JupyterHub default admin user and permissions

[Clare Sloggett]

Hi all,

I'm trying to diagnose a situation: I have two Ubuntu servers. On both I experimented a bit: I first tried running JupyterHub as root, then tried running it as ubuntu (with sudo). Because I'm pretty new to JupyterHub, I didn't configure admin users on either server. 

My understanding is that, without configuring admin users, the user who runs the jupyterhub process will be the only default admin user? So if I run it as root, there is effectively no usable JupyterHub admin account, but if I've run it as ubuntu, I should be able to log in as ubuntu and access the Admin part of the Control Panel.

The confusing bit is: on one of my servers, I see the Admin UI, and on the other I don't! That is, on the second server the blue Admin button isn't present, as if ubuntu is not an admin. The two servers are using identical jupyterhub config files and running identical commands. Both are currently running the process as ubuntu. All I can think of is that in my initial experimentation, I ran the process as root and maybe created a file somewhere that is still owned by root. I can't find such a file though (obvious candidates were jupyterhub_cookie_secret and jupyterhub.sqlite but they are both owned by ubuntu). Are there any other obvious pitfalls that could cause this?

I assume I could fix it by stopping the server and explicitly designating ubuntu as an admin user but I'd like to understand what's going on.

Thanks,

Clare

[MinRK]

It’s probably because you started it once as one user and then again as the other, with the same jupyterhub.sqlite. You are absolutely right that, by default, if you specify no admin users, the user running the server is added as an admin. The source of the confusion is probably that this will only happen once, because if it’s happened before, there will be at least one admin user, and it won’t happen again for the same Hub instance.

1. start jupyterhub as root, with no admin specified
2. jupyterhub noticed that there were no admin users, and made root an admin
3. start jupyterhub again as ubuntu (same jupyterhub.sqlite)
4. jupyterhub sees that root is an admin, which avoids the ‘uh-oh no admins’ event, so it does not add ubuntu to the admin user list

Deleting jupyterhub.sqlite or the root user from the database would result in ubuntu being made admin. You are also right, however, that the best way to address this is to make ubuntu an admin explicitly, rather than relying on the implicit at-least-one-admin behavior, with this config in jupyterhub_config.py:

c.Authenticator.admin_users = {'ubuntu'}

This should ensure that ubuntu is made admin on startup, regardless of what user you use to launch the process.

I’m thinking that perhaps better behavior is to remove the implicit-admin logic entirely, since it can be confusing like this, and instead require administrators to be added explicitly, warning on startup if no administrators are found (especially since the Hub actually works just fine with no admins).

Hope that helps,
-MinRK

Thanks,

Clare

--
You received this message because you are subscribed to the Google Groups "Project Jupyter" group.
To unsubscribe from this group and stop receiving emails from it, send an email to jupyter+u...@googlegroups.com.
To post to this group, send email to jup...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/jupyter/f92194d2-da1b-49c0-9e2e-17ab6d3c4c41%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

​

[MinRK]

The aforementioned change

[Clare Sloggett]

I see, thanks! I was concerned that this might be a sign I'd created some permissions issue that could catch me out later. But this is all sensible behaviour, so I will just configure the admin users.

You received this message because you are subscribed to a topic in the Google Groups "Project Jupyter" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/jupyter/iqWuPKUWw64/unsubscribe.
To unsubscribe from this group and all its topics, send an email to jupyter+u...@googlegroups.com.

To post to this group, send email to jup...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/jupyter/CAHNn8BWF%3DPNawcAnify7afJqUSvQKHCpJbNh%3DaiM9ZnU3ktRJw%40mail.gmail.com.