This article is based on this section of the administrator's guide.
OAuth2 authentication is available to authenticate against the Google OAuth2 service. RStudio Connect will use OAuth2 authentication if the
Authentication.Provider setting has a value of
[Authentication] Provider = oauth2
The appendix in the administrator's guide contains information about each OAuth2 configuration option.
In order for RStudio Connect to use Google as an OAuth2 service, you will need a client ID and client secret.
Obtaining a Client ID and Client Secret
These instructions tell you how to obtain an OAuth2 client ID and client secret. We recommend a distinct set of credentials for each application you configure to use the Google OAuth2 service.
- Visit the Google Developers Console and create a new project. Give it a name of your choosing, such as “rstudio-connect”.
- Once the project is created, locate and enable the “Google+ API”.
- In the left navigation window, click on “Credentials”, then goto the “OAuth consent screen” tab, fill in the information requested and click “Save”.
- Once again, click “Credentials” in the left navigation window. Then click the dropdown button “New credentials”, then “OAuth client ID”.
https://HOST:PORT). For “Authorized redirect URIs”, use your RStudio Connect server address with
- Click “Create”. Your client ID and client secret will be shown to you.
Add the client ID and secret to your configuration file as shown in the example below.
[OAuth2] DiscoveryEndpoint = https://accounts.google.com/.well-known/openid-configuration ClientId = <CLIENT ID> ClientSecret = <CLIENT SECRET>
ClientId and either
ClientSecretFile configured, you can use your Google Apps account to sign into RStudio Connect!
The default configuration allows all Google account holders to access RStudio Connect. We recommend that you limit access to specific domains that are used by your organization.
Verify that you can use your Google Apps account to sign into RStudio Connect before attempting to configure access restrictions.
OAuth2.AllowedDomains setting specifies the set of domains that are allowed to access your RStudio Connect server. Multiple domains should be space-separated.
[OAuth2] AllowedDomains = company.com subsidiary.com
You may also restrict access by email address if using domain alone is insufficient. The
OAuth2.AllowedEmails setting specifies the set of email addresses that are allowed to access your RStudio Connect server. Multiple addresses should be space-separated.
[OAuth2] AllowedEmails = firstname.lastname@example.org email@example.com
It is important to understand how the
AllowedEmails properties interact.
AllowedDomains is configured, only email addresses with a listed domain will be permitted access.
AllowedEmails is configured, only listed email addresses will be permitted access.
AllowedEmails are specified, email addresses given in
AllowedEmails are permitted access in addition to email addresses with a domain listed in
RStudio Connect allows users to search for collaborators against the user directory associated with your Google Apps account. That search is performed on behalf of the current user. Different accounts may have different visibility within the user directory and therefore will see different results. This is most obvious when you have configured RStudio Connect to allow access to two different domains. Users in
company.com, for example, will likely not be able to search for colleagues in
RStudio Connect augments the Google Apps user directory search with a local search across its set of known accounts. Once your colleague has created their own RStudio Connect account, they will become discoverable.