Shiny Server is a great solution for BI/analytics reporting. It leverages all the power of the R language, which is the most popular open-source language for statistics, and it has a lot of useful functions for Data Mining, Machine Learning, Reporting, etc.
The open-source version of Shiny Server features no Authentication, and if it's open on Internet, it leaves your data exposed. In that case, you likely won't want everyone on the Internet to be able to see your internal analytics, so you'll need to install and configure the authentication yourself.
One of the easiest ways to add authentication to Shiny and, by extension, any unsecured web application, is to use Apache with Auth0 through the auth_openidc module.
This is also useful if you have a legacy web app with a username and password everyone shares or if you are hosting a server with static files you want to share.
So, let's get started with the steps.
Installing and Configuring Shiny
First, follow the instructions to install and configure Shiny Server.
When you have installed and configured Shiny and you're sure it works, modify your config file so it only serves to 127.0.0.1 (the local machine). This ensures that we don't accidentally expose the open server to the entire Internet.
listen 3838 127.0.0.1;
Installing Apache and the OpenID Connect Module
We will use Apache as a gateway to our app using Auth0's tutorial. This will enable Apache to serve as a gatekeeper—a reverse proxy that only serves after authentication.
If you don't already have apache2 installed, install it according to your platform and ensure that you have two modules: modproxy and modauth_openidc.
mod_proxy is pretty standard. It comes with most apache2 installs, but it is often disabled. To enable it, execute the following with root:
modauthopenidc is provided in Debian as libapache2-mod-auth-openidc. Binary packages are available at the releases page, or you can always build it from source. When it is installed, enable it with this command:
Configure an Auth0 Account
If you don't already have an Auth0 Account, create one here and set up the type of connections you want to allow. The default settings allow anyone to sign up, but you can set up a better scheme. For example, if you use Google Apps, you can just connect that and allow only those from your domain to access the server. Alternatively, you can use rules to decide which users are allowed access.
Configure Apache to Serve Shiny with Auth0
Make sure Shiny is running in the background while Apache tries to serve it. You can ensure that it's always on by running it as a Daemon.
You will need to follow the steps in the Apache tutorial. Note: when you are logged in to Auth0, the tutorial includes your own variables in the configuration to make it easier for you.
Create a configuration file for your website using the configuration from the tutorial as a starting point. Replace everything from OIDCProviderIssuer to Location with the code in the tutorial.
You will need to personalize your OIDCRedirectURI. I recommend using https://<yourapacheserver>/auth. Of course, replace <yourapacheserver> with the public address that will be used for your server.
You also need to generate or write some random string on
You should at least have a self-signed SSL certificate to test and a real one to deploy.
It should look something like this:
ProxyPass / http://localhost:3838/
ProxyPassReverse / http://localhost:3838/
OIDCScope "openid profile"
You can save it somewhere like
`/etc/apache/sites-available/001-shiny and then link it to make it active:
ln -s /etc/apache/sites-available/001-shiny /etc/apache/sites-enabled/001-shiny
As the tutorial states, Auth0's
clientSecret is by default Base64 encoded, which isn't compatible with this Apache plugin out of the box. We're going to change that in the near future, but in the meantime, you need to call an API to make sure the clientSecret isn't Base64 encoded for your account.
Get an access token by clicking "Try Me!" on the docs page and execute the code shown in step 3 of the tutorial to change
ACCESS_TOKEN to the access token you just received.
Now you have a Shiny Server that is secured with Auth0, which you can use to serve reports only to employees of your organization using username and password authentication or one of the many identity providers supported.
This same configuration works well for other cases. For example, suppose you have an old legacy web application for which everyone uses the same password. That scenario is not very safe, is it? You can give it an additional security layer with the above approach without modifying your site.
Shiny uses websockets for a lot of things. While we haven't explored tunneling, it is theoretically possible with proxy_wstunnel. For most users, this will work fine because if the library fails with websockets, it will automatically fall back to XHR.