Unauthorized error trying to connect to remote OnDemand-based Jupyterlab

[marius311]

Description

I'm trying to connect jupyterlab-desktop to a Jupyterlab spawned by OnDemand on a remote cluster (this one, fwiw).

When I click through the OnDemand interface in a webbrowser to get to Jupyterlab, I'm at a URL like https://vdi.rc.fas.harvard.edu/node/holygpu.rc.fas.harvard.edu/1234/lab

If I try to paste that URL into the jupyterlab-desktop connect dialog, I get

Unauthorized
This server could not verify that you are authorized to access the document requested. Either you supplied the wrong credentials (e.g., bad password), or your browser doesn't understand how to supply the credentials required.

Doing some snooping on the OnDemand page that, in a webbrowser, would link me to jupyterlab, it looks like there's a password supplied via an html input, see attached screenshot:

I could be wrong, but I'm guessing this is the problem, since jupyterlab-desktop is not providing this password when I just paste the URL. Given this, is there any way for jupyterlab-desktop to connect in such a set up? I'm ok if it requires some work on my end. Thanks for any ideas.

Context

• Operating System and version: Linux Ubuntu 22.04
• JupyterLab-Desktop version: 3.6.1-1
• Installer: deb
• OnDemand version: 2.0.29

Logs (required for issues with loading, server and startup)

`main.log` is empty. 

[JasonWeill]

Can you use the JupyterLab instance's token instead of the password?

[marius311]

Can you confirm it would look like https://vdi.rc.fas.harvard.edu/node/holygpu.rc.fas.harvard.edu/1234/lab?token=... in my case? Or is it the token supposed to go elsewhere?

[marius311]

Actually, I'm not sure there's a token? I can view the config file OnDemand uses to lauch Jupyterlab, its this:

c.NotebookApp.ip = '0.0.0.0'
c.NotebookApp.port = 1234
c.NotebookApp.port_retries = 0
c.NotebookApp.password = u'sha1:....`
c.NotebookApp.base_url = '/node/holygpu.rc.fas.harvard.edu/1234/'
c.NotebookApp.open_browser = False
c.NotebookApp.allow_origin = '*'
c.NotebookApp.notebook_dir = '/n/home12/marius'
c.NotebookApp.disable_check_xsrf = True

I think disable_check_xsrf means token authentication is disabled. If thats right, is there any other way for jupyterlab-desktop to connect in this case?

[mbektas]

@marius311 token is not required, but the URL you enter in Connect dialog is expected to take you to JupyterLab eventually (after potential login steps when applicable).

So, you can use the login URL (that you see in the dev tools form action, in full format such as: https://vdi.rc.fas.harvard.edu/node/holygpu.rc.fas.harvard.edu/1234/login). It should prompt you for password that you can get from the <input> element as shown in dev tools screenshot.

[marius311]

Thanks, I think that helps make progress but still not fully working.

If I go to the URL with /login in an incognito window, the first thing I am prompted with is a browser password dialog which is for my account on this cluster:

then after that the password from the <input> element

If I try the login/ URL in jupyterlab-desktop, I immediately get the "Unauthorized" message. So I'm guessing its the first password prompt thats the problem, not the <input> element one. Is jupyterlab-desktop maybe not set up to handle something like that? I think I'm getting closer to thinking this is rather an issue for this cluster, but maybe there's still something to salvage on the jupyter-desktop end?

[mbektas]

can you clear session cache & data from the Settings dialog and restart the app and try entering the /login URL again?

[marius311]

Thanks, just tried, same error.

[mbektas]

@marius311 after further inspection, I found out that this is actually a bug in JupyterLab Desktop. it is not handling login dialogs. we will provide a fix.

[marius311]

Ah, awesome, thanks for sticking through this! Will keep an eye out for the fix.

[mbektas]

@marius311 could you test the fix by installing from Pull Request's build from here.

[marius311]

Yep that works on this system now, thank you!