JupyterHub Azure OAuth issues

[MarcSkovMadsen]

panel==1.5.5

I'm trying to add azure oauth to my Panel application. I'm developing and testing in VS Code on my JupyterHub.

Setup

import panel as pn

pn.extension()

user = pn.state.user or "Guest User"

pn.panel(user).servable()

Without oauth, I would serve this via

panel serve script.py --index script

And I would be able to open the application at

https://my-domain/workspace/user/userid/vscode/proxy/5006/
and
https://my-domain/workspace/user/userid/vscode/proxy/5006/script

Azure OAuth works on my laptop

It works on my laptop served with:

panel serve script.py --index script --oauth-provider=azure --oauth-key='********-****-****-****-************' --oauth-secret='******************************' --cookie-secret='********************************' --oauth-encryption-key='********************************' --oauth-extra-params "{'tenant': '********-****-****-****-************'}"

Issues

Coming in separate posts below

[MarcSkovMadsen]

1. Does not use https without --oauth-redirect

If I try to serve oauth without --oauth-redirect, azure will complain about http (not https) url not valid.

AADSTS50011: The redirect URI 'http://<my-domain>' specified in the request does not match the redirect URIs configured for the application

panel serve script.py --index script --oauth-provider=azure --oauth-key='********-****-****-****-************' --oauth-secret='******************************' --cookie-secret='************************************' --oauth-encryption-key='************************************' --oauth-extra-params "{'tenant': '********-****-****-****-************'}"

I do believe Panel should have been providing a https url instead of a http one by default.
And my guess is that the redirect uri should not go to the domain alone but include the full path?

Investigating this I see

Don't know where the http is coming from? (I clicked the login on the logout page).

[MarcSkovMadsen]

2. Get 502 Bad Gateway when adding --oauth-redirect-uri

I

• add --oauth-redirect-uri=https://my-domain/workspace/user/userid/vscode/proxy/5006/
• open https://my-domain/workspace/user/userid/vscode/proxy/5006/
• see the browser redirecting to https://my-domain/workspace/user/userid/vscode/proxy/5006/login?next=%2F%3Fcode%3D1.AV0A...
• see 502 Bad Gateway

panel serve script.py --index script --oauth-provider=azure --oauth-key='********-****-****-****-************' --oauth-secret='******************************' --cookie-secret='************************************' --oauth-encryption-key='************************************' --oauth-extra-params "{'tenant': '********-****-****-****-************'}"
--oauth-redirect-uri=https://my-domain/workspace/user/userid/vscode/proxy/5006/

If I click enter in the url https://my-domain/workspace/user/userid/vscode/proxy/5006/login?next=%2F%3Fcode%3D1.AV0A... to reload then the page actually loads:

2025-01-05 16:28:36,043 ERROR: panel.auth - AzureAd OAuth provider returned a HTTP 400: Bad Request error. The full response was: {'error': 'invalid_grant', 'error_description': 'AADSTS54005: OAuth2 Authorization code was already redeemed, please retry with a new valid code or use an existing refresh token. Trace ID:....

When I open the logout endpoint it works without issues

I also tried adding --login-endpoint="signin" --logout-endpoint="signout" to see if the login part of the url is the problem. But I still got 502 error.

I'm now thinking that maybe the ?next=%2F part of the url could be the problem. That it is somehow picked up by nginx or the reverse proxy?

But if I serve with

panel serve script.py --index script

And try to open with the ?next=... query args there is no problem.

[MarcSkovMadsen]

There is a discussion here mentioning the "buffer size" as the issue https://discourse.holoviz.org/t/oauth-redirect-uri/5182. I will ask the support team about that.

[philippjfr]

OAuth + Jupyter Proxy definitely seems like a combination that is probably not been exercised well or at all since usually you'd expect the JupyterHub to handle the authentication part.

Don't know where the http is coming from? (I clicked the login on the logout page).

Suspect one of the proxies is performing SSL termination so that Panel only ever sees an HTTP request.