User Management

This chapter covers user management and Google OpenID sign-in setup.

Here’s a command to add a user to Ubuntu server:

sudo useradd -m -d /pfs/home/<user> <user>
sudo passwd <user>  # will ask to enter a password

Once you’ve added a user it should be possible to login into Workbench using this user’s Ubuntu credentials. This is not the final approach we will use. Instead we are going to use authentication through our corporate Google accounts. However, if things go wrong with it, it is nice to be aware of this way.

First of all, add a user for yourself with a name equal to your gradientmetrics email. Example:

sudo useradd iaroslav@gradientmetrics.com -m -d /pfs/home/iaroslav

This way we create an Ubuntu user called “iaroslav@gradientmetrics.com” with home directory “/pfs/home/iaroslav”.

Now let’s setup Google OpenID authentication for our server. Here’s a guide from Workbench documentation: link. Note that admin account for our Google Workspace is not necessary. Any owner of a @gradientmetrics.com email should be able to do it.

1. Go to Google Cloud.
2. Create a project called something like “RStudio Workbench”.
3. Go to “Credentials”, click “+ create credentials”, select “OAuth client ID” type.
4. For application type select “Web application”, for “Authorized JavaScript origins” add “https://r.gradientmetrics.com” and for “Authorized redirect URIs " add “https://r.gradientmetrics.com/openid/callback".

You will be shown the Client ID - Client Secret pair. Add this pair to the Workbench server as described in the Workench guide.

Use the following settings.

# /etc/rstudio/rserver.conf
auth-openid=1
auth-openid-issuer=https://accounts.google.com
auth-openid-username-claim=email

Now you should be able to login into Workbench using you Google account.

It should be possible to setup some kind of automated user creation through PAM. But we do not have that many users at this point, so I did everything manually. To keep it more organized, first I’ve created a user group for RStudio users:

sudo addgroup rstudio-users

and limited access to Workbench to this group only.

# /etc/rstudio/rserver.conf
auth-required-user-group=rstudio-users

Then, for each user:

sudo useradd <user>@gradientmetrics.com -m -d /pfs/home/<user>
sudo usermod -a -G rstudio-users <user>@gradientmetrics.com

Command to list all users in the group:

getent group rstudio-users

Create a group for rstudio admins, called something like rstudio-admins and tell Workbench server about this group:

/etc/rstudio/rserver.conf
admin-enabled=1
admin-group=rstudio-admins

Each user added to rstudio-admins group will have access to admin dashboard: https://r.gradientmetrics.com/admin .

Command to list all registered Workbench users:

sudo rstudio-server list-users

Users are added to Workbench user database only when they successfully log in to the server. Apparently it is not possible to remove users from the database completely. But it is possible to free up the license place a user occupies by “locking” this user:

sudo rstudio-server lock-user <username>
sudo rstudio-server unlock-user <username>

This can be done via admin dashboard as well: go to Users tab, pick a user and click the lock sign at the top-right corner.