RStudio Connect Groups (from SAML)

Posit Professional & Hosted Products Posit Connect
1

I've been experimenting with switching over our groups from RStudio Connect to using domain owned groups provided via SAML from Azure Active Directory.

When doing this it seems like RStudio Connect hides the group info.

For my admin tasks, it would be really helpful

  • For debugging setup, if there was some way to see the saml information that has come across for an individual user (e.g. in the audit log)
  • For choosing group info, if there was some way to view all available groups (when using Saml as provider) - e.g. a list in the admin panel (and a list in the user view would also be useful)
  • For preparing apps (before users first login), if there was some way to prepopulate groups (e.g. to set up the name "Analysts" before any of the "Analysts" have logged in) - without this there's an awkward pause where I have to ask one person from each team to login before I can actually setup app access for a group (some of this awkwardness currently caused by lots of remote working!)

Currently investigating if I can do some of this using connectapi ... but wondering if any of this is already available anywhere...

Thanks

Stuart

2

The RStudio Connect command line interface (CLI) allows you to query users, groups and other information.

https://docs.rstudio.com/connect/admin/appendix/cli

For example, something like the following should allow you to query all groups:

/opt/rstudio-connect/bin/usermanager list --groups

PS. The connectapi (still experimental) also allows you to query users and groups:

https://rstudio.github.io/connectapi/reference/index.html#section-users-and-groups

From the help for get_groups():

library(connectapi)
client <- connect()

# get all groups
get_groups(client, limit = Inf)
1 Like
3

Thanks for the info on the CLI

I've also discovered that I can see the group membership in the www UI by adding a group to an app and then clicking through to that group.... and that I can see all groups just by using the URL /connect/#/people/groups/

How can we request that URL is made visible in the www UI? It looks like it's been deliberately hidden for the SAML auto-group case, but I can see utility and I can't see any harm in it being available.

Also, is there any info on pre filling the user and group directories - any way we can do that? Or do we have to have a user or group login before they are visible? I can understand if that's the case (I know guessing the right GUID can be hard :slight_smile: ) - but just wanted to check.

:+1:

Stuart

4

In a similar type of question... how would one go about requesting that the "Add viewer" (and add collaborator) boxes do some kind of case insensitive fuzzy matching instead of just "starts with" ?

image

This would be particularly useful here as we have lots of groups that all start with the same words - e.g. "London - ..."