JupyterHub“400：cookie 中缺少错误请求 OAuth 状态”通用身份验证

Question

我正在尝试在 OpenStack 上的 NGINX 反向代理后面部署 jupyterhub 服务，并使用通用身份验证类对来自外部 OIDC 提供程序的用户进行身份验证。从身份验证服务器重定向后，我收到“400：cookie 中缺少错误请求 OAuth 状态”错误消息。这是我的 jupyterhub_config.py 内容：

c = get_config()
import os
# use Generic OAuthenticator for local users
from oauthenticator.generic import GenericOAuthenticator

c.Application.log_level = 'DEBUG'

c.JupyterHub.authenticator_class = GenericOAuthenticator
c.GenericOAuthenticator.client_id =  os.environ['IAM_CLIENT_ID']
c.GenericOAuthenticator.client_secret = os.environ['IAM_CLIENT_SECRET']
c.GenericOAuthenticator.token_url = os.environ['OAUTH2_TOKEN_URL']
c.GenericOAuthenticator.userdata_url = 'https://iam-escape.cloud.cnaf.infn.it/userinfo'
c.GenericOAuthenticator.authorize_url = os.environ['OAUTH2_AUTHORIZE_URL']
#c.OAuthenticator.tls_verify = False
c.GenericOAuthenticator.userdata_method = 'GET'
c.GenericOAuthenticator.userdata_params = {'state': 'state'}
c.GenericOAuthenticator.username_key = "preferred_username"
c.GenericOAuthenticator.login_service = 'ESCAPE IAM'
c.GenericOAuthenticator.scope = ['openid', 'profile']
c.GenericOAuthenticator.oauth_callback_url = os.environ['OAUTH_CALLBACK_URL']
#************** Port and IP settings
# the hostname/ip that should be used to connect to the hub
# this is usually the hub container's name
#*************Spawner settings
# pick a docker image. This should have the same version of jupyterhub
# in it as our Hub.
# launch with docker
c.JupyterHub.spawner_class = 'jhub.SwarmSpawner'
c.JupyterHub.hub_ip = '0.0.0.0'
c.JupyterHub.bind_url = 'http://jhub:8000'
#Introduce the name of the jupyterhub service is given in docker-compose to the jupyterhub
c.SwarmSpawner.jupyterhub_service_name = 'jhub'
#Introduce the defined network given in the compose file to the jupyterhub
c.SwarmSpawner.networks = ["jhub_net"]

# Available docker images the user can spawn
c.SwarmSpawner.images = [
    {'image': 'jupyter/scipy-notebook:latest',
     'name': 'scipy notebook',
     'placement': {'constraints': ['node.hostname==r3b-notebook']}},
    }
]

c.SwarmSpawner.spawn_timeout = 60
# Before the user can select which image to spawn,user_options has to be enabled
c.SwarmSpawner.use_user_options = True
c.JupyterHub.shutdown_on_logout = True
# debug-logging for testing
import logging
c.JupyterHub.log_level = logging.DEBUG

和我的 nginx 配置文件：

user www-data;
worker_processes auto;
pid /run/nginx.pid;
include /etc/nginx/modules-enabled/*.conf;

events {
    worker_connections 1024;
}

http {

    map $http_upgrade $connection_upgrade {
        default upgrade;
        ''      close;
    }

         server {
            listen 80 ssl;
            server_name HUB.DOMAIN.TLD;
#           ssl on;
            ssl_certificate /etc/nginx/ssl/myssl.crt;
            ssl_certificate_key /etc/nginx/ssl/myssl.key;

            ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
            ssl_prefer_server_ciphers on;
            ssl_session_cache shared:SSL:50m;
            ssl_session_timeout 1d;
            ssl_stapling on;
            ssl_stapling_verify on;
            add_header Strict-Transport-Security max-age=15768000;
            resolver_timeout 5s;

            # Expose logs to "docker logs".
            # See https://github.com/nginxinc/docker-nginx/blob/master/Dockerfile#L12-L14
            access_log /var/log/nginx/access.log;
            error_log /var/log/nginx/error.log;

            location / {
            proxy_pass       http://jhub:8000;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header Host $host:$server_port;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
#
            proxy_http_version    1.1;
            proxy_set_header      Upgrade $http_upgrade;
            proxy_set_header      Connection $connection_upgrade;
            proxy_set_header X-Scheme $scheme;
            proxy_buffering off;
            }
        }

}

浏览器中的错误信息如下：

HTTP/1.1 400 Bad Request
Server: nginx/1.19.6
Date: Thu, 16 Sep 2021 12:54:51 GMT
Content-Type: text/html
Content-Length: 4365
Connection: keep-alive
x-jupyterhub-version: 1.2.1
access-control-allow-headers: accept, content-type, authorization
content-security-policy: frame-ancestors 'self'; report-uri /hub/security/csp-report
set-cookie: oauthenticator-state=""; expires=Wed, 16 Sep 2020 12:54:51 GMT; Path=/

还有一堆警告：

Cookie “oauthenticator-state” will be soon rejected because it has the “SameSite” attribute set to “None” or an invalid value, without the “secure” attribute. To know more about the “SameSite“ attribute, read https://developer.mozilla.org/docs/Web/HTTP/Headers/Set-Cookie/SameSite oauth_callback
Cookie “oauthenticator-state” has been rejected because it is already expired. oauth_callback
Strict-Transport-Security: The connection to the site is untrustworthy, so the specified header was ignored.
style.min.css
This page uses the non standard property “zoom”. Consider using calc() in the relevant property values, or using “transform” along with “transform-origin: 0 0”. oauth_callback
Strict-Transport-Security: The connection to the site is untrustworthy, so the specified header was ignored.
bootstrap.min.js
Strict-Transport-Security: The connection to the site is untrustworthy, so the specified header was ignored.
require.js
Strict-Transport-Security: The connection to the site is untrustworthy, so the specified header was ignored.
jquery.min.js
Strict-Transport-Security: The connection to the site is untrustworthy, so the specified header was ignored.
favicon.ico

我正在使用 Jupyterhub 版本 1.2.1 和 nginx 1.19.6，所有服务都在 Docker 容器中以 Swarm 模式运行。但是，我尝试了最简单的方案，只有一个没有 nginx 代理和 docker spawner 的 jupyterhub，问题仍然存在。对于如何解决此问题以找到解决方案，我将不胜感激。

Answer 1

您可能已经找到了解决方案，但是 c.GenericOAuthenticator.enable_auth_state = True 应该做的工作。 供参考：JupyterHub OAuth state