Skip to main content

Integrating Shiny Server Pro with Active Directory using CentOS / RHEL

Jay Clark
  • Updated

Integrating a Linux server with Active directory is documented in detail by the various Linux distributions and others.  As such, the intent of this article is only to provide an overview of the process at each step as it relates to RStudio.  It's important to note this is a general resource to assist with a topic outside of our support.  These exact steps may not work in your specific environment, in which case we suggest reviewing the additional resources. 

The use of # in front of each command signifies the need to be executed as root or with sudo.

1) Install the prerequisites

We'll be using realmd to join with the AD server.  To use the realmd system, install the realmd package:

# yum install realmd

In addition, install the packages which are required to be able to manage the system using realmd with kerberos enabled.

# yum install oddjob oddjob-mkhomedir sssd adcli samba-common samba-common-tools krb5-workstation openldap-clients policycoreutils-python

 

2) Join the underlying Linux server with Active Directory

Complete the join using the following syntax: realm join [-U user] [realm-name]

# realm join -U Administrator dc1.rstudio.example

You will be prompted for the password of the username entered.  If the command completes without error, confirm with:

# realm list

Example output:

rstudio.example
 type: kerberos
 realm-name: RSTUDIO.EXAMPLE
 domain-name: rstudio.example
 configured: kerberos-member
 server-software: active-directory
 client-software: sssd
 required-package: oddjob
 required-package: oddjob-mkhomedir
 required-package: sssd
 required-package: adcli
 required-package: samba-common-tools
 login-formats: %U@rstudio.example
 login-policy: allow-realm-logins

 

The realm join completes these steps automatically:

  1. Joining the domain by creating an account entry for the system in the directory.
  2. Creating the /etc/krb5.keytab host keytab file.
  3. Configuring the domain in SSSD and restarting the service.
  4. Enabling domain users for the system services in PAM configuration and the /etc/nsswitch.conf file.

 

Below is the example /etc/sssd/sssd.conf file automatically produced from the realm join:

[sssd]
domains = rstudio.example
config_file_version = 2
services = nss, pam

[domain/rstudio.example]
ad_server = dc1.rstudio.example
ad_domain = rstudio.example
krb5_realm = RSTUDIO.EXAMPLE
realmd_tags = manages-system joined-with-adcli
cache_credentials = True
id_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_sasl_authid = RSP-ADSRV$
ldap_id_mapping = True
use_fully_qualified_names = True
fallback_homedir = /home/%u@%d
access_provider = ad

 

One or more of the following additions under the [domain/rstudio.example] section above may be required to enumerate groups and allow the /etc/pam.d/shiny-server profile: 

ad_gpo_map_service = +shiny-server
enumerate = true ​

 

You can now check and verify an AD account using the id command before moving onto the next section.

# id user@rstudio.example

  

3) Configure the shiny-server PAM profile

After integrating the underlying Linux operating system with Active Directory, you can copy the /etc/pam.d/login PAM profile for use with Shiny Server Pro as suggested here:

# cp /etc/pam.d/login /etc/pam.d/shiny-server

 

Contents:

# cat /etc/pam.d/shiny-server

#%PAM-1.0
auth [user_unknown=ignore success=ok ignore=ignore default=bad] pam_securetty.so
auth substack system-auth
auth include postlogin
account required pam_nologin.so
account include system-auth
password include system-auth
# pam_selinux.so close should be the first session rule
session required pam_selinux.so close
session required pam_loginuid.so
session optional pam_console.so
# pam_selinux.so open should only be followed by sessions to be executed in the user context
session required pam_selinux.so open
session required pam_namespace.so
session optional pam_keyinit.so force revoke
session include system-auth
session include postlogin
-session optional pam_ck_connector.so

  

4) Test Shiny Server Pro and AD integration

Login to your instance with an Active Directory ID to test.  

Any login failures will be logged to  /var/log/secure 

 

Additional resources:

Redhat: Using REALMD To Connect To an Active Directory Domain

Related articles