Create Users Connect API

[jvail]

Hi,
I was experimenting with creating new user accounts via the connect API. We are using proxy authentication on our Connect server. My understanding is that with user_must_set_password = TRUE an email will be sent from the server email account set in the config file to the email specified for the user to set their password. So far no luck with getting a new account created this way.

Below is the R code we are trying. Thanks!

response <- POST(paste0(connectServer, "__api__/v1/users"),
add_headers(Authorization = apiKey),
body = list(username = "john_doe", 
            first_name =  "John", 
            last_name =  "Doe", 
            user_role =  "viewer", 
            user_must_set_password =  TRUE, 
            password = "", 
            email = "john_doe@rstudio.com")
)

[cole]

I'm excited to hear you are making use of the Connect Server API! Definitely feel free to share feedback with how the experience is going.

We have clarified the documentation a bit in the latest version of the API docs.

https://docs.rstudio.com/connect/api/#users

Specifically, the user_must_set_password setting is only valid for Password authentication (and not for proxy authentication). That would explain why you are not getting this behavior. Do you mind me asking what authentication service you are using with proxied authentication? I.e. does your authenticating proxy use SAML? Or some other authentication protocol?

Part of the reason Connect cannot send emails about passwords in Proxied authentication is because the password is not under Connect's control - it is being managed by a separate service.

[jvail]

Ah, that makes sense. We are using Shibboleth, so its SAML, and we are passing the necessary log on parameters to RStudio Connect in the http header from the proxy Does that mean we could still use the API to create accounts, but that we would have to supply the password as part of the initial API call?

[cole]

Ahh right. You definitely can, but it will be dependent on your proxy's behavior how you can get through the proxy when making programmatic requests. In particular, we recommend here in the admin guide (and an example) that you allow the Authorization: Key xxx requests to pass through your proxy. If this is not possible, then you will need some other method of bypassing the proxy with your programmatic API requests... I am ashamed to admit some of the hacky ways that I have done this in the past

Also, I'd like to whet your appetiate: we are hot on the tail of a native SAML implementation for RStudio Connect, and should hopefully have more information to share there in the coming months! That will get around the proxy issue, but some of the user management questions may still be best managed by the API.

[jvail]

Okay, thanks for the response. We did get it to work with the following update to our call. It looks like "encode = "json" was necessary. We can create new users now. Next step will be updating existing accounts. Thanks!

Here's the code that worked for us below.

response <- POST(paste0(connectServer, "__api__/v1/users"),
                 add_headers(Authorization = apiKey),
                 body = list(username = "john_doe", 
                             first_name =  "John", 
                             last_name =  "Doe", 
                             email = "john_doe@rstudio.com"
                  ), encode = "json"
)

[cole]

Glad to hear it!! Now if only RStudio had an employee named John Doe Then I could ping him and say "I didn't realize you were working with Jason too!" Glad I could help! Definitely let us know if you have any more issues (or successes!) with the Connect Server API! The developers will be glad to see it is getting some use!