search

microsoft / AzureTRE

An accelerator to help organizations build Trusted Research Environments on Azure.
https://microsoft.github.io/AzureTRE
MIT License
184 stars 141 forks source link

Researcher needs to access UI from inside the workspace #2402

Open marrobi opened 2 years ago

marrobi commented 2 years ago

As a Researcher I need to be able to access the UI for my current workspace from a VM inside the workspace. This is needed so that I can retrieve connection URIs to services such as AML, and read/copy/paste instructions on how to use workspace services while inside the workspace.

Acceptance Criteria

@damoodamoo welcome your thoughts

damoodamoo commented 2 years ago

Could we use app gateway routes to dynamically rewrite a route per workspace? so a call from Workspace A to the UI would get routed straight to /workspace/workspace-a ?

As we've also discussed, would we want to treat in-workspace access to the UI as readonly, possibly by blocking POST / PATCH requests?

marrobi commented 2 years ago

Yes, my first route forward would be to have a basic app gw per workspace, and do a path route. DNS and SSL will need configuring. The app gw could also be used with customer who do not want to expose Azure Websites URIs from the workspace.

marrobi commented 2 years ago

The inside view of the UI might need to provide access to secrets too, in line with #2401

marrobi commented 2 years ago

Application gateway now support private endpoints, so can add a private endpoint to a workspace. This doesn't limit access to a single workspace though, although could add a rule to limit inbound from that network to certain API paths.

david-salac commented 10 months ago

Hello, has there been any progress with this? Is there a plan to include it in any release soon? Cheers.

marrobi commented 10 months ago

@david-salac no, no immediate plans. What's the use case?

It's not straightforward as need to ensure cant access another workspace/UI should only be scoped to the current workspace.

david-salac commented 10 months ago

We need to disable clipboard paste and keep airlock (and DS provisioning) working; this is one of the ways (if not the only one) to achieve that.

marrobi commented 10 months ago

Understood, most customers allow paste in given the limited capacity of the Guacamole clipboard and impact on researcher productivity of blocking it completely. It might sound like a good idea initially but researchers soon become hamstrung.