# Authentication issues with OOD 3.0 and JupyterLab on iPad

**URL:** <https://discourse.openondemand.org/t/authentication-issues-with-ood-3-0-and-jupyterlab-on-ipad/2932>\
**Category:** Get Help\
**Tags:** question\
**Created:** [August 31, 2023, 2:54pm UTC](https://discourse.openondemand.org/t/authentication-issues-with-ood-3-0-and-jupyterlab-on-ipad/2932 "2023-08-31T14:54:24Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![ssivy](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/ssivy/32/106_2.png) [@ssivy](https://discourse.openondemand.org/u/ssivy)\
**Post date:** [August 31, 2023, 2:54pm UTC](https://discourse.openondemand.org/t/authentication-issues-with-ood-3-0-and-jupyterlab-on-ipad/2932/1 "2023-08-31T14:54:24Z")

</div>

This may be a known issue, but my searches didn’t turn up anything definitive. I have a user that is trying to use his iPad to access OOD. He is able to login and navigate the main OOD portal fine, but when he launches JupyterLab, it prompts him to login again after it starts up, and again each time he opens a notebook. I’ve found that Safari has issues with websockets, but I could replicate the issue with Firefox and Chrome on iPad. Everything works fine on a PC or Mac desktop using FF or Chrome.

We are still using Apache basic auth with an LDAP backend since Dex doesn’t provide the failed login attempt info (username + IP address) that we need to integrate with fail2ban. The OOD is version 3.0.1 and our websockify is version 0.9.0. Let me know if there is any other info needed.

I wanted to make sure this wasn’t a known issue or if there was a simple fix before I spend too much time troubleshooting it.

---

<div class="post-metadata">

**Author:** ![travert](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/travert/32/3074_2.png) [@travert](https://discourse.openondemand.org/u/travert)\
**Post date:** [August 31, 2023, 3:45pm UTC](https://discourse.openondemand.org/t/authentication-issues-with-ood-3-0-and-jupyterlab-on-ipad/2932/2 "2023-08-31T15:45:58Z")

</div>

Hey, thanks for the post and information.

I’ve not heard anything yet about Ipad specific issues, but we have had some users run into connection issues using OOD `3.0` with `websockify` versions `< 0.10.0`.

That might be the first step to see if this fixes the issue, and if not we can start to look into it more.

---

<div class="post-metadata">

**Author:** ![ssivy](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/ssivy/32/106_2.png) [@ssivy](https://discourse.openondemand.org/u/ssivy)\
**Post date:** [August 31, 2023, 6:21pm UTC](https://discourse.openondemand.org/t/authentication-issues-with-ood-3-0-and-jupyterlab-on-ipad/2932/3 "2023-08-31T18:21:28Z")

</div>

Just tried using websockify 0.10.0. It didn’t seem to make a difference. I used Chrome and Firefox on iPad to test with. Continued to work fine on PC/Mac using Chrome or FF.

---

<div class="post-metadata">

**Author:** ![ssivy](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/ssivy/32/106_2.png) [@ssivy](https://discourse.openondemand.org/u/ssivy)\
**Post date:** [August 31, 2023, 6:24pm UTC](https://discourse.openondemand.org/t/authentication-issues-with-ood-3-0-and-jupyterlab-on-ipad/2932/4 "2023-08-31T18:24:46Z")

</div>

Of note, this happens with noVNC-based apps in OOD too.

---

<div class="post-metadata">

**Author:** ![travert](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/travert/32/3074_2.png) [@travert](https://discourse.openondemand.org/u/travert)\
**Post date:** [August 31, 2023, 8:09pm UTC](https://discourse.openondemand.org/t/authentication-issues-with-ood-3-0-and-jupyterlab-on-ipad/2932/5 "2023-08-31T20:09:40Z")

</div>

Interesting. I just used an iPad pro with OOD 3.0 and was able to launch a Jupyter Lab and connect. I only tested on FF at the moment.

The iPad itself was on iPad OS 16.6. Do you know what version the iPad that is not working is on?

Also, when the login shows up for them in Jupyter, are you able to enter the information to get in? Or are they always locked out with this login page?

---

<div class="post-metadata">

**Author:** ![ssivy](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/ssivy/32/106_2.png) [@ssivy](https://discourse.openondemand.org/u/ssivy)\
**Post date:** [September 1, 2023, 4:50pm UTC](https://discourse.openondemand.org/t/authentication-issues-with-ood-3-0-and-jupyterlab-on-ipad/2932/6 "2023-09-01T16:50:45Z")

</div>

I think my iPad is too old to support 16 and higher. I’m running iPadOS 15.7.8.

I tried on my iPhone 13 too with the most up-to-date iOS (16.6), and it did the same thing.

Are you using Apache httpd basic authentication or something else like Dex? I think it is related to the basic auth since it seems that whenever I open something new … new app, new notebook in Jupyter … it reprompts for my credentials.

---

<div class="post-metadata">

**Author:** ![travert](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/travert/32/3074_2.png) [@travert](https://discourse.openondemand.org/u/travert)\
**Post date:** [September 1, 2023, 5:04pm UTC](https://discourse.openondemand.org/t/authentication-issues-with-ood-3-0-and-jupyterlab-on-ipad/2932/7 "2023-09-01T17:04:28Z")

</div>

Apache Basic Auth is insecure and something we try to recommend users not use.

We have a page in the docs over that here:  
[https://osc.github.io/ood-documentation/latest/authentication/insecure.html](https://osc.github.io/ood-documentation/latest/authentication/insecure.html)

At OSC we use openid-connect (OIDC) with I think Keycloak.

---

<div class="post-metadata">

**Author:** ![ssivy](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/ssivy/32/106_2.png) [@ssivy](https://discourse.openondemand.org/u/ssivy)\
**Post date:** [September 1, 2023, 5:17pm UTC](https://discourse.openondemand.org/t/authentication-issues-with-ood-3-0-and-jupyterlab-on-ipad/2932/8 "2023-09-01T17:17:43Z")

</div>

Do you know if that logs username and IP address on failures? That is the reason we didn’t use Dex because it only logs usernames on authentication failure. We use fail2ban to block IPs with too many failed logins.

---

<div class="post-metadata">

**Author:** ![travert](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/travert/32/3074_2.png) [@travert](https://discourse.openondemand.org/u/travert)\
**Post date:** [September 1, 2023, 5:22pm UTC](https://discourse.openondemand.org/t/authentication-issues-with-ood-3-0-and-jupyterlab-on-ipad/2932/9 "2023-09-01T17:22:01Z")

</div>

It looks like someone has made the community request to Dex to have this, but at this time it does not:

> <https://github.com/dexidp/dex/issues/2319>
>
> \### Preflight Checklist
> 
> \- \[X\] I agree to follow the \[Code of Conduct\](https://g…ithub.com/dexidp/dex/blob/master/.github/CODE\_OF\_CONDUCT.md) that this project adheres to.
> \- \[X\] I have searched the \[issue tracker\](https://www.github.com/dexidp/dex/issues) for an issue that matches the one I want to file, without success.
> 
> \### Problem Description
> 
> I am using Dex OIDC/LDAP with Apache, as part of OpenOnDemand installation. A portal like OpenOnDemand lets users to connect and run jobs and servers on (that is, arbitrary user code "inside") an HPC system, with obvious security implications. So it is customary to ban failed login attempts with tools like fail2ban, denyhosts and the like. 
> 
> Looks like when using Dex, there is no clear place to match a failed attempt with the source IP, because users connect to Dex directly, after Apache had forwarded the call? So, Dex would report the failure in its log, but w/o IP information, and Apache would have the IP but wont report a failure at all.  
> 
> \### Proposed Solution
> 
> Dex should have IP addresses at hand, because users connect to it directly. So the authentication routine should log not only username and the fact of the failure, but also IP. So fail2ban filter can be pointed to the log file and make existing, well known fail2ban to ban the offending IPs. 
> 
> \### Alternatives Considered
> 
> There is an open issue for the same problem: https://github.com/dexidp/dex/issues/1869 , which proposes I think taking on fail2ban functionality inside Dex. Very quiet ticket, there.
> 
> It probably would be less effort to just log things and let fail2ban take care of the firewalls, rather than add extra functionality to deal with things. 
> 
> \### Additional Information
> 
> \_No response\_

Interestingly, it’s another OOD user that made the request. I’m sure they would like to hear from you as someone that wants to use this, but who has a policy that won’t allow it because they don’t integrate with `fail2ban` yet. It might provide some motivation.

If the policy is worded such that you just need to log failed attempts after so many tries and block, I believe Keycloak has those features built-in. But, you would not directly be using `fail2ban`, so if you _must_ use `fail2ban` it may not be any better. Depends how the policy is worded I’d say.

---

<div class="post-metadata">

**Author:** ![ssivy](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/ssivy/32/106_2.png) [@ssivy](https://discourse.openondemand.org/u/ssivy)\
**Post date:** [September 1, 2023, 6:19pm UTC](https://discourse.openondemand.org/t/authentication-issues-with-ood-3-0-and-jupyterlab-on-ipad/2932/10 "2023-09-01T18:19:43Z")

</div>

Yeah, gshamov filed that feature request on my behalf 😁. I had brought up that issue when Dex was added to OOD 1.8. I’ll try one of the other authentication mechanisms like Keycloak, etc. again.

---

<div class="post-metadata">

**Author:** ![travert](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/travert/32/3074_2.png) [@travert](https://discourse.openondemand.org/u/travert)\
**Post date:** [September 1, 2023, 8:55pm UTC](https://discourse.openondemand.org/t/authentication-issues-with-ood-3-0-and-jupyterlab-on-ipad/2932/11 "2023-09-01T20:55:34Z")

</div>

Haha, that’s pretty funny. Sounds good.

I have taken to recommending Keycloak as I use it myself locally and think it’s pretty simple, but it also gives you an ability to **impersonate a user**. This can be huge for admins to troubleshoot issues. There’s been requests to have OOD offer this functionality, but I believe this belongs with the authentication service and not OOD for many reasons I’ll not dive into.

---

<div class="post-metadata">

**Author:** ![iuryt](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/iuryt/32/1882_2.png) [@iuryt](https://discourse.openondemand.org/u/iuryt)\
**Post date:** [September 27, 2023, 6:01pm UTC](https://discourse.openondemand.org/t/authentication-issues-with-ood-3-0-and-jupyterlab-on-ipad/2932/12 "2023-09-27T18:01:38Z")

</div>

I am not sure anything has changed since the last post, but I am experiencing the same problem with the HPC OpenOnDemand service from an university I collaborate. Any idea on how to solve this issue from the user side?

---

<div class="post-metadata">

**Author:** ![ssivy](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/ssivy/32/106_2.png) [@ssivy](https://discourse.openondemand.org/u/ssivy)\
**Post date:** [September 27, 2023, 6:18pm UTC](https://discourse.openondemand.org/t/authentication-issues-with-ood-3-0-and-jupyterlab-on-ipad/2932/13 "2023-09-27T18:18:17Z")

</div>

We ended up implementing OpenID (without Keycloak) directly to our identity provider. It took a bit to get it to work, but once we did, it provides single sign-on with our other apps that use that identity provider. It solved the iPhone/iPad reauthentication issue that basic auth method had.

---

<div class="post-metadata">

**Author:** ![iuryt](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/iuryt/32/1882_2.png) [@iuryt](https://discourse.openondemand.org/u/iuryt)\
**Post date:** [September 27, 2023, 6:49pm UTC](https://discourse.openondemand.org/t/authentication-issues-with-ood-3-0-and-jupyterlab-on-ipad/2932/14 "2023-09-27T18:49:56Z")

</div>

I see. I understand that this is not something I could do as an user of the service but rather suggest to the maintainers. I wish there was an easy solution…

---

<div class="post-metadata">

**Author:** ![iuryt](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/iuryt/32/1882_2.png) [@iuryt](https://discourse.openondemand.org/u/iuryt)\
**Post date:** [September 27, 2023, 6:50pm UTC](https://discourse.openondemand.org/t/authentication-issues-with-ood-3-0-and-jupyterlab-on-ipad/2932/15 "2023-09-27T18:50:56Z")

</div>

Do you know if it is possible to open the Jupyter service from Juno Connect iPad app?

---

<div class="post-metadata">

**Author:** ![jeff.ohrstrom](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jeff.ohrstrom/32/136_2.png) [@jeff.ohrstrom](https://discourse.openondemand.org/u/jeff.ohrstrom)\
**Post date:** [September 27, 2023, 7:00pm UTC](https://discourse.openondemand.org/t/authentication-issues-with-ood-3-0-and-jupyterlab-on-ipad/2932/16 "2023-09-27T19:00:05Z")

</div>

> [@iuryt](#):
>
> I see. I understand that this is not something I could do as an user of the service but rather suggest to the maintainers. I wish there was an easy solution…

Safari/webkit maintainers? Safari doesn’t like you running Basic authentication scheme. You can either use a different authentication (you really should! basic authentication is _very_ insecure) or use a different browser like Chrome or firefox.

[https://bugs.webkit.org/show\_bug.cgi?id=80362](https://bugs.webkit.org/show_bug.cgi?id=80362)

---

<div class="post-metadata">

**Author:** ![iuryt](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/iuryt/32/1882_2.png) [@iuryt](https://discourse.openondemand.org/u/iuryt)\
**Post date:** [September 27, 2023, 8:03pm UTC](https://discourse.openondemand.org/t/authentication-issues-with-ood-3-0-and-jupyterlab-on-ipad/2932/17 "2023-09-27T20:03:42Z")

</div>

Sorry. I meant the university IT services that maintain the HPC resources.

---

<div class="post-metadata">

**Author:** ![iuryt](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/iuryt/32/1882_2.png) [@iuryt](https://discourse.openondemand.org/u/iuryt)\
**Post date:** [September 27, 2023, 8:04pm UTC](https://discourse.openondemand.org/t/authentication-issues-with-ood-3-0-and-jupyterlab-on-ipad/2932/18 "2023-09-27T20:04:22Z")

</div>

I tried to use Chrome and it gives the same error as mentioned by the OP. I will try with Firefox…

---

<div class="post-metadata">

**Author:** ![jeff.ohrstrom](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jeff.ohrstrom/32/136_2.png) [@jeff.ohrstrom](https://discourse.openondemand.org/u/jeff.ohrstrom)\
**Post date:** [September 28, 2023, 4:08pm UTC](https://discourse.openondemand.org/t/authentication-issues-with-ood-3-0-and-jupyterlab-on-ipad/2932/19 "2023-09-28T16:08:52Z")

</div>

Sorry - as you aren’t the OP I’m not sure what your setup is. What’s the authentication you use? I don’t think there’s a solution on your side save for using a different browser. And as you indicate it may not even work then (though that’s surprising, i thought it was just a Mac/Safari thing).

In any case - if you use Basic authentication I would definitely suggest you lobby your administrators to upgrade to OIDC or similar (Shibboleth, CAS, etc) as it’s not just this bug, but Basic authentication is very insecure.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex015/uploads/osc/original/2X/b/bae70bd0ed39a3ae769c2108155f4cb3e9da8385.png) [@system](https://discourse.openondemand.org/u/system)\
**Post date:** [March 26, 2024, 4:09pm UTC](https://discourse.openondemand.org/t/authentication-issues-with-ood-3-0-and-jupyterlab-on-ipad/2932/20 "2024-03-26T16:09:04Z")

</div>

This topic was automatically closed 180 days after the last reply. New replies are no longer allowed.