From b84dd5d735ce2f9b402e0092d237ceb037754b65 Mon Sep 17 00:00:00 2001 From: Min RK Date: Mon, 7 Feb 2022 15:45:38 +0100 Subject: [PATCH] Stop opening PAM sessions by default We don't do it correctly, so don't try by default It does work _sometimes_, but most of the time it does work, it's because it's a no-op. Turning it off by default makes it more likely folks will see the caveat that it may not work. --- jupyterhub/auth.py | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/jupyterhub/auth.py b/jupyterhub/auth.py index 1ac38988..585d5242 100644 --- a/jupyterhub/auth.py +++ b/jupyterhub/auth.py @@ -975,16 +975,24 @@ class PAMAuthenticator(LocalAuthenticator): ).tag(config=True) open_sessions = Bool( - True, + False, help=""" Whether to open a new PAM session when spawners are started. - This may trigger things like mounting shared filsystems, - loading credentials, etc. depending on system configuration, - but it does not always work. + This may trigger things like mounting shared filesystems, + loading credentials, etc. depending on system configuration. + + The lifecycle of PAM sessions is not correct, + so many PAM session configurations will not work. If any errors are encountered when opening/closing PAM sessions, this is automatically set to False. + + .. versionchanged:: 2.2 + + Due to longstanding problems in the session lifecycle, + this is now disabled by default. + You may opt-in to opening sessions by setting this to True. """, ).tag(config=True)