Best user signup flow when running Workbench w/ Launcher and Slurm

[mmccarthy404]

At my company, we had the need to horizontally scale our RStudio Server in the cloud. Previously, I had setup a single, static, RStudio Server that I scaled vertically; however, as our team grew in size, we frequently hit our ceiling on both CPU and memory.

We've been using consultant company to implement Workbench w/ Launcher, horizontally scaling sessions using Slurm. My first (unrelated) question, is there any functional difference scaling Workbench in Slurm vs Kubernetes?

But to the main question. Right now I'm not happy with the user signup flow. The way it was explained to me, is the following need to happen in order for a user to access a session on Workbench:

1. User signs into Workbench using SSO credentials (authenticated against Azure AD). This creates the user's account in Workbench with user data stored in Workbench's DB.
2. User SSH into a Slurm Login node of Slurm. This creates the user's Linux account in the shared storage (EFS) of the Slurm cluster. The created user account has the same username as the one previously created in Workbench, and this is needed to actually launch sessions on Workbench (otherwise sessions will fail)

From my point of view, step #2 is redundant and can/should be automated. Is it possible/recommended to setup some sort of event-trigger in Workbench that I can use to automatically create Linux user accounts whenever a new user authenticates to Workbench? I suppose I can stream the DBs CDC and react on user creation, but that seems overly complex for what I actually need. Thanks!

[rstub]

It is difficult to answer this without knowing your infrastructure in more detail. However, I can speculate what might be happening:

• Your Linux systems are integrated with LDAP/AD using a tools such as AD.
• This makes users available, but they do not have a HOME directory.
• The HOME directory is automatically created when people login via SSH, typically with pam_mkhomedir.so in the PAM session.

If the above guesses about your infrastructure are correct, it might be enough to set auth-pam-sessions-enabled=1 in rserver.conf, since by default Workbench does not start a PAM session if Launcher is enabled. Please ignore the WARNING about password forwarding that you might get. This is not necessary for HOME creation.