Package {shinymanager}

Check credentials

Description

Check credentials

Usage

check_credentials(db, passphrase = NULL)

Arguments

Details

The credentials data.frame can have the following columns:

• user (mandatory) : the user's name.

• password (mandatory) : the user's password.

• admin (optional) : logical, is user have admin right ? If so, user can access the admin mode (only available using a SQLite database). Initialize to FALSE if missing.

• start (optional) : the date from which the user will have access to the application. Initialize to NA if missing.

• expire (optional) : the date from which the user will no longer have access to the application. Initialize to NA if missing.

• applications (optional) : the name of the applications to which the user is authorized, separated by a semicolon. The name of the application corresponds to the name of the directory, or can be declared using : options("shinymanager.application" = "my-app")

• additional columns : add others columns to retrieve the values server-side after authentication

Value

Return a function with two arguments: user and password to be used in module-authentication. The authentication function returns a list with 4 slots :

• result : logical, result of authentication.

• expired : logical, is user has expired ? Always FALSE if db doesn't have a expire column.

• authorized : logical, is user can access to his app ? Always TRUE if db doesn't have a applications column.

• user_info : the line in db corresponding to the user.

See Also

create_db, create_sql_db, check_credentials

Examples

# data.frame with credentials info
credentials <- data.frame(
  user = c("fanny", "victor"),
  password = c("azerty", "12345"),
  stringsAsFactors = FALSE
)

# check a user
check_credentials(credentials)("fanny", "azerty")
check_credentials(credentials)("fanny", "azert")
check_credentials(credentials)("fannyyy", "azerty")

# data.frame with credentials info
# using hashed password with scrypt
credentials <- data.frame(
  user = c("fanny", "victor"),
  password = c(scrypt::hashPassword("azerty"), scrypt::hashPassword("12345")),
  is_hashed_password = TRUE,
  stringsAsFactors = FALSE
)

# check a user
check_credentials(credentials)("fanny", "azerty")
check_credentials(credentials)("fanny", "azert")
check_credentials(credentials)("fannyyy", "azerty")

## Not run: 

## With a SQLite database:
check_credentials("credentials.sqlite", passphrase = "supersecret")


## With a SQL database:
check_credentials("config_db.yml")


## End(Not run)

Create credentials database

Description

Create a SQLite database with credentials data protected by a password.

Usage

create_db(
  credentials_data,
  sqlite_path,
  passphrase = NULL,
  flags = RSQLite::SQLITE_RWC
)

Arguments

Details

The credentials data.frame can have the following columns:

• user (mandatory) : the user's name.

• password (mandatory) : the user's password.

• admin (optional) : logical, is user have admin right ? If so, user can access the admin mode (only available using a SQLite database). Initialize to FALSE if missing.

• start (optional) : the date from which the user will have access to the application. Initialize to NA if missing.

• expire (optional) : the date from which the user will no longer have access to the application. Initialize to NA if missing.

• applications (optional) : the name of the applications to which the user is authorized, separated by a semicolon. The name of the application corresponds to the name of the directory, or can be declared using : options("shinymanager.application" = "my-app")

• additional columns : add others columns to retrieve the values server-side after authentication

See Also

create_db, create_sql_db, check_credentials, read_db_decrypt

Examples

## Not run: 

library(shiny)
library(shinymanager)

#### init the Sqlite Database
# Credentials data
credentials <- data.frame(
  user = c("shiny", "shinymanager"),
  password = c("azerty", "12345"), # password will automatically be hashed
  stringsAsFactors = FALSE
)

# you can use keyring package to set database key
library(keyring)
key_set("R-shinymanager-key", "obiwankenobi")

# Create the database
create_db(
  credentials_data = credentials,
  sqlite_path = "/path/to/database.sqlite", # will be created
   passphrase = key_get("R-shinymanager-key", "obiwankenobi")
   # passphrase = "secret"  # or just a word, without keyring
)

### Use in shiny
ui <- fluidPage(
  tags$h2("My secure application"),
  verbatimTextOutput("auth_output")
)

# Wrap your UI with secure_app
ui <- secure_app(ui, choose_language = TRUE)


server <- function(input, output, session) {
 
 # call the server part
 # check_credentials returns a function to authenticate users
 res_auth <- secure_server(
   check_credentials = check_credentials(
       db = "/path/to/database.sqlite", 
       passphrase = key_get("R-shinymanager-key", "obiwankenobi")
   )
 )
 
 output$auth_output <- renderPrint({
   reactiveValuesToList(res_auth)
 })
 
 observe({
   print(input$shinymanager_where)
   print(input$shinymanager_language)
 })
 
 # your classic server logic
 
}

shinyApp(ui, server)


## End(Not run)

Create credentials SQL database

Description

Create a SQL (not SQLite but Postgres, MSSQL, MySQL...) database with credentials data using DBI interface.

Usage

create_sql_db(credentials_data, config_path)

Arguments

Details

The credentials data.frame can have the following columns:

• user (mandatory) : the user's name.

• password (mandatory) : the user's password.

• admin (optional) : logical, is user have admin right ? If so, user can access the admin mode (only available using a SQLite database). Initialize to FALSE if missing.

• start (optional) : the date from which the user will have access to the application. Initialize to NA if missing.

• expire (optional) : the date from which the user will no longer have access to the application. Initialize to NA if missing.

• applications (optional) : the name of the applications to which the user is authorized, separated by a semicolon. The name of the application corresponds to the name of the directory, or can be declared using : options("shinymanager.application" = "my-app")

• additional columns : add others columns to retrieve the values server-side after authentication

See Also

create_db, create_sql_db, check_credentials

Examples

## Not run: 

library(shiny)
library(shinymanager)

#### init the SQL Database
# first edit the .yml configuration file
system.file("sql_config/pg_template.yml", package = "shinymanager")


# Init Credentials data
credentials <- data.frame(
  user = c("shiny", "shinymanager"),
  password = c("azerty", "12345"), # password will automatically be hashed
  stringsAsFactors = FALSE
)

# Create SQL database
create_sql_db(
  credentials_data = credentials,
  config_path = "path/to/your_sql_configuration.yml"
)

### Use in shiny
ui <- fluidPage(
  tags$h2("My secure application"),
  verbatimTextOutput("auth_output")
)

# Wrap your UI with secure_app
ui <- secure_app(ui, choose_language = TRUE)


server <- function(input, output, session) {
 
 # call the server part
 # check_credentials returns a function to authenticate users
 res_auth <- secure_server(
   check_credentials = check_credentials(db = "path/to/your_sql_configuration.yml")
 )
 
 output$auth_output <- renderPrint({
   reactiveValuesToList(res_auth)
 })
 
 observe({
   print(input$shinymanager_where)
   print(input$shinymanager_language)
 })
 
 # your classic server logic
 
}

shinyApp(ui, server)


## End(Not run)

Modify shinymanager labels to use custom text

Description

See all labels registered with get_labels(), then set custom text with set_labels().

Usage

set_labels(language, ...)

get_labels(language = "en")

Arguments

Value

get_labels() return a named list with all labels registered.

Examples

# In global.R for example:
set_labels(
  language = "en",
  "Please authenticate" = "You have to login",
  "Username:" = "What's your name:",
  "Password:" = "Enter your password:"
)

# same with named list
set_labels(
  language = "en",
  list(
    "Please authenticate" = "You have to login",
    "Username:" = "What's your name:",
    "Password:" = "Enter your password:"
 )
)

Read / Write crypted table from / to a SQLite database

Description

Read / Write crypted table from / to a SQLite database

Usage

write_db_encrypt(conn, value, name = "credentials", passphrase = NULL)

read_db_decrypt(conn, name = "credentials", passphrase = NULL)

Arguments

Value

a data.frame for read_db_decrypt.

See Also

create_db

Examples

# connect to database
conn <- DBI::dbConnect(RSQLite::SQLite(), dbname = ":memory:")

# write to database
write_db_encrypt(conn, value = head(iris), name = "iris", passphrase = "supersecret")

# read
read_db_decrypt(conn = conn, name = "iris", passphrase = "supersecret")


# with wrong passphrase
## Not run: 
read_db_decrypt(conn = conn, name = "iris", passphrase = "forgotten")

## End(Not run)

# with DBI method you'll get a crypted blob
DBI::dbReadTable(conn = conn, name = "iris")

# add some users to database
## Not run: 
conn <- DBI::dbConnect(RSQLite::SQLite(), dbname = "path/to/database.sqlite")

# update "credentials" table
current_user <- read_db_decrypt(
  conn,
  name = "credentials",
  passphrase = key_get("R-shinymanager-key", "obiwankenobi")
)

add_user <- data.frame(user = "new", password = "pwdToChange",
                      start = NA, expire = NA, admin = TRUE)

new_users <- rbind.data.frame(current_user, add_user)

write_db_encrypt(
  conn,
  value = new_users,
  name = "credentials",
  key_get("R-shinymanager-key", "obiwankenobi")
)

# update "pwd_mngt" table
pwd_mngt <- read_db_decrypt(
  conn,
  name = "pwd_mngt",
  passphrase = key_get("R-shinymanager-key", "obiwankenobi")
)

# columns of the new row must match the table (other columns, like custom
# or optional ones, must be added, e.g. with NA)
pwd_mngt <- rbind.data.frame(
  pwd_mngt,
  data.frame(user = "new", must_change = T, have_changed = F,
             date_change = "", n_wrong_pwd = 0)
)

write_db_encrypt(
  conn,
  value = pwd_mngt,
  name = "pwd_mngt",
  passphrase = key_get("R-shinymanager-key", "obiwankenobi")
)

## End(Not run)

DBI::dbDisconnect(conn)

Create a FAB button

Description

Create a fixed button in page corner with additional button(s) in it

Usage

fab_button(
  ...,
  position = c("bottom-right", "top-right", "bottom-left", "top-left", "none"),
  animation = c("slidein", "slidein-spring", "fountain", "zoomin"),
  toggle = c("hover", "click"),
  inputId = NULL,
  label = NULL
)

Arguments

Examples

library(shiny)
library(shinymanager)

ui <- fluidPage(

  tags$h1("FAB button"),

  tags$p("FAB button:"),
  verbatimTextOutput(outputId = "res_fab"),

  tags$p("Logout button:"),
  verbatimTextOutput(outputId = "res_logout"),

  tags$p("Info button:"),
  verbatimTextOutput(outputId = "res_info"),

  fab_button(
    actionButton(
      inputId = "logout",
      label = "Logout",
      icon = icon("arrow-right-from-bracket")
    ),
    actionButton(
      inputId = "info",
      label = "Information",
      icon = icon("info")
    ),
    inputId = "fab"
  )

)

server <- function(input, output, session) {

  output$res_fab <- renderPrint({
    input$fab
  })

  output$res_logout <- renderPrint({
    input$logout
  })

  output$res_info <- renderPrint({
    input$info
  })

}

if (interactive()) {
  shinyApp(ui, server)
}

Simple password generation

Description

Simple password generation

Usage

generate_pwd(n = 1)

Arguments

Value

a character

Examples

generate_pwd()

generate_pwd(3)

Authentication module

Description

Authentication module

Usage

auth_ui(
  id,
  status = "primary",
  tags_top = NULL,
  tags_bottom = NULL,
  background = NULL,
  choose_language = NULL,
  lan = NULL,
  ...
)

auth_server(
  input,
  output,
  session,
  check_credentials,
  use_token = FALSE,
  lan = NULL
)

Arguments

Value

A reactiveValues with 3 slots :

• result : logical, result of authentication.

• user : character, name of connected user.

• user_info : information about the user.

Examples

if (interactive()) {
  
  library(shiny)
  library(shinymanager)
  
  # data.frame with credentials info
  # credentials <- data.frame(
  #   user = c("fanny", "victor"),
  #   password = c("azerty", "12345"),
  #   comment = c("alsace", "auvergne"),
  #   stringsAsFactors = FALSE
  # )
  
  # you can hash the password using scrypt
  # and adding a column is_hashed_password
  # data.frame with credentials info
  credentials <- data.frame(
    user = c("fanny", "victor"),
    password = c(scrypt::hashPassword("azerty"), scrypt::hashPassword("12345")),
    is_hashed_password = TRUE,
    comment = c("alsace", "auvergne"),
    stringsAsFactors = FALSE
  )
  
  # app
  ui <- fluidPage(
    
    # authentication module
    auth_ui(
      id = "auth",
      # add image on top ?
      tags_top = 
        tags$div(
          tags$h4("Demo", style = "align:center"),
          tags$img(
            src = "https://www.r-project.org/logo/Rlogo.png", width = 100
        )
      ),
      # add information on bottom ?
      tags_bottom = tags$div(
        tags$p(
          "For any question, please  contact ",
          tags$a(
            href = "mailto:someone@example.com?Subject=Shiny%20aManager",
            target="_top", "administrator"
          )
        )
      ),
      # change auth ui background ?
      # https://developer.mozilla.org/fr/docs/Web/CSS/background
      background  = "linear-gradient(rgba(0, 0, 255, 0.5),
                       rgba(255, 255, 0, 0.5)),
                       url('https://www.r-project.org/logo/Rlogo.png');", 
      # set language ?
      lan = use_language("fr")
    ),
    
    # result of authentication
    verbatimTextOutput(outputId = "res_auth"),
    
    # classic app
    headerPanel('Iris k-means clustering'),
    sidebarPanel(
      selectInput('xcol', 'X Variable', names(iris)),
      selectInput('ycol', 'Y Variable', names(iris),
                  selected=names(iris)[[2]]),
      numericInput('clusters', 'Cluster count', 3,
                   min = 1, max = 9)
    ),
    mainPanel(
      plotOutput('plot1')
    )
  )
  
  server <- function(input, output, session) {
    
    # authentication module
    auth <- callModule(
      module = auth_server,
      id = "auth",
      check_credentials = check_credentials(credentials)
    )
    
    output$res_auth <- renderPrint({
      reactiveValuesToList(auth)
    })
    
    # classic app
    selectedData <- reactive({
      
      req(auth$result)  # <---- dependency on authentication result
      
      iris[, c(input$xcol, input$ycol)]
    })
    
    clusters <- reactive({
      kmeans(selectedData(), input$clusters)
    })
    
    output$plot1 <- renderPlot({
      palette(c("#E41A1C", "#377EB8", "#4DAF4A", "#984EA3",
                "#FF7F00", "#FFFF33", "#A65628", "#F781BF", "#999999"))
      
      par(mar = c(5.1, 4.1, 0, 1))
      plot(selectedData(),
           col = clusters()$cluster,
           pch = 20, cex = 3)
      points(clusters()$centers, pch = 4, cex = 4, lwd = 4)
    })
  }
  
  shinyApp(ui, server)
  
}

New password module

Description

New password module

Usage

pwd_ui(id, tag_img = NULL, status = "primary", lan = NULL)

pwd_server(
  input,
  output,
  session,
  user,
  update_pwd,
  validate_pwd = NULL,
  use_token = FALSE,
  lan = NULL
)

Arguments

Examples

if (interactive()) {

  library(shiny)
  library(shinymanager)

  ui <- fluidPage(
    tags$h2("Change password module"),
    actionButton(
      inputId = "ask", label = "Ask to change password"
    ),
    verbatimTextOutput(outputId = "res_pwd")
  )

  server <- function(input, output, session) {

    observeEvent(input$ask, {
      insertUI(
        selector = "body",
        ui = tags$div(
          id = "module-pwd",
          pwd_ui(id = "pwd")
        )
      )
    })

    output$res_pwd <- renderPrint({
      reactiveValuesToList(pwd_out)
    })

    pwd_out <- callModule(
      module = pwd_server,
      id = "pwd",
      user = reactiveValues(user = "me"),
      update_pwd = function(user, pwd) {
        # store the password somewhere
        list(result = TRUE)
      }
    )

    observeEvent(pwd_out$relog, {
      removeUI(selector = "#module-pwd")
    })
  }

  shinyApp(ui, server)

}

Secure a Shiny application and manage authentication

Description

Secure a Shiny application and manage authentication

Usage

secure_app(
  ui,
  ...,
  enable_admin = FALSE,
  head_auth = NULL,
  theme = NULL,
  language = "en",
  fab_position = "bottom-right"
)

secure_server(
  check_credentials,
  timeout = 15,
  inputs_list = NULL,
  max_users = NULL,
  fileEncoding = "",
  keep_token = FALSE,
  validate_pwd = NULL,
  send_mail = NULL,
  session = shiny::getDefaultReactiveDomain()
)

Arguments

Details

If database credentials, you can configure inputs with inputs_list for editing users information from the admin console. start, expire, admin and password are not configurable. The others columns are rendering by defaut using a textInput. You can modify this using inputs_list. inputs_list must be a named list. Each name must be a column name, and then we must have the function shiny to call fun and the arguments args like this : list(group = list( fun = "selectInput", args = list( choices = c("all", "restricted"), multiple = TRUE, selected = c("all", "restricted") ) ) )

You can specify if you want to allow downloading users file, sqlite database and logs from within the admin panel by invoking options("shinymanager.download"). It defaults to c("db", "logs", "users"), that allows downloading all. You can specify options("shinymanager.download" = "db" if you want allow admin to download only sqlite database, options("shinymanager.download" = "logs") to allow logs download or options("shinymanager.download" = "") to disable all.

Using options("shinymanager.pwd_validity"), you can set password validity period. It defaults to Inf. You can specify for example options("shinymanager.pwd_validity" = 90) if you want to force user changing password each 90 days.

Using options("shinymanager.pwd_failure_limit"), you can set password failure limit. It defaults to Inf. You can specify for example options("shinymanager.pwd_failure_limit" = 5) if you want to lock user account after 5 wrong password.

Using options("shinymanager.auto_sqlite_reader"), you can set reactiveFileReader time (milliseconds) used to look at sqlite db only. Used and useful in admin panel to prevent bug having potentially multiple admin session. It defaults to 1000

Using options("shinymanager.auto_sql_reader"), you can set reactiveTimer SQL (not sqlite) admin reader. It defaults to Inf (disabled). It's only needed to prevent potential bug if two ore more admin are updated users at the same time.

Using options("shinymanager.write_logs"), you can activate or not writing users connection logs. Default to TRUE

Using options("shinymanager.show_logs"), you can activate or not showing users connection logs in admin panel. Default to TRUE

Using options("shinymanager.reset_password"), you can enable a self-service password reset link ("Forgot password?") on the authentication page. Default to FALSE. It requires a email column in the credentials, a send_mail function passed to secure_server and a SQLite / SQL backend: otherwise the link is hidden, with a warning (once per R process) giving the reason. The option must be set before the authentication page is built (e.g. in global.R, not in the server function). Two modes are available:

• TRUE : the user must enter a valid username and its associated email.

• "username" : the user only enters a username; the temporary password is sent to the email stored for that user (if any).

In both cases a temporary password is generated, emailed, and the user is forced to change it on next login. A generic confirmation message is displayed (before sending the email) to avoid account enumeration. Known limits: an account that can't reset its password (see shinymanager.reset_password_max and shinymanager.reset_password_unlock below) gets a dedicated message and a failed sending (SMTP error, misconfiguration) shows an error popup; both reveal that the account exists. The reset button is enabled again after the same minimal delay (a few seconds) whatever the outcome, unless the sending takes longer. Each attempt is logged (Reset password, Reset password: <reason>) and sending errors are also raised as R warnings. No reset is done for an expired account or an account not authorized for the application. Note: the temporary password replaces the current one as soon as the email is sent, before the user proves access to the mailbox. Anyone who knows a username (and its email with TRUE) can thus invalidate the password of this account, and use up its resets when shinymanager.reset_password_max is set. We recommend the TRUE mode rather than "username", and to set shinymanager.reset_password_max knowing this risk. By default the email is looked up in the email column; use options("shinymanager.email_column" = "my_col") to use another column name.

Using options("shinymanager.reset_password_validity"), you can limit the validity, in minutes, of the temporary password sent by email (e.g. 20). Default to NA (no expiration). Once expired, login with it fails with a dedicated message (logged as Reset password: expired) and the user has to request a new one. Passwords generated by an admin never expire this way, and an admin reset cancels a pending emailed password. The send_mail function does not receive the validity: mention it in the email by reading getOption("shinymanager.reset_password_validity"). The expiration is stored as text (UTC) in a temp_pwd_expire column of the pwd_mngt table: created automatically with SQLite, to be added manually as a text column with a SQL backend (without it, the temporary password does not expire).

Using options("shinymanager.reset_password_max"), you can limit the number of password resets a user can request in a row (e.g. 3). Default to Inf (no limit). The counter is reset on the next successful login with a non temporary password, or by an admin reset. It is stored in a n_user_reset column of the pwd_mngt table: created automatically with SQLite, to be added manually as an integer column with a SQL backend (without it, no limit).

Using options("shinymanager.reset_password_cooldown"), you can set the minimal time, in seconds (not minutes, unlike timeout and shinymanager.reset_password_validity), before a user who received a reset email can get a new one. Default to 60; 0 for no limit. It is checked on the server: a request within this time gets the same generic message, sends nothing and is logged as Reset password: too soon. This limit is kept in memory: it is lost when the application restarts, and each R process (worker) has its own.

Using options("shinymanager.reset_password_unlock"), you can choose whether a password reset unlocks an account locked by shinymanager.pwd_failure_limit. Default to TRUE; with FALSE, only an admin can unlock it and no email is sent.

Value

A reactiveValues containing informations about the user connected.

Note

A special input value will be accessible server-side with input$shinymanager_where to know in which step user is : authentication, application, admin or password.

Examples

if (interactive()) {

  # define some credentials
  credentials <- data.frame(
    user = c("shiny", "shinymanager"),
    password = c("azerty", "12345"),
    stringsAsFactors = FALSE
  )

  library(shiny)
  library(shinymanager)

  ui <- fluidPage(
    tags$h2("My secure application"),
    verbatimTextOutput("auth_output")
  )

  # Wrap your UI with secure_app
  ui <- secure_app(ui, choose_language = TRUE)

  # change auth ui background ?
  # ui <- secure_app(ui,
  #                  background  = "linear-gradient(rgba(0, 0, 255, 0.5), 
  #                  rgba(255, 255, 0, 0.5)),
  #                  url('https://www.r-project.org/logo/Rlogo.png')  no-repeat center fixed;")

  server <- function(input, output, session) {

    # call the server part
    # check_credentials returns a function to authenticate users
    res_auth <- secure_server(
      check_credentials = check_credentials(credentials)
    )

    output$auth_output <- renderPrint({
      reactiveValuesToList(res_auth)
    })

    observe({
      print(input$shinymanager_where)
      print(input$shinymanager_language)
    })
    
    # your classic server logic

  }

  shinyApp(ui, server)

}

Send an email through an SMTP server

Description

Optional helper to send an email using the emayili package. This is only a convenience wrapper: shinymanager never requires emayili to be installed. You can use this function inside the send_mail callback of secure_server, or provide your own sending function using any other backend (blastula, sendmailR, gmailr, system sendmail, ...).

Usage

send_smtp_mail(
  to,
  subject,
  body,
  from,
  host,
  port = 587,
  username = NULL,
  password = NULL,
  html = FALSE,
  timeout = 30,
  max_times = 1
)

Arguments

Value

TRUE invisibly on success. An error is raised if emayili is not installed or if sending fails.

Examples

## Not run: 

# inside secure_server()
secure_server(
  check_credentials = check_credentials("credentials.sqlite", passphrase = "supersecret"),
  send_mail = function(user, email, temp_password) {
    send_smtp_mail(
      to = email,
      subject = "Password reset",
      body = paste0("Hello ", user, ", your temporary password is: ", temp_password),
      from = "no-reply@example.com",
      host = "smtp.example.com",
      port = 587,
      username = "no-reply@example.com",
      password = "smtp_secret"
    )
  }
)


## End(Not run)

Use shinymanager labels

Description

See all labels registered with get_labels(), then set custom text with set_labels().

Usage

use_language(lan = "en")

Arguments

Value

A language object

Examples

use_language(lan = "fr")