Add PASSWORD envt var. to rstudio workbench docker image

[dlebauer]

Per #545 (comment)

After Adding a PASSWORD environment variable, the rstudio instances seem to launch w/o returning an 'unable to connect' error.

Per Craig's suggestions, need to add this to:
https://github.com/terraref/workbench-catalog/blob/master/terraref/rstudio.json

It doesn't seem like the password is used in normal operations, so it doesn't matter what it is except that 'rstudio' is not allowed.

[craig-willis]

The PASSWORD environment variable is now required by Rstudio. In addition to adding the PASSWORD field, per the Whole Tale example below you can also just disable Rstudio's internal auth altogether -- so you're no longer prompted beyond your WB credentials (But apparently the env var is still required).

The postgres.json example shows how to tell workbench to auto-generate a password for a service:
https://github.com/nds-org/ndslabs-specs/blob/master/postgres/postgres.json#L19-L25

The Whole Tale RStudio image is an example of how to disable auth in RStudio altogether:

https://github.com/whole-tale/rstudio-base/blob/master/ROOT/etc/services.d/rstudio/run

[robkooper]

Another option to use is by adding DISABLE_AUTH=true as an environment variable to the dockerfile.

[craig-willis]

Even better. In this case, you don't even need to put it in the Dockerfile, since Workbench specs can set arbitrary environment variables.

Adding this to the rstudio.json:

  "config": [
    {
      "name": "DISABLE_AUTH",
      "value": "true",
      "label": "Disable Auth"
    },
    {
      "name": "PASSWORD",
      "value": "",
      "label": "Password",
      "isPassword": true,
      "canOverride": true
    }
  ],

Once the change is committed, restarting the ndslabs-apiserver pod should pickup the changes.

[robkooper]

Cool. was trying to figure out how to do that. Is there a way in workbench to set it such you will always have to proxy through workbench? or is it security through obscurity with regards to the servername?

[craig-willis]

https://github.com/terraref/workbench-catalog/blob/master/terraref/rstudio.json#L46

If authRequired=true in the application spec, then the service is protected by workbench auth. Auth is SSO, so if you've signed into Workbench you don't need to sign in again. If authRequired=false, then WB assumes it either 1) doesn't need auth or 2) has it's own (ala services like Dataverse/Clowder that don't apply in TERRA-REF):

[max-zilla]

Can this be closed? If not, who is this assigned to?