Posit Connect - local unix account with LDAP authentication

[nmath]

Hello,

I have a RSConnect Server where some of the shiny apps deployed there are getting data from cloudera odbc databases, which have kerberos authentication.

If I set the authentication to PAM, then from rsc content UI, I can change the rus as current user to "Use the Unix account of current user" and the connection to odbc databses works fine.

However the option "Use the Unix account of current user" is only available for PAM authentication but I need to use LDAP.

In short, I need to run shiny apps with the unix account of the user who is running the app.

Is there any work arround to the above problem?

Thank you in advance!

[rstub]

You are on the right track! The way forward would be:

• Join the Linux server into the AD realm: See https://support.posit.co/hc/en-us/articles/360016587973-Integrating-RStudio-Workbench-RStudio-Server-Pro-with-Active-Directory-using-CentOS-RHEL (this is for for Workbench, but the basics are the same; there is also an article for Ubuntu)
• Once you have Linux accounts coming from AD, you can authenticate with AD credentials while using PAM authentication
• Next configuring the appropriate PAM module to initialize Kerberos tickets on user login
• Finally configuring the RunAsCurrentUser setting and PAM credential cacheing.

[nmath]

Thank you for your response.
Forgot to mentioned that I need multiple (2 or more) AD to communicate with RSC Server and this is the reason I used LDAP authentication. So, in the solution you proposed, can I join more than one AD to Linux Server?

[rstub]

Yes, sssd can use more than one AD server. It is actually more flexible than Connect in this regard, since it does not pose any restrictions w.r.t. the layout of the LDAP tree. Resources:

• centos - Linux SSSD with two AD Domains - Server Fault
• How To Configure sssd To Work With Multiple Active Directory Domains in Different Forests (CentOS/RHEL) – The Geek Diary

[nmath]

So my understanding is that there is no work around to what I want to do if I want to use LDAP as authentication mechanism for rsc server. The only way to do it, is to add the Ads with realm and use PAM as authentication mech in rsc server, correct?

[cole]

Unfortunately, yes - the workarounds here get a bit unfortunate if you want RunAsCurrentUser and LDAP auth. We will definitely pass this feedback on to the team!! We would love to have a more flexible runAsCurrentUser feature someday.

The workarounds generally take the flavor of something akin to:

• use keytabs associated with different accounts for each of the applications, since no PAM session / context will be available from the user's authentiction
• set per-app runAsUser service accounts. Does not accomplish "for different viewers"
• build helpers into your applications that behave in a more "kerberos aware fashion" and can impersonate users based on session$user and whoever is authenticated to the application.

EDIT: Just to be clear, when I say "LDAP Auth" above, I mean Connect's "direct LDAP integration." If you integrate your server with sssd as @rstub mentions above, then users will still use their LDAP credentials to login, but Connect will be using "PAM Auth" from its point of view.

[rstub]

Why do you want to use Connect's LDAP integration for authentication? With Connect's PAM integration together with sssd integrating with AD you will end up with the same usernames and passwords.