How to obtain a user-delegated OAuth token inside a browser-served, server-side RStudio environmen

Ask the Community
,
1

Hi - I am trying to find ONE pushdown for SQL (inside and outside of FDP) that will execute from RStudio(outside) and RStudio Workspace(inside fdp).

I need to execute SQL statements that use Multi-join ( i.e capabilities not given by containers_Sql) .

I cant use Iceberg.

I have successfully tested SQL REST API from outside using RStudio and pre-created Oauth2/PKCE wilth a locahost callback.

But I anticipate (shortly to test) that a callback inside FDP RStudio Workspace is very unlikely to work to localhost :wink:

Are there any callback URLs that I could use that point to something RStudio Workspace could see?

More technically~: How to obtain a user-delegated OAuth token inside a browser-served, server-side RStudio environment without breaking the no-egress security boundary or the human-user audit mode?

Regards

Barney

2

You can use the special collector page of Multipass as redirect uri

https:///multipass/api/oauth2/callback

and complete the login flow from the server.

We have implemented this in foundry devtools:

https://emdgroup.github.io/foundry-dev-tools/getting_started/sso.html

https://emdgroup.github.io/foundry-dev-tools/getting_started/installation.html#credentials-configuration

3

Thanks - I will try it later. I actually came accross a pre-issue as my test case involves executing R code from RStudio workspace using the SQL REST API. Which I assume is not a typical test as it is likely designed to be from outside FDP. And currently it fails on reslution of the hostname becausde our projects are constrained and cannot egress. Unless I can route it internally somehow.

4

I tried using it inside a code workspace and the browser authorization flow against /multipass/api/oauth2/authorize succeeds, but attempting POST <FOUNDRY_PROXY_URL>/multipass/api/oauth2/token from a Code Workspace returns 404 Default:NotFound. Is there a supported internal token-exchange endpoint for Code Workspaces, or is FOUNDRY_PROXY_URL intended only for selected Platform API routes?”