Open clhedrick opened 3 months ago
Thank you for opening your first issue in this project! Engagement like this is essential for open source projects! :hugs:
If you haven't done so already, check out Jupyter's Code of Conduct. Also, please try to follow the issue template as it helps other other community members to contribute more effectively.
You can meet the other Jovyans by joining our Discourse forum. There is also an intro thread there where you can stop by and say Hi! :wave:
Welcome to the Jupyter community! :tada:
The PAM sessions being wrong is already open at #2973, documented, and why sessions are off by default.
os.getgrouplist
instead of os.initgroups
, which sounds like it might be better. Would you like to make a PR for that?If anyone has a Dockerfile where PAM sessions open and close actually do things, that would be a huge help for testing this kind of thing. I tried setting up a simple toy with pam_python, but I can only get it to segfault, not actually do anything.
Bug description
Two problems with the preexec passed to Popen when starting the single server:
For the first, rather than
in the wrapper, do
in the preexec function itself. Initgroups uses undocumented internal libc calls to get just the groups for that user, and is thus much more efficient than getgrall for sites with many users and groups. It also works properly with IPA.
For the second, put the
in the preexec function, not the authentication code.
Here's my actual code, from jupyterhub_config.py
How to reproduce
Expected behaviour
Actual behaviour
Your personal set up
Full environment
``` # paste output of `pip freeze` or `conda list` here ```Configuration
```python # jupyterhub_config.py ```Logs
``` # paste relevant logs here, if any ```