Using Okta Authentication for RStudio Sessions Launched via Open OnDemand

Get Help
1

Hi,

I am currently integrating RStudio Server with Open OnDemand and am using a custom authentication helper to authenticate users.

Currently, my workflow is:

  1. When the OOD job starts, I generate a random password for the RStudio session:
export RSTUDIO_PASSWORD="$(openssl rand -hex 16)"
  1. I create a custom authentication helper (auth) which validates:
    • The username matches the OOD user ($USER).
    • The password matches the generated RSTUDIO_PASSWORD.

The helper is configured using:

--auth-pam-helper-path="${RSTUDIO_ROOT}/bin/auth"

and my rserver is launched as:

exec rserver \
    --server-daemonize=0 \
    --www-port="${RSTUDIO_PORT}" \
    --server-user="${USER}" \
    --server-data-dir="${RSTUDIO_ROOT}/run" \
    --database-config-file="${RSTUDIO_ROOT}/conf/database.conf" \
    --config-file="${RSTUDIO_ROOT}/conf/rserver.conf" \
    --auth-none=0 \
    --auth-pam-helper-path="${RSTUDIO_ROOT}/bin/auth" \
    --auth-encrypt-password=0 \
    --rsession-path="${RSTUDIO_ROOT}/bin/rsession.sh"

This approach works, but it requires users to enter a separate session password rather than using the same authentication they already used to log in to the Open OnDemand portal.

Our OOD portal uses Okta (OIDC/SAML) for authentication.

My question is:

Is there a supported way for RStudio Server, when launched through Open OnDemand, to leverage the existing Okta-authenticated OOD session so that users are not prompted for another login?

In other words, I’d like RStudio to trust the authentication already performed by OOD, similar to how /rnode proxies other interactive applications.

If this isn’t directly supported, what is the recommended approach for integrating RStudio authentication with an OOD deployment that uses Okta?

Any guidance or examples would be greatly appreciated.

2

I might be misunderstanding the nature of your question, but I just checked on our production systems here at OSC (we use Okta as well) and when I launched / connect to RStudio Server I’m not asked to login again.

Some of my more technical colleagues hopefully can help diagnose what’s going on with you, but in the interim, have you looked at any of the RStudio Server repos in the Appverse? The Appverse | Open OnDemand Community Hub We have several implementations available and maybe there is something that will help you in one of those?

3

I am logging on OOD through okta. but if i disable authentication in Rstudio it generates a url but any user can use that url to login into that Rstudio session without authentication prompt.

4

They shouldn’t be prompted by Rstudio. You can check out our view below where we pass the credentials to Rstudio’s /auth-do-sign-in. So it’s seamless for our users, it should be for you as well.

That said - we don’t pass any credential headers back to origin servers (rstudio in this case) for security reasons. You can enable this by removing some OIDC headers from this blocklist, but even so, I’m not 100% sure if Okta is going to recognize or accept those credentials given to one server (OOD) and used in another (Rstudio). Though there may be some realm configurations you can do there.

You can supply a different list of headers to strip in strip_proxy_headers configuration here:

But again, basic auth should be seamless and I think that’s likely much easier route if not more secure because you’d have to pass these headers to every single application which could be an issue.

I can look at your view.html.erb to diagnose any issues with seamless basic authentication.