jupyterhub behind authenticating apache proxy

[Magnus Hagdorn]

Hi there,
I am looking into setting up a jupyterhub service for our school. We are currently in the process of upgrading our Linux machines to Scientific Linux 7. So, jupyterhub will run on those. To make life more interesting I would like to access jupyterhub through an authenticating reverse proxy (currently we are using apache 2.2). So far, I have installed jupyterhub from a recent git checkout, I am using the remote_user authenticator [1] and for now the single user spawner. The configurable_proxy is running locally on the jupyterhub machine. The apache reverse proxy uses mod_rewrite for proxying to the jupyterhub public interface.

Authentication works, I just access the correct page and the proxy sends to me to the jupyterhub backend which correctly identifies my username. I can browse my files, etc. I can start a new python 3 notebook. The singleuser process is started. However, I get a 400 error when jupyterhub tries to access the kernel.

Any suggestions how to tackle this issue?

Do I need to proxy the websockets as well?

Regards
magnus


[1] https://github.com/cwaldbieser/jhub_remote_user_authenticator

[MinRK]

Yes, you need to make sure that Apache proxies websockets, otherwise you won’t be able to connect to kernels, which use websockets.

This Stack Overflow answer appears to have some sample Apache configurations that should work.

-MinRK

Regards
magnus


[1] https://github.com/cwaldbieser/jhub_remote_user_authenticator

--
You received this message because you are subscribed to the Google Groups "Project Jupyter" group.
To unsubscribe from this group and stop receiving emails from it, send an email to jupyter+u...@googlegroups.com.
To post to this group, send email to jup...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/jupyter/df2b0e88-bd35-41af-8827-67951a025958%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

​

[Magnus Hagdorn]

ok, thanks. Will need to wait until we have sorted out managed apache v2.4 which seems to be next on the hit list.

[Carl Waldbieser]

Magnus,

If you don't mind me asking, what are you using as your authentication system?

Thanks,
Carl

[Ian Allison]

I realize that you didn't ask me :-) but we are doing something almost identical: Jupyterhub + Shibboleth + Apache 2.4. 

At the moment I'm trying to adapt jhub_remote_user_authenticator to get ahold of some of our shibboleth attributes, but I don't know exactly where to grab them from.

-Ian.

[Carl Waldbieser]

Shibboleth Native SP typically exports attributes into environment variables [1].  So you could access them in Apache, or more typically, in your application programming framework.  With python, that would be os.environ [2].

Thanks,
Carl

[1] https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPAttributeAccess#NativeSPAttributeAccess-EnvironmentVariables
[2] https://docs.python.org/3.5/library/os.html#os.environ

[Carl Waldbieser]

Though now that I think about it, since jupyterhub runs its own web server (tornado), you will probably have to pass the attributes from Shib SP to Jupyterhub using request headers [1].  You can use `self.request.headers.get()` in the request handler.

Thanks,
Carl

[1] https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPAttributeAccess#NativeSPAttributeAccess-RequestHeaders