jupyterhub / jupyterhub/nativeauthenticator

import_from_firstuse not working: Previous users cannot log in or create an account.

Open
#219 1 comment 0 reactions 0 assignees View on GitHub
bug
Dominant language
Python
Stars
81
Forks
68
PR merge metrics
No merged PRs in 30d

Description

### Bug description

After setting _c.NativeAuthenticator.import_from_firstuse = True_ and reloading the configuration, the users from _firstuse_dbm_path_ do get added to the new database, but they cannot log in or create a new account.

This is because the hashed password from _firstuse_dbm_path_ is passed to the user creation function as if it were a normal password, leading to a different hash.
The user then exists in the new database, preventing them from signing up with the same name.
And they cannot sign in because their old password will not match the new hash.

#### Expected behaviour

All users would be transferred with the same username and password and are able to sign in without having to sign up first.

#### Actual behaviour

They cannot log in or create a new account with the same username.

### How to reproduce

1. Set up _tljh_ with an admin user and password (randomly chosen here):
```
curl -L https://tljh.jupyter.org/bootstrap.py \
| sudo python3 - \
--admin the_admin:PUYLjBrI5q
```
2. Create the file _/opt/tljh/config/jupyterhub_config.d/native_auth.py_ with:
```
c.JupyterHub.authenticator_class = 'nativeauthenticator.NativeAuthenticator'
c.Authenticator.admin_users = {'the_admin'}
c.NativeAuthenticator.enable_signup = True
c.NativeAuthenticator.import_from_firstuse = True
```
3. Reload the hub:
`sudo tljh-config reload`
4. Try to log in as _the_admin_ with password _PUYLjBrI5q_ or create a new user named _the_admin_.

### Your personal set up

Tested on the-littlest-jupyterhub.

- OS:
Ubuntu 22.04.1 LTS
- Version(s):
JupyterHub version 1.5.0, python 3.10

Full environment

```
# paste output of `pip freeze` or `conda list` here
```

Configuration

```python
# jupyterhub_config.py
"""
JupyterHub config for the littlest jupyterhub.
"""

from glob import glob
import os

from tljh import configurer
from tljh.config import INSTALL_PREFIX, USER_ENV_PREFIX, CONFIG_DIR
from tljh.utils import get_plugin_manager
from tljh.user_creating_spawner import UserCreatingSpawner
from jupyterhub_traefik_proxy import TraefikTomlProxy

c.JupyterHub.spawner_class = UserCreatingSpawner

# leave users running when the Hub restarts
c.JupyterHub.cleanup_servers = False

# Use a high port so users can try this on machines with a JupyterHub already present
c.JupyterHub.hub_port = 15001

c.TraefikTomlProxy.should_start = False

dynamic_conf_file_path = os.path.join(INSTALL_PREFIX, "state", "rules", "rules.toml")
c.TraefikTomlProxy.toml_dynamic_config_file = dynamic_conf_file_path
c.JupyterHub.proxy_class = TraefikTomlProxy

c.SystemdSpawner.extra_paths = [os.path.join(USER_ENV_PREFIX, "bin")]
c.SystemdSpawner.default_shell = "/bin/bash"
# Drop the '-singleuser' suffix present in the default template
c.SystemdSpawner.unit_name_template = "jupyter-{USERNAME}"

tljh_config = configurer.load_config()
configurer.apply_config(tljh_config, c)

# Let TLJH hooks modify `c` if they want

# Call our custom configuration plugin
pm = get_plugin_manager()
pm.hook.tljh_custom_jupyterhub_config(c=c)

# Load arbitrary .py config files if they exist.
# This is our escape hatch
extra_configs = sorted(glob(os.path.join(CONFIG_DIR, "jupyterhub_config.d", "*.py")))
for ec in extra_configs:
load_subconfig(ec)
```

Logs

```
# paste relevant logs here, if any
```

Contributor guide

Open the contributing guide

Research direction

Start by tracing NativeAuthenticator.import_from_firstuse from configuration reload into the user-creation path, then reproduce the documented TLJH setup with the example credentials. Done means imported users can log in with their existing password and are not incorrectly treated as new signups; add or update regression coverage for this path if the repository provides it.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
authentication
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.