OSC RStudio App erroring

[mani91-ug]

Hi,

I'm trying to run the OSC Rstudio app on an AlmaLinux image on a Microsoft Azure CycleCloud cluster. I'm running the following commands to set up the app and applying what I believe are minimal changes to get the app to work with my setup:

git clone --single-branch -b v0.27.1 https://github.com/OSC/bc_osc_rstudio_server /var/www/ood/apps/sys/rstudio
sed -i 's/- "owens"/- "my_cluster"/g' /var/www/ood/apps/sys/rstudio/form.yml
sed -n -i 'p;18a "export PATH="$PATH:/usr/lib/rstudio-server/bin"' /var/www/ood/apps/sys/jupyter/template/script.sh.erb

The image has R, Rstudio and proot installed I am trying to avoid using a container.

The app appears on the portal but when I try to connect I get the following:

The log file displays the following lines:

2024-06-11T09:02:49.297123Z [rserver] ERROR Failed to validate sign-in with invalid CSRF form; LOGGED FROM: bool rstudio::server::auth::common::validateSignIn(const rstudio::core::http::Request&, rstudio::core::http::Response*) src/cpp/server/auth/ServerAuthCommon.cpp:136
2024-06-11T09:02:52.408399Z [rserver] DEBUG Request for main page with no user-identifier - redirecting to login page: /
2024-06-11T09:02:55.444481Z [rserver] DEBUG Request for main page with no user-identifier - redirecting to login page: /

I then tried switching off authentication (just to get it working) by setting --auth-none 1.

Upon trying to login to the app I do not get redirected to the authentication screen, but just get a blank page like the following:

The log file displays the following in this case but I never see RStudio start up, just the blank page above:

_2024-06-11T09:12:27.065764Z [rserver] ERROR Failed to validate sign-in with invalid CSRF form; LOGGED FROM: bool rstudio::server::auth::common::validateSignIn(const rstudio::core::http::Request&, rstudio::core::http::Response*) src/cpp/server/auth/ServerAuthCommon.cpp:136
2024-06-11T09:12:27.083290Z [rserver] DEBUG Created new UserSession for: muneeb (total: 1)
2024-06-11T09:12:27.089375Z [rserver] DEBUG User db query start: muneeb
2024-06-11T09:12:27.095115Z [rserver] DEBUG No record found for user in db: muneeb
2024-06-11T09:12:27.101050Z [rserver] DEBUG Adding user to database: muneeb
2024-06-11T09:12:27.107846Z [rserver] DEBUG Adding session cookie: muneeb|Tue%2C%2011%20Jun%202024%2010%3A12%3A27%20GMT|MNHhzTU%2Fsh2%2Bk8fp%2FDucD%2F3JdNlI1MYjEl2HakCVwDM%3D for user: muneeb

Is there something I am missing here?

[johrstrom]

What version of RStudio are you trying to run? I want to say they changed the CSRF token cookie name at some point.

This comment says it will change, but doesn't indicate what it'll change to. Maybe it's just changing this key csrf-token to something different.

https://github.com/OSC/bc_osc_rstudio_server/blob/0cd8bc9f316ca12716ecb8c15f5bdc0ee5cdb072/view.html.erb#L7-L10

sed -n -i 'p;18a "export PATH="$PATH:/usr/lib/rstudio-server/bin"' /var/www/ood/apps/sys/jupyter/template/script.sh.erb

This isn't your issue - but /var/www/ood doesn't exist on the compute node so this PATH isn't right. Again, not your issue, but isn't doing anything for you.

[mani91-ug]

I have been using the very latest version on the posix website: https://download2.rstudio.org/server/rhel8/x86_64/rstudio-server-rhel-2024.04.1-748-x86_64.rpm

Which versions currently being used your side? I can try testing if it makes a difference.

Are you able to comment on the issue regarding --auth-none 1 or do you believe this may be a version problem too?

Oh, and can I assume that the rstudio-server service is supposed to be stopped on the compute node on boot?

The 'sed' commands are only issued on the OnDemand node where the app is stored. I'm cloning the git on there to create the app.

[johrstrom]

We're running RStudio 2023.06.1+524 "Mountain Hydrangea".

Are you able to comment on the issue regarding --auth-none 1 or do you believe this may be a version problem too?

Not really. I've never tried auth-none so I can't really speak to it because you really really need auth so I've never actually turned it off.

[mani91-ug]

I get the same exact issues with the version of RStudio you are using. It works fine if I try it outside of OOD. But OOD is working for the test jupyter and visual studio code apps. Any other ideas on where to look?

[johrstrom]

When you're using OOD - you're getting the CSRF error?

[mani91-ug]

Yes correct I get the CSRF error and get redirected to the login screen:

2024-06-11T09:02:49.297123Z [rserver] ERROR Failed to validate sign-in with invalid CSRF form; LOGGED FROM: bool rstudio::server::auth::common::validateSignIn(const rstudio::core::http::Request&, rstudio::core::http::Response*) src/cpp/server/auth/ServerAuthCommon.cpp:136
2024-06-11T09:02:52.408399Z [rserver] DEBUG Request for main page with no user-identifier - redirecting to login page: /
2024-06-11T09:02:55.444481Z [rserver] DEBUG Request for main page with no user-identifier - redirecting to login page: /

If try to turn authentication off, it actually gets further and creates a user, but nothing seems to happen on the web browser, it doesn't even error, it's just blank. Im unsure if Id get the same if authentication was fixed.

[johrstrom]

OK - then I'd guess you should confirm you're passing the token both in the form and in the cookies. You can use Chrome to open dev tools on new windows.

Here's what you're looking for, when you press the login to Rstudio in a new tab:

I passed the csrf-token in the FORM

And I sent it in a cookie as well.

This is what Rstudio is validating - that the form token matches the cookie token. It seems like one or both is not being set correctly.

[mani91-ug]

So it looks the token is sent in the cookie:

But there is nothing useful in the form:

Where would I look next? The app should be identical to yours other than the change in cluster name and exporting the path to rstudio rather than using modules...

[johrstrom]

Where would I look next? The app should be identical to yours other than the change in cluster name and exporting the path to rstudio rather than using modules...

It's the view.html.erb that's submitting the POST request here with a form.

One thing I'm seeing there is you have Query String Parameters meaning you're issuing a GET request. Whereas my image shows Form Data which is a POST request.

The view.html.erb specifies method='post'

https://github.com/OSC/bc_osc_rstudio_server/blob/0cd8bc9f316ca12716ecb8c15f5bdc0ee5cdb072/view.html.erb#L15

[mani91-ug]

I'm using the following commands to install the app:

git clone --single-branch -b v0.27.1 https://github.com/OSC/bc_osc_rstudio_server /var/www/ood/apps/sys/rstudio
sed -i 's/- "owens"/- "my_cluster"/g' /var/www/ood/apps/sys/rstudio/form.yml
sed -n -i 'p;18a "export PATH="$PATH:/usr/lib/rstudio-server/bin"' /var/www/ood/apps/sys/jupyter/template/script.sh.erb

So the view.html.erb is untouched from the original you have shared a link to.

I never actually see an 'auth-do-sign-in' via chrome developer tools. When I start R studio there's only an 'auth-sign-in?appURI=%2F'. Is there anything which may be forcing a GET request rather than the expected post request?

If it's useful, I'm viewing open on demand via an azure virtual machine. So essentially, from my laptop, I'm going through two other VMs to reach the node on which RStudio is started.

Im also not using SSL as this is just for testing, Im not sure if that would cause some issues. It hasnt with the other apps...

[johrstrom]

Is there anything which may be forcing a GET request rather than the expected post request?

Javascript could - though you'd have to have added it. OR a browser extension of some kind.

If you could right click and inspect the element what does it look like?

[mani91-ug]

So it seems the data is sent but not received. If I put the username and password into the prompt manually, it authenticates but then I get the following:

[johrstrom]

OK - do you have any browser extensions that could be throwing this off? Can you try in a different browser?

[mani91-ug]

Vanilla installations of Firefox and Chrome both result in the very same issue, no specific changes have been made to the browsers.

[mani91-ug]

I'm also finding that if I start the standard rstudio-server.service and try to login via web browser without OnDemand, it works.

If I try to login to the OnDemand created server, as well as getting the issues described above, trying to login to the server outside of the OnDemand gives the same issue.

[mani91-ug]

OK, so the problem related to passing user details to login to rstudio has been resolved and occured because I'm not using SSL at the moment.

I had to run 'sed -i 's/SameSite=strict;secure/SameSite=strict/g' /var/www/ood/apps/sys/rstudio/view.html.erb'

However, on login I'm now presented with a blank screen like this:

I'm unsure what's happening here, any ideas where to look?

[mani91-ug]

OK, so for completions sake, the blank screen from above is what happens if the regex matching for your reverse proxy configuration is incorrect: https://osc.github.io/ood-documentation/release-1.2/app-development/interactive/setup/enable-reverse-proxy.html