Get JupyterHub groups from Keycloak, support oauthenticator 16.3+

nebari-dev · Mar 27, 2024 · 6a4691a · 6a4691a
1 parent 3e1dfde
commit 6a4691a
Showing 1 changed file with 9 additions and 2 deletions.
diff --git a/...nebari/stages/kubernetes_services/template/modules/kubernetes/services/jupyterhub/main.tf b/...nebari/stages/kubernetes_services/template/modules/kubernetes/services/jupyterhub/main.tf
@@ -157,11 +157,18 @@ resource "helm_release" "jupyterhub" {
             token_url          = module.jupyterhub-openid-client.config.token_url
             userdata_url       = module.jupyterhub-openid-client.config.userinfo_url
             login_service      = "Keycloak"
-            username_key       = "preferred_username"
-            claim_groups_key   = "roles"
+            username_claim     = "preferred_username"
+            claim_groups_key   = "groups"
             allowed_groups     = ["jupyterhub_admin", "jupyterhub_developer"]
             admin_groups       = ["jupyterhub_admin"]
+            manage_groups      = true
+            refresh_pre_spawn  = true
+            validate_server_cert = false
+
+            # deprecated, to be removed (replaced by validate_server_cert)
             tls_verify         = false
+            # deprecated, to be removed (replaced by username_claim)
+            username_key       = "preferred_username"
           }
         }
       }