Changelog#
For detailed changes from the prior release, click on the version number, and
its link will bring up a GitHub listing of changes. Use git log
on the
command line for details.
Unreleased#
15.0#
15.1.0 - 2022-09-08#
New features added#
[CILogon] Add allowed_domains to allowed_idps config for a possiblity to restrict access based on idp + domain #518 (@GeorgianaElena)
Enhancements made#
Documentation improvements#
Update documentation theme and fix autodoc #524 (@GeorgianaElena)
Contributors to this release#
(GitHub contributors page for this release)
@consideRatio | @dingobar | @drhagen | @GeorgianaElena | @manics | @minrk | @terrencegf | @yuvipanda
15.0.1#
Bugs fixed#
[Bitbucket] Fix for changes to bitbucket API - /teams removed and /workspaces to be used #477 (@Marcalberga)
[CILogon] Don’t make action a required field of CILogonOAuthenticator.allowed_idps follow-up #517 (@GeorgianaElena)
[CILogon] Don’t make action a required field of CILogonOAuthenticator.allowed_idps #516 (@GeorgianaElena)
Contributors to this release#
15.0.0#
If you are using AzureAD, MediaWiki, and CILogon authenticators, make sure to read about the breaking changes.
Breaking security change#
CILogonOAuthenticator
has breaking changes and come with a migration guide. These changes resolve the known vulnerability GHSA-r7v4-jwx9-wx43. Your hub will fail to start if you do not follow the migration guide.
Other breaking changes#
pyjwt
version 2.4.0 or greater is now required when use with authentication classes that needs it:AzureAdOAuthenticator
,MWOAuthenticator
.
New features added#
[GitHub] Add populate_teams_in_auth_state option #498 (@yuvipanda, @consideRatio, @GeorgianaElena, @manics)
Enhancements made#
Allow and document custom 403 messages and pages #484 (@GeorgianaElena, @yuvipanda)
Bugs fixed#
[GitHub] fix implementation of populate_teams_in_auth_state #504 (@consideRatio, @yuvipanda)
[Auth0] Fix AUTH0_SUBDOMAIN default setting #502 (@alejandrosame, @yuvipanda)
Maintenance and upkeep improvements#
maint: unpin extras_require googlegroups dependencies #508 (@consideRatio, @missingcharacter)
breaking maint: require pyjwt>=2 and mwoauth>=0.3.8 (to reduce complexity) #506 (@consideRatio, @yuvipanda, @GeorgianaElena, @halfak)
Use isort for import formatting #497 (@yuvipanda, @consideRatio)
General maintenance and fix of pre-commit ci failure #479 (@consideRatio, @minrk, @GeorgianaElena)
Remove custom stylesheet and bump sphinx version #465 (@diego-plan9, @consideRatio)
Support pyjwt >= 2 in tests #461 (@diego-plan9, @minrk, @consideRatio)
Documentation improvements#
docs/ci: use myst, fix broken links, add linkcheck test, remove deprecated distutils, avoid 2x job triggers #511 (@consideRatio, @GeorgianaElena)
docs/source/getting-started: mention openid scope for AzureAD + MFA #478 (@rkdarst, @consideRatio)
Fix My Service authenticator class names in documentation #457 (@sgaist, @consideRatio)
Contributors to this release#
(GitHub contributors page for this release)
@alejandrosame | @brianaydemir | @consideRatio | @diego-plan9 | @GeorgianaElena | @halfak | @kkaraivanov1 | @manics | @minrk | @missingcharacter | @rkdarst | @sgaist | @yuvipanda
14.2#
14.2.0 - 2021-08-09#
Enhancements made#
[GitHub] Add syntax to allow specific teams in a GitHub organization #449 (@j0nnyr0berts)
Contributors to this release#
(GitHub contributors page for this release)
@consideRatio | @dhirschfeld | @j0nnyr0berts | @jabbera | @manics | @sgibson91
14.1#
14.1.0 - 2021-07-19#
New features added#
[Globus] Add config to manage: allowed, admin, and blocked users through Globus groups #441 (@rpwagner)
[Auth0] Add config username_key - maps identity providers response to a JH username #439 (@GeorgianaElena)
[All] Support custom logout url (logout_redirect_url) #437 (@GeorgianaElena)
Bugs fixed#
Maintenance and upkeep improvements#
pre-commit configured and executed #434 (@consideRatio)
ci: unpin pyjwt in test-requirements.txt #431 (@consideRatio)
Documentation improvements#
docs: update to async/await in example #435 (@consideRatio)
Add reference to external FeiShuAuthenticator #427 (@harrywang)
Note that whitelist should be used if not in 1.2 #422 (@mafloh)
Contributors to this release#
(GitHub contributors page for this release)
@consideRatio | @GeorgianaElena | @harrywang | @holdenk | @mafloh | @manics | @minrk | @NickolausDS | @rpwagner | @satra | @wOvAN
14.0#
14.0.0 - 2021-04-09#
New features added#
Support username_claim in Google OAuth #401 (@dtaniwaki)
added allowed_groups and admin_groups to generic.py #395 (@mcmartins)
[Google] Allow for checking of google_groups for admin only #358 (@dwilliams782)
Enhancements made#
Bugs fixed#
Maintenance and upkeep improvements#
Test oldest dependencies and bump jupyterhub required to 1.2 #413 (@consideRatio)
[Generic] Remove userdata_method configuration supposedly not relevant #376 (@consideRatio)
Documentation improvements#
docs: cleanup userdata_method from docs #416 (@consideRatio)
allowed_project_ids is the valid name #409 (@manning-ncsa)
Contributors to this release#
(GitHub contributors page for this release)
@consideRatio | @dhirschfeld | @dtaniwaki | @dwilliams782 | @holdenk | @manics | @manning-ncsa | @mcmartins | @minrk | @support | @welcome | @wseaton
0.13#
0.13.0 - 2021-02-04#
Enhancements made#
Auth0: Add refresh and id tokens to auth_state #393 (@biomath-vlad)
Bugs fixed#
PyJWT 2.0 compliant #402 (@rragundez)
Contributors to this release#
(GitHub contributors page for this release)
@biomath-vlad | @consideRatio | @kianaf | @manics | @rragundez | @yuvipanda
0.12#
[0.12.3] - 2020-12-04#
Bugs fixed#
Fix exception when enable_auth_state is enabled but user.encrypted_auth_state is None #391 (@rkevin-arch)
Maintenance and upkeep improvements#
Contributors to this release#
0.12.2 - 2020-11-30#
Security fix for GHSA-384w-5v3f-q499: Deprecated c.Authenticator.whitelist
configuration was ignored instead of mapped to newer c.Authenticator.allowed_users
when used with JupyterHub 1.2 and OAuthenticator 0.12.0-0.12.1.
0.12.1 - 2020-11-20#
Bugs fixed#
Maintenance and upkeep improvements#
Remove support for python 3.5 #384 (@consideRatio)
CI: Stop testing py35 and don’t test on tagged commits #379 (@consideRatio)
Contributors to this release#
0.12.0 - 2020-10-26#
Enhancements made#
[OpenShift] Enable cert verification for self-signed certs and auto-load auth api URL #363 (@vpavlin)
[Globus] Support custom username handling #357 (@NickolausDS)
[Google] Adding refresh_token #350 (@missingcharacter)
[Google] Added optional support for google groups #341 (@missingcharacter)
[All] Added extra_authorize_params to pass extra params in the initial request to the identity provider #338 (@NickolausDS)
Bugs fixed#
[All] Let auth cookie be influenced by JupyterHub’s cookie_options configuration #378 (@Wh1isper)
[GitHub] Respect validate_server_cert attribute #354 (@nvs-abhilash)
[Generic] tls verify not being honored at the httprequest level when internal_ssl is enabled #326 (@sstarcher)
Maintenance and upkeep improvements#
Rename OAuthenticator.whitelist to allow #366 (@GeorgianaElena)
Python package extra dependencies updated #343 (@missingcharacter)
[Generic] Fix failing GenericOAuthenticator tests #339 (@GeorgianaElena)
[Globus] Remove the need for globus_sdk as a python dependency #337 (@NickolausDS)
Documentation improvements#
Add changelog for 0.12.0 release #377 (@consideRatio)
[Globus] Docs: explain identity_provider better #362 (@NickolausDS)
[OpenShift] Docs: fix broken link for OpenShift OAuth service accounts #352 (@nscozzaro)
Docs: Updating sphinx and pandas_sphinx_theme references #345 (@missingcharacter)
[Google] Added optional support for google groups #341 (@missingcharacter)
[Globus] Remove the need for globus_sdk as a python dependency #337 (@NickolausDS)
Update docs #336 (@GeorgianaElena)
Contributors to this release#
(GitHub contributors page for this release)
@ablekh | @akhmerov | @Analect | @arneki | @bellackn | @betatim | @CJCShadowsan | @cmseal | @consideRatio | @d0m84 | @daniel-ciocirlan | @dmpe | @dmvieira | @GeorgianaElena | @ghezalsherdil | @guimou | @gweis | @hardik42 | @hbuttguavus | @jamescross91 | @linkcd | @louis-she | @manics | @meeseeksmachine | @michec81 | @minrk | @missingcharacter | @mransley | @NickolausDS | @nscozzaro | @nvs-abhilash | @patback66 | @PaulMazzuca | @RAbraham | @sampathkethineedi | @saurav-bhagat | @shivan10 | @SolarisYan | @sstarcher | @support | @umar-sik | @vpavlin | @welcome | @Wh1isper | @willingc | @yuvipanda | @zhiyuli
0.11#
0.11.0 - 2020-01-30#
The main change in 0.11 is a refactoring of classes to remove mixins, reducing the amount of boilerplate needed. In addition, there are some fixes to the Azure AD Authenticator. This should be a fully backward-compatible change, except in cases where some subclasses were importing these now-unneeded mixin classes, such as GitHubLoginHandler, GitHubMixin, etc.
All options should now be configurable via the standard jupyterhub config file. There should no longer be any options that are only configurable via environment variable.
This release also removes the latest Authenticators added in 0.10
(AzureAdB2COAuthenticator, AWSCognitoOAuthenticator, YandexOAuthenticator),
which were released without being fully supported and
which can be achieved through configuration of existing classes,
such as AzureAd
and Generic
.
We don’t plan to accept further contributions of new providers if they can be achieved through customization or configuration of existing classes. Rather, contributors are encouraged to provide example documentation for using new providers, or pull requests addressing gaps necessary to do so with the GenericOAuthenticator.
Merged PRs#
Contributors to this release#
(GitHub contributors page for this release)
@consideRatio | @craigminihan | @Dmitry1987 | @manics | @minrk | @NickolausDS | @zevaryx
0.10#
0.10.0 - 2019-11-27#
New#
Add support for
GenericOAuthenticator.username_key
to hold a callable value #305 (@eslavich)Add
AzureAdOAuthenticator.username_claim
config field #280 (@jeff-sternberg)Add
AWSCognitoAuthenticator
#269 (@jmartinc89)
Fixed#
mediawiki: utf-8 > binary strings, req. mwoauth>=0.3.7 #297 (@consideRatio)
Fixed Globus Logout Handler, added test #288 (@NickolausDS)
Include inherited members in GitLab auth checks, requires GitLab 12.4 or newer, but will fall back to previous behavior for older GitLab versions. #283 (@vindvaki)
Maintenance#
Fixed content index in readme, and fixed typo in comments #310 (@linkcd)
Add scopes documentation to auth0 example #303 (@jbradenbrown)
Add py3.8 for CI testing #302 (@consideRatio)
Disable MediaWiki’s mwoauth==0.3.5 due to a regression #295 (@consideRatio)
Add RELEASE.md #294 (@consideRatio)
Add PyPI/Travis build badges to README.md #293 (@consideRatio)
Use traitlet.default for Azure AD tenant_id #282 (@jeff-sternberg)
Add clarifying comment into README code block #279 (@raethlein)
0.9#
0.9.0 - 2019-07-30#
switch to asyncio coroutines from tornado coroutines (requires Python 3.5)
add
GenericOAuthenticator.userdata_token_method
configurableadd
GenericOAuthenticator.basic_auth
configurablesupport for OpenShift 4.0 API changes
0.8#
0.8.2 - 2019-04-16#
Validate login URL redirects to avoid Open Redirect issues.
0.8.1 - 2019-02-28#
Provide better error messages
Allow auth scope to be array or strings
GitHubOAuthenticator
: More efficientorg_whitelist
checkUse pytest-asyncio instead of pytest-tornado
CILogon: New additional_username_claims config for linked identities, fallback to the primary username claim
GitLabOAuthenticator
: Newproject_id_whitelist
config to whitelist users who have Developer+ access to the projectGoogleOAuthenticator
: Allow email domains (hosted_domain
) to be a listAdd
jupyterhub-authenticator
entrypoints for jupyterhub 1.0.Cleanup & bugfixes
0.8.0 - 2018-08-10#
Add
azuread.AzureADOAuthenticator
Add
CILogonOAuthenticator.idp_whitelist
andCILogonOAuthenticator.strip_idp_domain
optionsAdd
GenericOAuthenticator.tls_verify
andGenericOAuthenticator.extra_params
optionsAdd refresh token and scope to generic oauthenticator auth state
Better error messages when GitHub oauth fails
Stop normalizing mediawiki usernames, which can be case-sensitive
Fixes for group-membership checks with GitLab
Bugfixes in various authenticators
Deprecate GITLAB_HOST in favor of GITLAB_URL, since we expect
https://
in the url, not just the host.
0.7#
0.7.3 - 2018-02-16#
0.7.3 is a security fix for CVE-2018-7206.
It fixes handling of gitlab_group_whitelist
when using GitLabOAuthenticator.
The same fix is backported to 0.6.2.
0.7.2 - 2017-10-27#
Fix CILogon OAuth 2 implementation. ePPN claim is used for default username (typically institutional email).
CILogonOAuthenticator.username_claim
can be used to change which field is used for JupyterHub usernames.GenericOAuthenticator.login_service
is now configurable.default to GitLab API version 4 and allow v3 via GITLAB_API_VERSION=3 environment variable.
Add
GlobusOAuthenticator.revoke_tokens_on_logout
andGlobusOAuthenticator.logout_redirect_url
config for further clearing of credentials on JupyterHub logout.
0.7.1 - 2017-10-04#
fix regression in 0.7.0 preventing authentication via providers other than GitHub, MediaWiki
0.7.0 - 2017-10-02#
0.7.0 adds significant new functionality to all authenticators.
CILogon now uses OAuth 2 instead of OAuth 1, to be more consistent with the rest.
All OAuthenticators support
auth_state
when used with JupyterHub 0.8. In every case, the auth_state is a dict with two keys:access_token
and the user-info reply identifying the user. For instance, GitHubOAuthenticator auth_state looks like:{ 'acces_token': 'abc123', 'github_user': { 'username': 'fake-user', 'email': 'fake@email.com', ... } }
auth_state can be passed to Spawners by defining a
.pre_spawn_start
method. See examples/auth_state for an example.All OAuthenticators have a
.scope
trait, which is a list of string scopes to request. See your OAuth provider’s documentation for what scopes you may want. This is useful in conjunction withauth_state
, which may be used to pass access tokens to Spawners via environment variables..scope
can control what permissions those tokens will have. In general, OAuthenticator default scopes should only have read-only access to identify users.GITHUB_HTTP environment variable can be used to talk to HTTP-only GitHub Enterprise deployments.
0.6#
0.6.2 - 2018-02-16#
0.6.2 is a security fix for CVE-2018-7206.
It fixes handling of gitlab_group_whitelist
when using GitLabOAuthenticator.
0.6.1 - 2017-08-11#
0.6.1 has bugfixes for new behaviors in 0.6.0
Use
.login_url
andnext_url
from JupyterHub if defined (JupyterHub 0.8)Fix empty login_url where final login redirect could be omitted
Fix mediawiki authenticator, which broke in 0.6.0
Encode state as base64 instead of JSON, for easier passing in URLs
0.6.0 - 2017-07-25#
Support for changes in upcoming JupyterHub 0.8
Refactor to share more code across providers
Deprecated GITHUB_CLIENT_ID and other provider-specific environment variables for common options. All OAuthenticators support the same OAUTH_CLIENT_ID, OAUTH_CLIENT_SECRET, and OAUTH_CALLBACK_URL environment variables.
New authenticators:
auth0
globus
okpy
openshift
generic - a generic implementation that can work with any OAuth2 provider
0.5#
0.5.1 - 2016-10-05#
Fixes in BitbucketOAuthenticator.check_whitelist
0.5.0 - 2016-09-02#
Add GitLabOAuthenticator
0.4#
0.4.1 - 2016-05-18#
Fix typo preventing Google OAuth from working in 0.4.0
0.4.0 - 2016-05-11#
Enable username normalization (for mixed-case names on GitHub, requires JupyterHub 0.5). This removes
GitHubOAuthenticator.username_map
introduced in 0.3, because the oauth2 Authenticator has.username_map
as of 0.5.
0.3 - 2016-04-20#
Add Google authenticator
Allow specifying OAuth scope
Add
GitHubOAuthenticator.username_map
for mapping GitHub usernames to system usernames.
0.2 - 2016-01-04#
Add mediawiki authenticator
0.1 - 2015-12-22#
First release