Keycloak与JupyterHub集成问题：获取用户信息时HTTP 403错误

问题场景 #

• 部署环境：通过Helm在Kubernetes集群中运行Keycloak
• 配置情况：在dev realm下为JupyterHub创建了名为styx的客户端，已启用Client authentication
• 异常现象：输入正确用户名密码完成Keycloak认证后，重定向回JupyterHub时触发用户信息获取失败，收到Keycloak返回的HTTP 403 Forbidden错误

错误日志 #

[E 2023-01-11 02:34:20.026 JupyterHub oauth2:386] Error fetching user data 403 GET https://ceres.themodelvault.com/realms/dev/protocol/openid-connect/userinfo:
[E 2023-01-11 02:34:20.027 JupyterHub web:1798] Uncaught exception GET /hub/oauth_callback?state=eyJzdGF0ZV9pZCI6ICIzZWZiZjQzNzM4ZDA0ZmM2YTZmODdjYzk4MDAxZjkxNCIsICJuZXh0X3VybCI6ICIvaHViLyJ9&session_state=129fa2d5-c9d3-4d13-8539-7611f0e05604&code=3d9031f9-3889-4ad4-a676-4d2276e5907f.129fa2d5-c9d3-4d13-8539-7611f0e05604.0526b372-e282-401f-af45-6ea2ca2647fd (::ffff:10.0.106.200)
    HTTPServerRequest(protocol='http', host='styx-dev.themodelvault.com', method='GET', uri='/hub/oauth_callback?state=eyJzdGF0ZV9pZCI6ICIzZWZiZjQzNzM4ZDA0ZmM2YTZmODdjYzk4MDAxZjkxNCIsICJuZXh0X3VybCI6ICIvaHViLyJ9&session_state=129fa2d5-c9d3-4d13-8539-7611f0e05604&code=3d9031f9-3889-4ad4-a676-4d2276e5907f.129fa2d5-c9d3-4d13-8539-7611f0e05604.0526b372-e282-401f-af45-6ea2ca2647fd', version='HTTP/1.1', remote_ip='::ffff:10.0.106.200')
    Traceback (most recent call last):
      File "/usr/local/lib/python3.9/site-packages/tornado/web.py", line 1713, in _execute
        result = await result
      File "/usr/local/lib/python3.9/site-packages/oauthenticator/oauth2.py", line 222, in get
        user = await self.login_user()
      File "/usr/local/lib/python3.9/site-packages/jupyterhub/handlers/base.py", line 801, in login_user
        authenticated = await self.authenticate(data)
      File "/usr/local/lib/python3.9/site-packages/jupyterhub/auth.py", line 491, in get_authenticated_user
        authenticated = await maybe_future(self.authenticate(handler, data))
      File "/usr/local/lib/python3.9/site-packages/oauthenticator/generic.py", line 165, in authenticate
        user_data_resp_json = await self._get_user_data(token_resp_json)
      File "/usr/local/lib/python3.9/site-packages/oauthenticator/oauth2.py", line 387, in fetch
        raise e
      File "/usr/local/lib/python3.9/site-packages/oauthenticator/oauth2.py", line 366, in fetch
        resp = await self.http_client.fetch(req, **kwargs)
    tornado.httpclient.HTTPClientError: HTTP 403: Forbidden

解决方案 #

已解决该问题，针对Keycloak 20版本中userinfo端点的权限限制问题，通过以下客户端配置调整解决：

• 在Keycloak客户端styx的设置中，启用Direct Access Grants Enabled选项
• 确认客户端的作用域（Client Scopes）包含openid、profile等用于获取用户信息的必要权限
• 检查JupyterHub的OAuth配置，确保授权请求中包含正确的scope参数，保证获取的token具备访问userinfo端点的权限

内容的提问来源于stack exchange，提问作者stasdavydov