Problem

There may be instances where you wish to implement MFA (Multi-Factor Authentication) on Posit Workbench or Posit Connect. Formally, MFA isn't supported natively on our products at the time of this writing. That said, there is a workaround for those who may require MFA.

Solution

We have seen some customers implement a push model with their MFA provider that did not include the requirement for an additional prompt for MFA input. Unfortunately, we can not offer any support on such a setup, other than to say please engage support with your MFA provider to see about this possibility.
 
Workbench & Connect does not have the capability to support MFA on its own, but you should be able to implement this via proxied authentication. We'd suggest reviewing Apache as a proxy server combined with the mod_auth_openidc module, https://www.mod-auth-openidc.org, to integrate with an authentication provider supporting OpenID Connect. You may also configure proxied authentication using another module or web server; please consult your IT group for assistance configuring your proxy with your authentication provider.
 
An example reverse proxy (without authentication integrated) is described here:
https://support.rstudio.com/hc/en-us/articles/200552326-Running-RStudio-Server-with-a-Proxy
https://support.rstudio.com/hc/en-us/articles/227449427-Running-RStudio-Connect-with-a-Proxy
 
For Proxied authentication specifically, these links will also be useful:
https://support.rstudio.com/hc/en-us/articles/235191307-Understanding-Proxied-Authentication
 
Workbench:
http://docs.rstudio.com/ide/server-pro/authenticating-users.html#proxied-authentication
 
Connect:
https://docs.posit.co/connect/admin/authentication/proxied/index.html

It's worth noting that this is formally outside of Posit's support SLA! As such, it is worth engaging your infrastructure team for assistance.