Github - auth_state_groups_key cannot find teams dict keys

[linkeal]

Bug description

When configuring Jupyterhub on Kubernetes via helm and configuring the GithubOAuthenticator to populate the teams and then also utilize those teams as group it cannot find the properties. Error message:

E 2025-06-09 19:13:22.282 JupyterHub oauth2:1245] The auth_state_groups_key teams does not exist in the auth_model. Available keys are: dict_keys(['access_token', 'refresh_token', 'id_token', 'scope', 'token_response', 'github_user', 'teams'])

How to reproduce

Config

helm upgrade --cleanup-on-fail
--install jupyterhub jupyterhub/jupyterhub
--namespace jupyterhub
--create-namespace
--version=4.2.0
--values values.yaml

hub:
  config:
    JupyterHub:
      authenticator_class: github
    GitHubOAuthenticator:
      client_id: "XXXX"
      client_secret: "XXXX"
      oauth_callback_url: "XXXX"
      manage_groups: true
      admin_groups:
        - jupyterhub-admins
      populate_teams_in_auth_state: true
      auth_state_groups_key: teams
      allowed_organizations:
        - XXXXX
      scope:
        - read:org
        - user:email

Expected behaviour

The Teams of the Organization from Github are validated in JupyterHub and if a User is part of the group (e.g. jupyterhub-admins) those users are granted admin permissions in JupyterHub.

Actual behaviour

Users can login since authentication is configured correctly, however every user is just a normal user. No admin permissions are granted to any user.

Your personal set up

• OS: Kubernetes v1.30.3
• Image: quay.io/jupyterhub/k8s-hub:4.2.0

• Version(s):

jupyterhub==5.3.0
oauthenticator==17.3.0

Full environment

# paste output of `pip freeze` or `conda list` here

Configuration

# jupyterhub_config.py

Logs

[manics]

The error message may be misleading, since the set() call may also return a TypeError even if the key exists:

oauthenticator/oauthenticator/oauth2.py

Lines 1240 to 1248 in 6d08bf2

	try:
	return set(
	reduce(dict.get, self.auth_state_groups_key.split("."), auth_state)
	)
	except TypeError:
	self.log.error(
	f"The auth_state_groups_key {self.auth_state_groups_key} does not exist in the auth_model. Available keys are: {auth_state.keys()}"
	)
	return set()

Can you add some debugging to show the values of the teams field?

[cobotrifork]

Can you add some debugging to show the values of the teams field?

Hello
Sorry for hijacking the thread, I have a similar issue. I have a 'groups' claim inside my id_token, so I'm trying to set auth_state_groups_key to id_token.groups. It fails with the similar The auth_state_groups_key id_token.groups does not exist in the auth_model. Available keys are: dict_keys(['access_token', 'refresh_token', 'id_token', 'scope', 'token_response', 'oauth_user']). Looking at the code, it seems that the call to reduce() is the culprit. I wonder if my auth_state is not what I expect it to be?
Coming back to your comment, what is a way to debug this? How do I make the code print the auth_state? I'm also using JupyterHub through the Helm chart and I've tried setting debug.enabled to true but that still does not give me enough info.

Edit: Well I guess I should've looked more into this. id_token is saved as a string in auth_state, so no way to get a claim out of it. I had to change my auth_state_groups_key to oauth_user.groups. That did the trick for me! cheers!