[Ext] Re: R/Shiny integration

[Bryan Wooten]

Thanks Greg.
 "Put an Apache httpd with mod_proxy_http in front with a Shibboleth SP installed”

That is what I was thinking… But some other R/Shiny link mentioned custom header names (security through obscurity?) and not REMOTE_USER or even their own default header name?

Thanks for re-affirming I am not yet completely senile. :)

-Bryan


From: users <users-bounces at shibboleth.net<mailto:users-bounces at shibboleth.net>> on behalf of Greg Haverkamp <gahaverkamp at lbl.gov<mailto:gahaverkamp at lbl.gov>>
Reply-To: "users at shibboleth.net<mailto:users at shibboleth.net>" <users at shibboleth.net<mailto:users at shibboleth.net>>
Date: Monday, June 25, 2018 at 8:24 PM
To: "users at shibboleth.net<mailto:users at shibboleth.net>" <users at shibboleth.net<mailto:users at shibboleth.net>>
Subject: [Ext] Re: R/Shiny integration

******************************************************
WARNING: Stop. Think. Read. This is an external email.
******************************************************

On Mon, Jun 25, 2018 at 7:13 PM Bryan Wooten <bryan.wooten at utah.edu<mailto:bryan.wooten at utah.edu>> wrote:
"Proxied authentication allows these tools to integrate with other Single Sign On (SSO) and Identity Access Management (IAM) tools that are not directly supported.“

I can’t find any direct support for SAML?

They wouldn't prescribe a proxy for external authentication if they did direct SAML.


Any and all pro-tips / insults gladly accepted.

Note: the R/Shiny app is currently doing simple AD authentication, the owners want Duo added. Our Shib/CAS currently supports Duo. So I want to move this R/Shiny app to either CAS or Shib SSO and not direct AD authentication.

Put an Apache httpd with mod_proxy_http in front with a Shibboleth SP installed and configured for the proxy location with ShibUserHeaders On (but be sure to read the caveats).  Decide which environment variable you're going to have to set the username, and configure that in the backend server.

I imagine this can be done with CAS, too; I just haven't ever used it.

Greg
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20180626/1eefb422/attachment.html>