2.0 → oauthenticator-16.3.0}/oauthenticator/mediawiki.py

@@ -1,6 +1,7 @@
 """
 A JupyterHub authenticator class for use with MediaWiki as an identity provider.
 """
+
 import json
 import os
 from asyncio import wrap_future

{oauthenticator-16.2.0 → oauthenticator-16.3.0}/oauthenticator/oauth2.py

@@ -3,12 +3,14 @@ Base classes for use by OAuth2 based JupyterHub authenticator classes.
 
 Founded based on work by Kyle Kelley (@rgbkrk)
 """
+
 import base64
 import json
 import os
 import uuid
 from urllib.parse import quote, urlencode, urlparse, urlunparse
 
+import jwt
 from jupyterhub.auth import Authenticator
 from jupyterhub.crypto import EncryptionUnavailable, InvalidToken, decrypt
 from jupyterhub.handlers import BaseHandler, LogoutHandler
@@ -18,7 +20,7 @@ from tornado.auth import OAuth2Mixin
 from tornado.httpclient import AsyncHTTPClient, HTTPClientError, HTTPRequest
 from tornado.httputil import url_concat
 from tornado.log import app_log
-from traitlets import Any, Bool, Dict, List, Unicode, default
+from traitlets import Any, Bool, Callable, Dict, List, Unicode, Union, default, validate
 
 
 def guess_callback_uri(protocol, host, hub_server_url):
@@ -268,6 +270,8 @@ class OAuthenticator(Authenticator):
         help="""
         Allow all authenticated users to login.
 
+        Overrides all other `allow` configuration.
+
         .. versionadded:: 16.0
         """,
     )
@@ -278,37 +282,29 @@ class OAuthenticator(Authenticator):
         help="""
         Allow existing users to login.
 
-        An existing user is a user in JupyterHub's database of users, and it
-        includes all users that has previously logged in.
+        Enable this if you want to manage user access via the JupyterHub admin page (/hub/admin).
+
+        With this enabled, all users present in the JupyterHub database are allowed to login.
+        This has the effect of any user who has _previously_ been allowed to login
+        via any means will continue to be allowed until the user is deleted via the /hub/admin page
+        or REST API.
 
         .. warning::
 
            Before enabling this you should review the existing users in the
            JupyterHub admin panel at `/hub/admin`. You may find users existing
-           there because they have once been declared in config such as
-           `allowed_users` or once been allowed to sign in.
+           there because they have previously been declared in config such as
+           `allowed_users` or allowed to sign in.
 
         .. warning::
 
-           When this is enabled and you are to remove access for one or more
-           users allowed via other config options, you must make sure that they
-           are not part of the database of users still. This can be tricky to do
+           When this is enabled and you wish to remove access for one or more
+           users previously allowed, you must make sure that they
+           are removed from the jupyterhub database. This can be tricky to do
            if you stop allowing a group of externally managed users for example.
 
         With this enabled, JupyterHub admin users can visit `/hub/admin` or use
-        JupyterHub's REST API to add and remove users as a way to allow them
-        access.
-
-        The username for existing users must match the normalized username
-        returned by the authenticator. When creating users, only lowercase
-        letters should be used unless `MWOAuthenticator` is used.
-
-        .. note::
-
-           Allowing existing users is done by adding existing users on startup
-           and newly created users to the `allowed_users` set. Due to that, you
-           can't rely on this config to independently allow existing users if
-           you for example would reset `allowed_users` after startup.
+        JupyterHub's REST API to add and remove users to manage who can login.
 
         .. versionadded:: 16.0
 
@@ -359,6 +355,24 @@ class OAuthenticator(Authenticator):
     def _token_url_default(self):
         return os.environ.get("OAUTH2_TOKEN_URL", "")
 
+    userdata_from_id_token = Bool(
+        False,
+        config=True,
+        help="""
+        Extract user details from an id token received via a request to
+        :attr:`token_url`, rather than making a follow-up request to the
+        userinfo endpoint :attr:`userdata_url`.
+
+        Should only be used if :attr:`token_url` uses HTTPS, to ensure
+        token authenticity.
+
+        For more context, see `Authentication using the Authorization
+        Code Flow
+        <https://openid.net/specs/openid-connect-core-1_0.html#CodeFlowAuth>`_
+        in the OIDC Core standard document.
+        """,
+    )
+
     userdata_url = Unicode(
         config=True,
         help="""
@@ -369,6 +383,8 @@ class OAuthenticator(Authenticator):
         For more context, see the `Protocol Flow section
         <https://www.rfc-editor.org/rfc/rfc6749#section-1.2>`_ in the OAuth2
         standard document, specifically steps E-F.
+
+        Incompatible with :attr:`userdata_from_id_token`.
         """,
     )
 
@@ -376,14 +392,25 @@ class OAuthenticator(Authenticator):
     def _userdata_url_default(self):
         return os.environ.get("OAUTH2_USERDATA_URL", "")
 
-    username_claim = Unicode(
-        "username",
+    @validate("userdata_url")
+    def _validate_userdata_url(self, proposal):
+        if proposal.value and self.userdata_from_id_token:
+            raise ValueError(
+                "Cannot specify both authenticator.userdata_url and authenticator.userdata_from_id_token."
+            )
+        return proposal.value
+
+    username_claim = Union(
+        [Unicode(os.environ.get('OAUTH2_USERNAME_KEY', 'username')), Callable()],
         config=True,
         help="""
-        The key to get the JupyterHub username from in the data response to the
-        request made to :attr:`userdata_url`.
+        When `userdata_url` returns a json response, the username will be taken
+        from this key.
 
-        Examples include: email, username, nickname
+        Can be a string key name or a callable that accepts the returned
+        userdata json (as a dict) and returns the username.  The callable is
+        useful e.g. for extracting the username from a nested object in the
+        response or doing other post processing.
 
         What keys are available will depend on the scopes requested and the
         authenticator used.
@@ -768,7 +795,11 @@ class OAuthenticator(Authenticator):
 
         Called by the :meth:`oauthenticator.OAuthenticator.authenticate`
         """
-        username = user_info.get(self.username_claim, None)
+
+        if callable(self.username_claim):
+            username = self.username_claim(user_info)
+        else:
+            username = user_info.get(self.username_claim, None)
         if not username:
             message = (f"No {self.username_claim} found in {user_info}",)
             self.log.error(message)
@@ -863,6 +894,9 @@ class OAuthenticator(Authenticator):
         Determines who the logged-in user by sending a "GET" request to
         :data:`oauthenticator.OAuthenticator.userdata_url` using the `access_token`.
 
+        If :data:`oauthenticator.OAuthenticator.userdata_from_id_token` is set then
+        extracts the corresponding info from an `id_token` instead.
+
         Args:
             token_info: the dictionary returned by the token request (exchanging the OAuth code for an Access Token)
 
@@ -871,6 +905,32 @@ class OAuthenticator(Authenticator):
 
         Called by the :meth:`oauthenticator.OAuthenticator.authenticate`
         """
+        if self.userdata_from_id_token:
+            # Use id token instead of exchanging access token with userinfo endpoint.
+            id_token = token_info.get("id_token", None)
+            if not id_token:
+                raise web.HTTPError(
+                    500,
+                    f"An id token was not returned: {token_info}\nPlease configure authenticator.userdata_url",
+                )
+            try:
+                # Here we parse the id token. Note that per OIDC spec (core v1.0 sect. 3.1.3.7.6) we can skip
+                # signature validation as the hub has obtained the tokens from the id provider directly (using
+                # https). Google suggests all token validation may be skipped assuming the provider is trusted.
+                # https://openid.net/specs/openid-connect-core-1_0.html#IDTokenValidation
+                # https://developers.google.com/identity/openid-connect/openid-connect#obtainuserinfo
+                return jwt.decode(
+                    id_token,
+                    audience=self.client_id,
+                    options=dict(
+                        verify_signature=False, verify_aud=True, verify_exp=True
+                    ),
+                )
+            except Exception as err:
+                raise web.HTTPError(
+                    500, f"Unable to decode id token: {id_token}\n{err}"
+                )
+
         access_token = token_info["access_token"]
         token_type = token_info["token_type"]
 
@@ -1078,3 +1138,18 @@ class OAuthenticator(Authenticator):
                 self._deprecated_oauth_trait, names=list(self._deprecated_oauth_aliases)
             )
         super().__init__(**kwargs)
+
+
+# patch allowed_users help string to match our definition
+# base Authenticator class help string gives the wrong impression
+# when combined with other allow options
+OAuthenticator.class_traits()[
+    "allowed_users"
+].help = """
+Set of usernames that should be allowed to login.
+
+If unspecified, grants no access. You must set at least one other `allow` configuration
+if any users are to have permission to access the Hub.
+
+Any usernames in `admin_users` will also be allowed to login.
+"""

{oauthenticator-16.2.0 → oauthenticator-16.3.0}/oauthenticator/openshift.py

@@ -1,6 +1,7 @@
 """
 A JupyterHub authenticator class for use with OpenShift as an identity provider.
 """
+
 import concurrent.futures
 import json
 import os

{oauthenticator-16.2.0 → oauthenticator-16.3.0}/oauthenticator/schemas/cilogon-schema.yaml

@@ -15,6 +15,8 @@ properties:
       type: string
   allowed_domains_claim:
     type: string
+  default:
+    type: boolean
   username_derivation:
     type: object
     additionalProperties: false

{oauthenticator-16.2.0 → oauthenticator-16.3.0}/oauthenticator/tests/conftest.py

@@ -1,4 +1,5 @@
 """Py.Test fixtures"""
+
 from pytest import fixture
 from tornado.httpclient import AsyncHTTPClient
 

{oauthenticator-16.2.0 → oauthenticator-16.3.0}/oauthenticator/tests/mocks.py

@@ -1,4 +1,5 @@
 """Mocking utilities for testing"""
+
 import json
 import os
 import re
@@ -103,7 +104,6 @@ def setup_oauth_mock(
     access_token_path,
     user_path=None,
     token_type='Bearer',
-    token_request_style='post',
 ):
     """setup the mock client for OAuth
 
@@ -127,9 +127,6 @@ def setup_oauth_mock(
         token_type (str): the token_type field for the provider
     """
 
-    if user_path is None and token_request_style != "jwt":
-        raise TypeError("user_path is required unless token_request_style is jwt")
-
     client.oauth_codes = oauth_codes = {}
     client.access_tokens = access_tokens = {}
 
@@ -164,7 +161,7 @@ def setup_oauth_mock(
             'access_token': token,
             'token_type': token_type,
         }
-        if token_request_style == 'jwt':
+        if 'id_token' in user:
             model['id_token'] = user['id_token']
         return model
 

{oauthenticator-16.2.0 → oauthenticator-16.3.0}/oauthenticator/tests/test_azuread.py

@@ -1,4 +1,5 @@
 """test azure ad"""
+
 import json
 import os
 import re
@@ -7,6 +8,7 @@ import uuid
 from unittest import mock
 
 import jwt
+import pytest
 from pytest import fixture, mark
 from traitlets.config import Config
 
@@ -20,7 +22,6 @@ def azure_client(client):
         client,
         host=['login.microsoftonline.com'],
         access_token_path=re.compile('^/[^/]+/oauth2/token$'),
-        token_request_style='jwt',
     )
     return client
 
@@ -44,6 +45,17 @@ def user_model(tenant_id, client_id, name):
             "tid": tenant_id,
             "nonce": "123523",
             "aio": "Df2UVXL1ix!lMCWMSOJBcFatzcGfvFGhjKv8q5g0x732dR5MB5BisvGQO7YWByjd8iQDLq!eGbIDakyp5mnOrcdqHeYSnltepQmRp6AIZ8jY",
+            "groups": [
+                "96000b2c-7333-4f6e-a2c3-e7608fa2d131",
+                "a992b3d5-1966-4af4-abed-6ef021417be4",
+                "ceb90a42-030f-44f1-a0c7-825b572a3b07",
+            ],
+            # different from 'groups' for tests
+            "grp": [
+                "96000b2c-7333-4f6e-a2c3",
+                "a992b3d5-1966-4af4-abed",
+                "ceb90a42-030f-44f1-a0c7",
+            ],
         },
         os.urandom(5),
     )
@@ -103,6 +115,23 @@ def user_model(tenant_id, client_id, name):
             True,
             None,
         ),
+        # test user_groups_claim
+        (
+            "30",
+            {"allow_all": True, "manage_groups": True},
+            True,
+            None,
+        ),
+        (
+            "31",
+            {
+                "allow_all": True,
+                "manage_groups": True,
+                "user_groups_claim": "grp",
+            },
+            True,
+            None,
+        ),
     ],
 )
 async def test_azuread(
@@ -119,6 +148,12 @@ async def test_azuread(
     c.AzureAdOAuthenticator.client_id = str(uuid.uuid1())
     c.AzureAdOAuthenticator.client_secret = str(uuid.uuid1())
     authenticator = AzureAdOAuthenticator(config=c)
+    manage_groups = False
+    if "manage_groups" in class_config:
+        if hasattr(authenticator, "manage_groups"):
+            manage_groups = authenticator.manage_groups
+        else:
+            pytest.skip("manage_groups requires jupyterhub 2.2")
 
     handled_user_model = user_model(
         tenant_id=authenticator.tenant_id,
@@ -130,7 +165,10 @@ async def test_azuread(
 
     if expect_allowed:
         assert auth_model
-        assert set(auth_model) == {"name", "admin", "auth_state"}
+        expected_keys = {"name", "admin", "auth_state"}
+        if manage_groups:
+            expected_keys.add("groups")
+        assert set(auth_model) == expected_keys
         assert auth_model["admin"] == expect_admin
         auth_state = auth_model["auth_state"]
         assert json.dumps(auth_state)
@@ -138,6 +176,9 @@ async def test_azuread(
         user_info = auth_state[authenticator.user_auth_state_key]
         assert user_info["aud"] == authenticator.client_id
         assert auth_model["name"] == user_info[authenticator.username_claim]
+        if manage_groups:
+            groups = auth_model['groups']
+            assert groups == user_info[authenticator.user_groups_claim]
     else:
         assert auth_model == None
 

{oauthenticator-16.2.0 → oauthenticator-16.3.0}/oauthenticator/tests/test_cilogon.py

@@ -636,6 +636,7 @@ async def test_allowed_idps_username_derivation_actions(cilogon_client):
     c.CILogonOAuthenticator.allow_all = True
     c.CILogonOAuthenticator.allowed_idps = {
         'https://strip-idp-domain.example.com/login/oauth/authorize': {
+            'default': True,
             'username_derivation': {
                 'username_claim': 'email',
                 'action': 'strip_idp_domain',

{oauthenticator-16.2.0 → oauthenticator-16.3.0}/oauthenticator/tests/test_generic.py

@@ -1,23 +1,33 @@
 import json
 from functools import partial
 
+import jwt
 from pytest import fixture, mark
 from traitlets.config import Config
 
 from ..generic import GenericOAuthenticator
 from .mocks import setup_oauth_mock
 
+client_id = "jupyterhub-oauth-client"
+
 
 def user_model(username, **kwargs):
     """Return a user model"""
     return {
         "username": username,
+        "aud": client_id,
+        "sub": "oauth2|cilogon|http://cilogon.org/servera/users/43431",
         "scope": "basic",
         "groups": ["group1"],
         **kwargs,
     }
 
 
+@fixture(params=["id_token", "userdata_url"])
+def userdata_from_id_token(request):
+    return request.param == "id_token"
+
+
 @fixture
 def generic_client(client):
     setup_oauth_mock(
@@ -29,10 +39,31 @@ def generic_client(client):
     return client
 
 
+@fixture
+def generic_client_variant(client, userdata_from_id_token):
+    setup_oauth_mock(
+        client,
+        host='generic.horse',
+        access_token_path='/oauth/access_token',
+        user_path='/oauth/userinfo',
+    )
+    return client
+
+
 def _get_authenticator(**kwargs):
     return GenericOAuthenticator(
         token_url='https://generic.horse/oauth/access_token',
         userdata_url='https://generic.horse/oauth/userinfo',
+        client_id=client_id,
+        **kwargs,
+    )
+
+
+def _get_authenticator_for_id_token(**kwargs):
+    return GenericOAuthenticator(
+        token_url='https://generic.horse/oauth/access_token',
+        userdata_from_id_token=True,
+        client_id=client_id,
         **kwargs,
     )
 
@@ -45,6 +76,21 @@ def get_authenticator(generic_client):
     return partial(_get_authenticator, http_client=generic_client)
 
 
+@fixture
+def get_authenticator_variant(generic_client, userdata_from_id_token):
+    """
+    http_client can't be configured, only passed as argument to the constructor.
+    """
+    return partial(
+        (
+            _get_authenticator_for_id_token
+            if userdata_from_id_token
+            else _get_authenticator
+        ),
+        http_client=generic_client,
+    )
+
+
 @mark.parametrize(
     "test_variation_id,class_config,expect_allowed,expect_admin",
     [
@@ -151,29 +197,47 @@ def get_authenticator(generic_client):
             False,
             False,
         ),
+        (
+            "20",
+            {
+                "manage_groups": True,
+                "allow_all": True,
+            },
+            True,
+            None,
+        ),
     ],
 )
 async def test_generic(
-    get_authenticator,
-    generic_client,
+    get_authenticator_variant,
+    generic_client_variant,
     test_variation_id,
     class_config,
     expect_allowed,
     expect_admin,
+    userdata_from_id_token,
 ):
     print(f"Running test variation id {test_variation_id}")
     c = Config()
     c.GenericOAuthenticator = Config(class_config)
     c.GenericOAuthenticator.username_claim = "username"
-    authenticator = get_authenticator(config=c)
+    authenticator = get_authenticator_variant(config=c)
+    manage_groups = False
+    if "manage_groups" in class_config:
+        manage_groups = authenticator.manage_groups
 
     handled_user_model = user_model("user1")
-    handler = generic_client.handler_for_user(handled_user_model)
+    if userdata_from_id_token:
+        handled_user_model = dict(id_token=jwt.encode(handled_user_model, key="foo"))
+    handler = generic_client_variant.handler_for_user(handled_user_model)
     auth_model = await authenticator.get_authenticated_user(handler, None)
 
     if expect_allowed:
         assert auth_model
-        assert set(auth_model) == {"name", "admin", "auth_state"}
+        expected_keys = {"name", "admin", "auth_state"}
+        if manage_groups:
+            expected_keys.add("groups")
+        assert set(auth_model) == expected_keys
         assert auth_model["admin"] == expect_admin
         auth_state = auth_model["auth_state"]
         assert json.dumps(auth_state)
@@ -183,10 +247,39 @@ async def test_generic(
         assert "scope" in auth_state
         user_info = auth_state[authenticator.user_auth_state_key]
         assert auth_model["name"] == user_info[authenticator.username_claim]
+        if manage_groups:
+            assert auth_model["groups"] == user_info[authenticator.claim_groups_key]
+
     else:
         assert auth_model == None
 
 
+async def test_username_claim_callable(
+    get_authenticator,
+    generic_client,
+):
+    c = Config()
+    c.GenericOAuthenticator = Config()
+
+    def username_claim(user_info):
+        username = user_info["sub"]
+        if username.startswith("oauth2|cilogon"):
+            cilogon_sub = username.rsplit("|", 1)[-1]
+            cilogon_sub_parts = cilogon_sub.split("/")
+            username = f"oauth2|cilogon|{cilogon_sub_parts[3]}|{cilogon_sub_parts[5]}"
+        return username
+
+    c.GenericOAuthenticator.username_claim = username_claim
+    c.GenericOAuthenticator.allow_all = True
+    authenticator = get_authenticator(config=c)
+
+    handled_user_model = user_model("user1")
+    handler = generic_client.handler_for_user(handled_user_model)
+    auth_model = await authenticator.get_authenticated_user(handler, None)
+
+    assert auth_model["name"] == "oauth2|cilogon|servera|43431"
+
+
 async def test_generic_data(get_authenticator, generic_client):
     c = Config()
     c.GenericOAuthenticator.allow_all = True

{oauthenticator-16.2.0 → oauthenticator-16.3.0}/oauthenticator/tests/test_google.py

@@ -5,22 +5,23 @@ import re
 from unittest import mock
 
 from pytest import fixture, mark, raises
-from tornado.web import HTTPError
 from traitlets.config import Config
 
 from ..google import GoogleOAuthenticator
 from .mocks import setup_oauth_mock
 
 
-def user_model(email, username="user1"):
+def user_model(email, username="user1", hd=None):
     """Return a user model"""
-    return {
+    model = {
         'sub': hashlib.md5(email.encode()).hexdigest(),
         'email': email,
         'custom': username,
-        'hd': email.split('@')[1],
         'verified_email': True,
     }
+    if hd:
+        model['hd'] = hd
+    return model
 
 
 @fixture
@@ -187,37 +188,49 @@ async def test_google(
         assert auth_model == None
 
 
-async def test_hosted_domain_single_entry(google_client):
+@mark.parametrize(
+    "test_variation_id,user_email,user_hd,expect_username,expect_allowed,expect_admin",
+    [
+        ("01", "user1@ok-hd.orG", "ok-hd.org", "user1", True, True),
+        ("02", "user2@ok-hd.orG", "ok-hd.org", "user2", True, None),
+        ("03", "blocked@ok-hd.org", "ok-hd.org", None, False, None),
+        ("04", "user2@ok-hd.org", "", None, False, None),
+        ("05", "user1@not-ok.org", "", None, False, None),
+        # Test variation 06 below isn't believed to be possible, but since we
+        # aren't sure this test clarifies what we expect to happen.
+        ("06", "user1@other.org", "ok-hd.org", "user1@other.org", True, None),
+    ],
+)
+async def test_hosted_domain_single_entry(
+    google_client,
+    test_variation_id,
+    user_email,
+    user_hd,
+    expect_username,
+    expect_allowed,
+    expect_admin,
+):
     """
     Tests that sign in is restricted to the listed domain and that the username
     represents the part before the `@domain.com` as expected when hosted_domain
     contains a single entry.
     """
     c = Config()
-    c.GoogleOAuthenticator.hosted_domain = ["In-Hosted-Domain.com"]
+    c.GoogleOAuthenticator.hosted_domain = ["ok-hd.org"]
     c.GoogleOAuthenticator.admin_users = {"user1"}
-    c.GoogleOAuthenticator.allowed_users = {"user2"}
+    c.GoogleOAuthenticator.allowed_users = {"user2", "blocked", "user1@other.org"}
+    c.GoogleOAuthenticator.blocked_users = {"blocked"}
     authenticator = GoogleOAuthenticator(config=c)
 
-    handled_user_model = user_model("user1@iN-hosteD-domaiN.com")
+    handled_user_model = user_model(user_email, hd=user_hd)
     handler = google_client.handler_for_user(handled_user_model)
     auth_model = await authenticator.get_authenticated_user(handler, None)
-    assert auth_model
-    assert auth_model["name"] == "user1"
-    assert auth_model["admin"] == True
-
-    handled_user_model = user_model("user2@iN-hosteD-domaiN.com")
-    handler = google_client.handler_for_user(handled_user_model)
-    auth_model = await authenticator.get_authenticated_user(handler, None)
-    assert auth_model
-    assert auth_model["name"] == "user2"
-    assert auth_model["admin"] == None
-
-    handled_user_model = user_model("user1@not-in-hosted-domain.com")
-    handler = google_client.handler_for_user(handled_user_model)
-    with raises(HTTPError) as exc:
-        await authenticator.get_authenticated_user(handler, None)
-    assert exc.value.status_code == 403
+    if expect_allowed:
+        assert auth_model
+        assert auth_model["name"] == expect_username
+        assert auth_model["admin"] == expect_admin
+    else:
+        assert auth_model == None
 
 
 @mark.parametrize(
@@ -235,7 +248,27 @@ async def test_check_allowed_no_auth_state(google_client, name, allowed):
     assert await authenticator.check_allowed(name, None)
 
 
-async def test_hosted_domain_multiple_entries(google_client):
+@mark.parametrize(
+    "test_variation_id,user_email,user_hd,expect_username,expect_allowed",
+    [
+        ("01", "user1@ok-hd1.orG", "ok-hd1.org", "user1@ok-hd1.org", True),
+        ("02", "user2@ok-hd2.orG", "ok-hd2.org", "user2@ok-hd2.org", True),
+        ("03", "blocked@ok-hd1.org", "ok-hd1.org", None, False),
+        ("04", "user3@ok-hd1.org", "", None, False),
+        ("05", "user1@not-ok.org", "", None, False),
+        # Test variation 06 below isn't believed to be possible, but since we
+        # aren't sure this test clarifies what we expect to happen.
+        ("06", "user1@other.org", "ok-hd1.org", "user1@other.org", True),
+    ],
+)
+async def test_hosted_domain_multiple_entries(
+    google_client,
+    test_variation_id,
+    user_email,
+    user_hd,
+    expect_username,
+    expect_allowed,
+):
     """
     Tests that sign in is restricted to the listed domains and that the username
     represents the full email as expected when hosted_domain contains multiple
@@ -243,29 +276,21 @@ async def test_hosted_domain_multiple_entries(google_client):
     """
     c = Config()
     c.GoogleOAuthenticator.hosted_domain = [
-        "In-Hosted-Domain1.com",
-        "In-Hosted-Domain2.com",
+        "ok-hd1.org",
+        "ok-hd2.ORG",
     ]
+    c.GoogleOAuthenticator.blocked_users = ["blocked@ok-hd1.org"]
     c.GoogleOAuthenticator.allow_all = True
     authenticator = GoogleOAuthenticator(config=c)
 
-    handled_user_model = user_model("user1@iN-hosteD-domaiN1.com")
+    handled_user_model = user_model(user_email, hd=user_hd)
     handler = google_client.handler_for_user(handled_user_model)
     auth_model = await authenticator.get_authenticated_user(handler, None)
-    assert auth_model
-    assert auth_model["name"] == "user1@in-hosted-domain1.com"
-
-    handled_user_model = user_model("user2@iN-hosteD-domaiN2.com")
-    handler = google_client.handler_for_user(handled_user_model)
-    auth_model = await authenticator.get_authenticated_user(handler, None)
-    assert auth_model
-    assert auth_model["name"] == "user2@in-hosted-domain2.com"
-
-    handled_user_model = user_model("user1@not-in-hosted-domain.com")
-    handler = google_client.handler_for_user(handled_user_model)
-    with raises(HTTPError) as exc:
-        await authenticator.get_authenticated_user(handler, None)
-    assert exc.value.status_code == 403
+    if expect_allowed:
+        assert auth_model
+        assert auth_model["name"] == expect_username
+    else:
+        assert auth_model == None
 
 
 @mark.parametrize(

{oauthenticator-16.2.0 → oauthenticator-16.3.0/oauthenticator.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: oauthenticator
-Version: 16.2.0
+Version: 16.3.0
 Summary: OAuthenticator: Authenticate JupyterHub users with common OAuth providers
 Home-page: https://jupyter.org
 Author: Jupyter Development Team
@@ -19,13 +19,12 @@ Requires-Python: >=3.8
 Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: jsonschema
-Requires-Dist: jupyterhub>=1.2
+Requires-Dist: jupyterhub>=2.2
+Requires-Dist: pyjwt>=2
 Requires-Dist: requests
 Requires-Dist: ruamel.yaml
 Requires-Dist: tornado
 Requires-Dist: traitlets
-Provides-Extra: azuread
-Requires-Dist: pyjwt>=2; extra == "azuread"
 Provides-Extra: googlegroups
 Requires-Dist: google-api-python-client; extra == "googlegroups"
 Requires-Dist: google-auth-oauthlib; extra == "googlegroups"
@@ -33,10 +32,9 @@ Provides-Extra: mediawiki
 Requires-Dist: mwoauth>=0.3.8; extra == "mediawiki"
 Provides-Extra: test
 Requires-Dist: pytest>=2.8; extra == "test"
-Requires-Dist: pytest-asyncio; extra == "test"
+Requires-Dist: pytest-asyncio<0.23,>=0.17; extra == "test"
 Requires-Dist: pytest-cov; extra == "test"
 Requires-Dist: requests-mock; extra == "test"
-Requires-Dist: pyjwt>=2; extra == "test"
 Requires-Dist: google-api-python-client; extra == "test"
 Requires-Dist: google-auth-oauthlib; extra == "test"
 Requires-Dist: mwoauth>=0.3.8; extra == "test"

{oauthenticator-16.2.0 → oauthenticator-16.3.0}/oauthenticator.egg-info/requires.txt

@@ -1,13 +1,11 @@
 jsonschema
-jupyterhub>=1.2
+jupyterhub>=2.2
+pyjwt>=2
 requests
 ruamel.yaml
 tornado
 traitlets
 
-[azuread]
-pyjwt>=2
-
 [googlegroups]
 google-api-python-client
 google-auth-oauthlib
@@ -17,10 +15,9 @@ mwoauth>=0.3.8
 
 [test]
 pytest>=2.8
-pytest-asyncio
+pytest-asyncio<0.23,>=0.17
 pytest-cov
 requests-mock
-pyjwt>=2
 google-api-python-client
 google-auth-oauthlib
 mwoauth>=0.3.8

{oauthenticator-16.2.0 → oauthenticator-16.3.0}/pyproject.toml

@@ -64,7 +64,7 @@ omit = [
 github_url = "https://github.com/jupyterhub/oauthenticator"
 
 [tool.tbump.version]
-current = "16.2.0"
+current = "16.3.0"
 regex = '''
     (?P<major>\d+)
     \.

{oauthenticator-16.2.0 → oauthenticator-16.3.0}/requirements.txt

@@ -1,6 +1,9 @@
 # jsonschema is used for validating authenticator configurations
 jsonschema
-jupyterhub>=1.2
+jupyterhub>=2.2
+# PyJWT is used for parsing id tokens
+# and azuread
+pyjwt>=2
 # requests is already required by JupyterHub, but explicitly ask for it since we use it
 requests
 # ruamel.yaml is used to read and write .yaml files.

{oauthenticator-16.2.0 → oauthenticator-16.3.0}/setup.py

@@ -27,7 +27,7 @@ class bdist_egg_disabled(bdist_egg):
 setup_args = dict(
     name='oauthenticator',
     packages=find_packages(),
-    version="16.2.0",
+    version="16.3.0",
     description="OAuthenticator: Authenticate JupyterHub users with common OAuth providers",
     long_description=open("README.md").read(),
     long_description_content_type="text/markdown",
@@ -88,8 +88,6 @@ with open('requirements.txt') as f:
 
 
 setup_args['extras_require'] = {
-    # azuread is required for use of AzureADOAuthenticator
-    'azuread': ['pyjwt>=2'],
     # googlegroups is required for use of GoogleOAuthenticator configured with
     # either admin_google_groups and/or allowed_google_groups.
     'googlegroups': [
@@ -102,11 +100,10 @@ setup_args['extras_require'] = {
     # dependencies above.
     'test': [
         'pytest>=2.8',
-        'pytest-asyncio',
+        # FIXME: unpin pytest-asyncio
+        'pytest-asyncio>=0.17,<0.23',
         'pytest-cov',
         'requests-mock',
-        # dependencies from azuread:
-        'pyjwt>=2',
         # dependencies from googlegroups:
         'google-api-python-client',
         'google-auth-oauthlib',