Why You Should Use RStudio (Posit) Connect Authentication And How to Set It Up

When it comes to securing your application, the first thing that comes to mind is protecting access with proper <b>authentication</b>. This means only allowing people that you create accounts for can access your platform. RStudio Connect authentication makes this process relatively easy with options for either internal or external authentication providers.  The second thing is to allow those with access, only the required permissions to perform their duties. You can do that by applying the rule of least privilege implemented as <b>authorization</b>. For example, if the user only needs to view the app, it serves no purpose to give them edit or delete rights. But how do you properly implement that? Authentication and authorization are big vector attacks. There are many examples where misconfiguration led to privilege escalations, unauthorized access, data breaches, and so on. In this article, I will explain how both authentication and authorization work and show what options are available with RStudio Connect Authorization. If you're ready to level up your security, continue reading.  Note: At the time of writing this article, Posit PBC was RStudio PBC. We use RStudio and Posit interchangeably in this text (e.g. RStudio Connect == Posit Connect). <ul><li><a href="#anchor-1" rel="noopener noreferrer">Why authentication and authorization are important</a></li><li><a href="#anchor-2" rel="noopener noreferrer">RStudio Connect authentication</a></li><li><a href="#anchor-4" rel="noopener noreferrer">RStudio Connect authorization</a></li><li><a href="#anchor-5" rel="noopener noreferrer">Security and reliability</a></li><li><a href="#anchor-6" rel="noopener noreferrer">Summary</a></li></ul> <h2 id="anchor-1">Why authentication and authorization are important</h2> Authentication and authorization are so important that you're likely better off delegating these tasks to specialists. Ask yourself, are you willing to risk these vital entry points by implementing them yourself? Nowadays, there are many platforms that provide authentication and authorization capabilities. So instead of managing users, groups, and their access by yourself, you can use a provider to handle this and integrate your applications with the platform. If you choose to delegate here, and we recommend that you do, there are plenty of high-quality 3rd party providers to choose from like Google, Microsoft (Azure), Okta, OneLogin, Auth0, PingIdentity, and more. <blockquote><strong>Organize data science teams and overcome the challenges of <a href="https://appsilon.com/rstudio-connect-as-a-solution-for-remote-data-science-teams/" target="_blank" rel="noopener noreferrer">remote work with RStudio Connect</a></strong></blockquote> So now that you have your preferred provider, defined your users and groups, and their permissions, what comes next? You'll need to integrate your application to be able to communicate with the Identity Provider. This will allow a secure exchange of the necessary information to let people into your app and give them assigned permissions. But how do you implement that in your shiny app? Choosing to do this yourself will be a very complicated process requiring constant updates and maintenance, and there is no need for you to do so. You can leverage RStudio Connect platform features to integrate it with most of the popular identity providers.  <h2 id="anchor-2">RStudio (Posit) Connect authentication</h2> There are numerous 3rd party providers and products that can be integrated with RStudio Connect. RStudio Connect only supports a single provider at a time. So select a 3rd party provider carefully depending on your preference and project needs. RStudio Connect also has native, built-in password authentication that is not integrated with an external authentication service. But it should only be used for PoCs, user training, small-scale testing, and groups isolated from a centralized IT system. RStudio recommends integrating your organization’s preferred identity provider for most cases. What you will gain from using an identity provider instead of built-in authentication? <img class="aligncenter size-full wp-image-8724" src="https://webflow-prod-assets.s3.amazonaws.com/6525256482c9e9a06c7a9d3c%2F65b01fd999f2296f27b6a33b_RStudio-authentication-vs-authorization.webp" alt="User login and role assignment showing difference between authentication and authorization in RStudio Connect" width="1600" height="969" /> As an administrator you will be able to: <ul><li style="font-weight: 400;" aria-level="1">manage users from a single platform</li><li style="font-weight: 400;" aria-level="1">quickly deactivate users from all systems at once</li><li style="font-weight: 400;" aria-level="1">centrally control requirements like password complexity and multi-factor authentication (MFA)</li></ul> Users will not have to: <ul><li style="font-weight: 400;" aria-level="1">track different sets of credentials</li><li style="font-weight: 400;" aria-level="1">change passwords within RStudio Connect</li></ul> The <a href="https://docs.rstudio.com/connect/admin/authentication/" target="_blank" rel="noopener noreferrer">Admin Guide for RStudio Connect authentication</a> covers in-depth, available options and integration methods. <h3>Password authentication</h3> If default RStudio connect configurations are not overwritten for your instance, then you’ll be offered a simple <a href="https://docs.rstudio.com/connect/admin/authentication/password/" target="_blank" rel="noopener noreferrer">password authentication provider</a>. The password authenticator uses user accounts backed by RStudio’s Connect database (SQLite or PostgreSQL depending on your configuration). And as mentioned above, this is not integrated with an external authentication service and is the only provider that permits users to change passwords within RStudio Connect.  Users can be either created by an administrator or self-registered. Admin-created users will receive an email and be prompted to configure a password. Self-registered users will be assigned the default user role, which can be defined as either publisher or viewer. If you’re looking to quickly start and launch a PoC, then this is an excellent option. However, this is not recommended if you’ll be using it as an authentication method on something like a production server. Instead, integrate with your organization’s existing authentication provider like G-Suite or Active Directory. <h3>Single Sign-On</h3> Single sign-on (SSO) is an authentication method that enables users to securely authenticate with multiple applications and websites by using a single set of credentials. It’s a trust relationship between an application as the service provider, which in our case is RStudio Connect, and an identity provider, like Google, Active Directory, etc.  So instead of using your username and password, like with built-in password authentication, you’ll use an identity provider (e.g Google) to log in, allow RStudio Connect to access your Google Account, and exchange the required information to the service provider (e.g RStudio Connect).  <img class="aligncenter size-full wp-image-8748" src="https://webflow-prod-assets.s3.amazonaws.com/6525256482c9e9a06c7a9d3c%2F65b01fdb99f2296f27b6a40a_RStudio-Connect-Google-identity-provider-small.webp" alt="RStudio Connect Google identity provider" width="270" height="132" /> If you want to check out examples, there’s no better place than <a href="https://docs.rstudio.com/connect/admin/authentication" target="_blank" rel="noopener noreferrer">RStudio’s authentication docs</a>. <h2 id="anchor-4">RStudio (Posit) Connect authorization</h2> After authentication, you might like to know your user permissions. As we mentioned previously, this is where authorization comes into play. In RStudio Connect, authorization is divided into <b>user roles </b>and <b>permissions</b>. Roles control default capabilities on the system, while permissions control access to a specific piece of content (e.g., your Shiny application).  <blockquote><strong><a href="https://appsilon.com/remote-data-science-team-best-practices-scrum-github-and-docker/" target="_blank" rel="noopener noreferrer">Remote Data Science Team Best Practices</a>: Scrum, GitHub, Docker, and More</strong></blockquote> Available roles: <ul><li style="font-weight: 400;" aria-level="1">Administrator - the most comprehensive access control</li><li style="font-weight: 400;" aria-level="1">Publisher - allowed to deploy content, configure settings, and access controls</li><li style="font-weight: 400;" aria-level="1">Viewer - can sign in, see all users and groups, and view permitted content</li><li style="font-weight: 400;" aria-level="1">Anonymous - automatically assigned role for non-authenticated users with no view into the RStudio Connect platform and rights to view apps that have been marked as viewable by "Anyone"</li></ul> User Permissions - The functionality available to any user for any specific piece of content will depend upon their default role and the specific permissions they have been granted. Permissions modify the user's role downward (becoming more restrictive) for a specific piece of content (i.e. a publisher may become a collaborator or viewer or have no access). <img class="aligncenter wp-image-8745" src="https://webflow-prod-assets.s3.amazonaws.com/6525256482c9e9a06c7a9d3c%2F65b01fdca8912184dd3a97a1_Screenshot-RStudio-Connect-Authorization.webp" alt="Screengrab of RStudio Connect's authorization " width="328" height="374" /> If you want to read more about roles and permissions, I recommend the user-management section of RStudio Connect’s Admin Guide. <h2 id="anchor-5">Security and reliability</h2> Even armed with the comprehensive tutorial in RStudio's documentation, you might encounter problems that are not described. In such a case, you can reach out to RStudio for <b>full support</b>. <a href="https://support.rstudio.com" target="_blank" rel="noopener noreferrer">RStudio's support</a> is fast and reliable. Give them a description of your issue and you will receive instructions and documentation that will help you resolve the problem. Having access to support from RStudio ensures you won't spend countless hours debugging the issue on your own, leaving your website unavailable for users and exposing yourself to security threats caused by <b>misconfiguration</b>. If you think these types of issues won't happen to you, here are a few real-life examples showing why you shouldn't take risks: <ul><li style="font-weight: 400;" aria-level="1">Improper authentication in the GitLab SAML integration had a validation issue that permitted an attacker to take over another user's account</li><li style="font-weight: 400;" aria-level="1">IBM Data Risk Manager allowed a remote attacker to bypass security restrictions when configured with SAML authentication</li></ul> Often security vulnerabilities are introduced by Service Providers that improperly validate and process SAML responses received from Identity Providers. Meaning that if you want to configure SSO integration, then you should trust your Service Provider. If security is important to you, then you shouldn't be using packages developed once by a few developers and left unmaintained. Instead, you should be using a secure platform that releases new updates regularly and is maintained by a team of specialists.  <blockquote><strong>Scale for hundreds of concurrent users with <a href="https://appsilon.com/scaling-and-infrastructure-why-is-my-shiny-app-slow/" target="_blank" rel="noopener noreferrer">better Shiny app performance on an infrastructure level</a></strong></blockquote> <strong>Updating applications</strong><b> on a regular basis </b>is so important. We can't stress this enough. So don't leave your app vulnerable to attacks. With RStudio Connect you make sure that when new security vulnerabilities appear, a team of security engineers will take care of them and fix the software as quickly as it’s possible. <img class="aligncenter size-full wp-image-8726" src="https://webflow-prod-assets.s3.amazonaws.com/6525256482c9e9a06c7a9d3c%2F65b01fded6bd062d7ff88918_RStudio-Security-Updates.webp" alt="July 2021 updates to RStudio Connect Security " width="1238" height="701" /> <h2 id="anchor-6">Summing up RStudio (Posit) Connect authentication</h2> You've invested a lot into your application. Now be sure to secure it properly using RStudio Connect authentication. If you feel unsure about proceeding, feel free to reach out to the <a href="https://appsilon.com/" target="_blank" rel="noopener noreferrer">Appsilon team</a>. We're a proud <a href="https://appsilon.com/appsilon-data-science-is-now-an-rstudio-full-service-certified-partner/" target="_blank" rel="noopener noreferrer">RStudio Full Service Certified Partner</a>. Whether your team requires training, implementation, management, or development services, we're here to help enterprises succeed with R and RStudio<i>. </i>