Advanced authentication for Shiny apps

[sbrooks]

Hi all,

My company uses Shiny for a few internal tools. The apps are currently deployed to Heroku and protected with a single user/password but we'd like to allow users to create accounts with their emails, and add/revoke access (because not everyone should have access to all apps).

Have you done something like this?

One of the most important features is that deployment should be simple. One team is in charge of controlling access to the apps but the analysts are in charge of pushing new versions. So we want the authentication to be transparent so when an analyst deploys a new version, the authentication remains the same. Ideally, the solution should not require code changes to the Shiny app because that'd mean the analysts will have to deal with it.

[keithn]

Would hosting apps on a server running Posit Connect be suitable for your company?

@sbrooks

we'd like to allow users to create accounts with their emails

This can be handled by the Built-In password Authentication, but other Single Sign-On Authentication options are available.

add/revoke access (because not everyone should have access to all apps)

Connect users with administrator roles can create, lock (disable) or delete user accounts to the Posit Connect system.

In terms of restricting access to individual applications, content publishers (and administrators) can control which individual user accounts and user groups can access the content they manage. Content can also be made accessible to everyone, or internally to anyone with a Connect login.

One of the most important features is that deployment should be simple

RStudio has built-in support for publishing Shiny apps to Posit Connect (same interface used to deploy to shinyapps.io). Other deployment methods are available.

One team is in charge of controlling access to the apps but the analysts are in charge of pushing new versions. So we want the authentication to be transparent so when an analyst deploys a new version, the authentication remains the same. Ideally, the solution should not require code changes to the Shiny app because that'd mean the analysts will have to deal with it.

The authentication is to access the Posit Connect system, and then from there, users can access the apps they are allowed to access. So the authentication is kept separate from the running of the Shiny applications, meaning the app developer doesn't need to worry about authentication code for getting into the app (if your app links itself to other services that need authentication like cloud storage or databases, that is a separate matter). The Shiny application can still know which user is logged in, as Posit Connect populates the session$user value that some Shiny applications will want to know.