A Kerberos system can be used to login to Posit Connect by configuring Posit Connect to use Linux PAM and configuring PAM on your server to use Kerberos.
Posit Connect does not support Kerberos SSO (Windows Integrated Auth/SPNEGO), though support for Kerberos authentication may be served via SAML or OIDC/OAuth2 Identity Providers, which are supported with SAML or OpenID Connect integrations.
Using this integration, user authentication will be handled by Kerberos via PAM. However, the group functionality is provided by Posit Connect, and the groups will have no relation with Linux groups that may be provided by PAM.
Kerberos integration often means different things to different people, depending on what they are trying to accomplish. The information below will help you configure PAM integration for user authentication within Posit Connect. Further details regarding the use of Kerberos tickets from within published content can be found here
The PAM configuration appendix contains information about each PAM configuration option.
; /etc/rstudio-connect/rstudio-connect.gcfg [Authentication] Provider = "pam" [PAM] ; These default values should be adjusted ; accord to the level of PAM support desired: ;Service = "rstudio-connect" ;UseSession = false ;ForwardPassword = false ; When attempting to troubleshoot a problem relating to PAM, ; you can enable more verbose logging by enabling the following line ;Logging = true
See the PAM sessions section for information about using PAM sessions when launching processes associated with content.
RStudio is now Posit
Our professional products have been renamed to Posit Connect, Posit Workbench, and Posit Package Manager. Some references to RStudio and
rstudio-connect will remain as we transition through the rebrand.
You can change the PAM service used for authentication by customizing the
PAM.Service setting. The
default PAM service name used for authentication is
; /etc/rstudio-connect/rstudio-connect.gcfg [PAM] Service = "rstudio-connect"
Note that there are three types of PAM services that can be configured in the
PAM configuration section. The PAM
sessions section contains additional
PAM.Service: The PAM service used for authenticating users when logging in.
If the user accounts on Linux are provisioned externally, you may need to use the pam_mkhomedir module in your PAM configuration to automatically create the users’ home directories on first login.
You may need to use the
pam_rootokmodule in your PAM configuration to accomplish this.
PAM.AuthenticatedSessionService: The PAM service used for running processes as the currently logged-in user with the user's password. Requires
Applications.RunAsCurrentUserto be enabled. This is useful in Kerberos configurations to allow the running content to access authenticated resources as the visiting user.
The examples below assume Posit Connect is configured to use the
rstudio-connect PAM service name for authentication.
Posit Connect does not create a PAM service on Ubuntu systems. When Posit
Connect attempts to use the
rstudio-connect service name for authentication,
PAM will recognize that there is no service with that name and fall back to the
other service located at
The default Ubuntu
other service is configured to inherit from a set of common
# Ubuntu default "other" PAM service. @include common-auth @include common-account @include common-password @include common-session
other service is appropriate for your organization, no further
configuration is needed.
Otherwise, create and configure
/etc/pam.d/rstudio-connect to prevent PAM from
falling back to the
other service. PAM will use this service for subsequent
authentication attempts using the
rstudio-connect service name.
Red Hat/CentOS/SUSE systems may deny access to unknown PAM service names by default.
This is because the
other configuration in
/etc/pam.d/other contains only
#%PAM-1.0 # The Red Hat/CentOS default "other" PAM service. auth required pam_deny.so account required pam_deny.so password required pam_deny.so session required pam_deny.so
The Posit Connect RPM installs an
rstudio-connect PAM service located at
/etc/pam.d/rstudio-connect. This service is configured to require a user ID
greater than 500 and authenticates against local system accounts.
#%PAM-1.0 # The Posit Connect default PAM service. auth requisite pam_succeed_if.so uid >= 500 quiet auth required pam_unix.so nodelay account required pam_unix.so
This default PAM service may not reflect the authentication behavior that you want for Posit Connect. Feel free to customize this service for your organization.
Configuring a PAM service#
This section may be helpful if your organization has different requirements from
the default behavior of the
rstudio-connect PAM service name. Please consult
with your PAM/systems administrator to ensure that the Posit Connect PAM
service configuration fits your needs.
If your system already has a PAM service (e.g.
/etc/pam.d/login) with the
desired behavior, it may be enough to simply include that service from within
the Posit Connect service. For example:
# Posit Connect PAM service that defers to the existing login service. @include login
Alternatively, you may copy the existing service into the Posit Connect service.
sudo cp /etc/pam.d/login /etc/pam.d/rstudio-connect
Lastly, you could configure the
PAM.Service setting to
reference that PAM service. This would be appropriate if you have a common
posit service that you use across all Posit products, for example.
; /etc/rstudio-connect/rstudio-connect.gcfg [PAM] Service = posit
If you change the
PAM.Service setting from its default
value, the PAM service defined in
/etc/pam.d/rstudio-connect will not be used.
PAM Authentication requires that users in Posit Connect have corresponding local system accounts. These accounts should be provisioned ahead of the first login in Posit Connect. Linux Name Service Switch (NSS) or System Security Services Daemon (SSSD) can be configured on the machine hosting Posit Connect to automate the provisioning of these local accounts.
Users may also be created in Posit Connect ahead of their first login by adding them as users via the Posit Connect Server API.
Register on First Login#
By default, PAM users can be created in Posit Connect upon their first
successful login attempt. Accounts will be created with the role specified in the
setting (see User Roles).
Disabling Register on First Login#
If you wish to disable this feature, set the configuration setting
; /etc/rstudio-connect/rstudio-connect.gcfg [PAM] RegisterOnFirstLogin = false
Using this option requires users to be exclusively created via the Posit Connect Server API.
Usernames must be unique and are case-sensitive following the Linux requirement for usernames. Additionally, they must adhere to the following:
- Be 3-64 characters in length
- Start with a letter
- Contain only alphanumeric characters, underscores, and periods
- The following values are prohibited:
Editing User Attributes#
Posit Connect is always supplied with a username corresponding to the Linux account username and is therefore not editable.
Changing the username of the Linux account will result in a new user being created in Posit Connect the next time the user logs in.
A user's first name, last name, and email address are not provided by the
hosting system and are considered editable. The setting
has a default value of
AdminAndSelf, permitting users and administrators to
manage these user profile attributes. Configure
Admin if profile editing should be restricted to administrators.
Automatic User Role Mapping#
Posit Connect does not provide the ability to map user roles when using the PAM Authentication provider. Roles must be managed within the Posit Connect dashboard or via the Posit Connect Server API.
Group Membership Management#
Posit Connect allows the organization of users into groups. Administrators can manage local groups within the "People" tab in the Posit Connect dashboard or via the Posit Connect Server API.
These groups are local to Posit Connect and have no relation with Linux groups present on the host machine where PAM is configured.
If you do not want groups at all in Posit Connect, set the
configuration option to