Integrating RStudio Workbench / RStudio Server Pro with Active Directory using CentOS / RHEL

Follow

Integrating a Linux server with Active Directory is documented in detail by the various Linux distributions and others.  As such, the intent of this article is only to provide an overview of the process at each step as it relates to RStudio Workbench (previously RStudio Server Pro).  It's important to note this is a general resource to assist with a topic outside of our support.  These exact steps may not work in your specific environment, in which case we suggest reviewing the additional resources. 

The use of # in front of each command signifies the need to be executed as root or with sudo.

1) Install the prerequisites

We'll be using realmd to join with the AD server.  To use the realmd system, install the realmd package:

# yum install realmd

In addition, install the packages which are required to be able to manage the system using realmd with kerberos enabled.

RHEL 7/CentOS 7:

# yum install oddjob oddjob-mkhomedir sssd adcli samba-common samba-common-tools krb5-workstation openldap-clients policycoreutils-python

RHEL 8/binary equivalent:

# yum install oddjob oddjob-mkhomedir sssd adcli samba-common samba-common-tools krb5-workstation openldap-clients policycoreutils-python3

2) Join the underlying Linux server with Active Directory

Complete the join using the following syntax: realm join [-U user] [realm-name]

# realm join -U Administrator dc1.rstudio.example

You will be prompted for the password of the username entered.  If the command completes without error, confirm with:

# realm list

Example output:

rstudio.example
type: kerberos
realm-name: RSTUDIO.EXAMPLE
domain-name: rstudio.example
configured: kerberos-member
server-software: active-directory
client-software: sssd
required-package: oddjob
required-package: oddjob-mkhomedir
required-package: sssd
required-package: adcli
required-package: samba-common-tools
login-formats: %U@rstudio.example
login-policy: allow-realm-logins

 

The realm join completes these steps automatically:

  1. Joining the domain by creating an account entry for the system in the directory.
  2. Creating the /etc/krb5.keytab host keytab file.
  3. Configuring the domain in SSSD and restarting the service.
  4. Enabling domain users for the system services in PAM configuration and the /etc/nsswitch.conf file.

 

Below is the example /etc/sssd/sssd.conf file automatically produced from the realm join:

[sssd]
domains = rstudio.example
config_file_version = 2
services = nss, pam

[domain/rstudio.example]
ad_server = dc1.rstudio.example
ad_domain = rstudio.example
krb5_realm = RSTUDIO.EXAMPLE
realmd_tags = manages-system joined-with-adcli
cache_credentials = True
id_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_sasl_authid = RSP-ADSRV$
ldap_id_mapping = True
use_fully_qualified_names = True
fallback_homedir = /home/%u@%d
access_provider = ad

 

The following additions under the [domain/rstudio.example] section above may be required to enumerate groups and allow the /etc/pam.d/rstudio profile. Enumeration is required to share projects with users who have never logged in to RStudio Workbench but can be listed from LDAP. If you set enumerate as false, your users can only share projects with other users that logged into RStudio at least once. 

ad_gpo_map_service = +rstudio​
enumerate = true ​

 

You can now check and verify an AD account using the id command before moving onto the next section.

# id user@rstudio.example

  

3) Configure the rstudio PAM profile

After integrating the underlying Linux operating system with Active Directory, you can copy the /etc/pam.d/login PAM profile for use with RStudio Workbench as suggested here:

# cp /etc/pam.d/login /etc/pam.d/rstudio

 

Contents:

# cat /etc/pam.d/rstudio

#%PAM-1.0
auth [user_unknown=ignore success=ok ignore=ignore default=bad] pam_securetty.so
auth substack system-auth
auth include postlogin
account required pam_nologin.so
account include system-auth
password include system-auth
# pam_selinux.so close should be the first session rule
session required pam_selinux.so close
session required pam_loginuid.so
session optional pam_console.so
# pam_selinux.so open should only be followed by sessions to be executed in the user context
session required pam_selinux.so open
session required pam_namespace.so
session optional pam_keyinit.so force revoke
session include system-auth
session include postlogin
-session optional pam_ck_connector.so

  

4) Test RStudio Workbench and AD integration

Login to your instance with an Active Directory ID to test.

Assuming the login completes, you can confirm a kerberos ticket has been generated with system("klist") 

 

> system("klist")
Ticket cache: KEYRING:persistent:1543801107:krb_ccache_RNjxOTS
Default principal: user@RSTUDIO.EXAMPLE

Valid starting       Expires              Service principal
02/01/2019 14:47:44  02/02/2019 00:47:44  krbtgt/RSTUDIO.EXAMPLE@RSTUDIO.EXAMPLE
	renew until 02/08/2019 14:47:44

 

Additional resources:

Redhat: Using REALMD To Connect To an Active Directory Domain

Comments