Authentication in RStudio Team

Configuring Authentication in RStudio Professional Products is an important step towards creating a secure environment for your data scientists to do their work. This page is designed to help you choose which authentication option is the right choice for your situation.

For details on how to configure a particular setup, please see the Administration Guide for the relevant product (RStudio Server Pro, RStudio Connect).

Authentication Options for RStudio Professional Products #

RStudio Server Pro #

Your authentication options in RStudio Server Pro require that users and groups in RStudio Server Pro must also exist on the Linux server where the product is running.

Therefore, configuring authentication in RStudio Server Pro generally has 2 parts:

  1. Configuring RStudio Server Pro to authenticate with either the Linux server (using PAM), or directly with your authentication system.
  2. Manually creating corresponding users on the Linux server, or configuring NSS to create users and groups based on your authentication provider.

Options #

Here are the options to authenticate in RStudio Server Pro.

  • Default/System: Manually manage users/groups in Linux.
  • Kerberos: Authenticate with a Kerberos ticket via PAM.
  • LDAP: Authenticate with LDAP via PAM.
  • Google: Authenticate with Google OAuth.
  • Proxied: Authentication methods not otherwise covered. Recommended only for advanced administrators.

In versions of RStudio Server Pro 1.3 and earlier, SAML authentication must be done via proxied authentication. As of RStudio 1.4 (forthcoming), SAML authentication will be directly supported in RStudio Server Pro.

RStudio Connect #

In contrast to RStudio Server Pro, RStudio Connect users and groups exist in the product, and generally do not need to be created on the underlying server. Therefore, usually the only step in configuring authentication in RStudio Connect is to configure the product to communicate with your authentication provider.

If you wish to use the Applications.RunAsCurrentUser setting, you will need to use PAM authentication and provision Linux users. This is often desired in order to use Kerberos to access a data source.

Options #

Here are the authentication options in RStudio Connect along with relevant links on configuration.

  • Default/Password: Manually manage users and groups using the RStudio Connect UI or the RStudio Connect Server API.
  • System: Use Linux users via PAM, manage groups manually or via API.
  • Kerberos: Use a Kerberos ticket to authenticate users via PAM, manage groups manually or via API.
  • LDAP: Manage users and groups via LDAP.
  • SAML: Manage users and groups via SAML.
  • Google: Manage users via Google OAuth, manage groups manually or via API.
  • Proxied: Authentication for options not otherwise covered. Recommended only for advanced administrators.

RStudio Package Manager #

RStudio Package Manager does not have in-product authentication for end-users. Anyone who has network access to your RStudio Package Manager instance will be able to install packages using the install.packages command from R.

Administrators require command-line access to the Linux server where RStudio Package Manager is installed as well as membership in the rstudio-pm group to be able to use the Command-line Interface to administer the package repositories.

Please see the relevant section of the RStudio Package Manager Admin Guide for more details.

Other Resources #