Shinydocs Pro
Shinydocs Pro
Breadcrumbs

Secure Shinydocs Dashboards with IIS Reverse Proxy

This guide assumes you are using Windows Server edition. If you are using Windows 10 or 11, use Turn Windows features on or off.

Using this configuration will provide an authentication gate to access the platforms, once authenticated, configured users will have access to all content in the respective platform.

This guide covers configuring an IIS reverse proxy to configure which AD users and groups can access Shinydocs Dashboards.

Preconditions

🛑

Hold up!

Before you proceed, you will need to think about which ports you will use. You cannot use the same port (443) for each.

  • Have Shinydocs Pro installed

  • Have IIS installed along with the URL Rewrite & Application Request Routing modules

  • (Dashboards only) A service account (or user account) that will be used to authenticate the connection between Shinydocs Pro and Dashboards

    • This process will enable Windows Authentication when accessing Dashboards, therefore account credentials are needed to make the Dashboard links work in Shinydocs Pro

      image-20250310-133319.png

IIS Installation and Configuration

Install IIS - Windows Server

  1. Open Server Manager

  2. Click Manage → Add Roles and Features

  3. Click Next until Server Roles

  4. Check Web Server (IIS)

  5. In the pop-up, click Add Features

  6. Click Next until Role Services

  7. Ensure these are checked:

    • Web Server → Security → Windows Authentication

    • Web Server → Security → URL Authorization

  8. Click Next, then Install

Install IIS - Windows 11

  1. Press Windows + R, type: optionalfeatures, press Enter

  2. Check:

    • Internet Information Services

    • Expand:

      • Web Management Tools

      • World Wide Web Services → Security → check Windows Authentication

      • World Wide Web Services → Security → check URL Authorization

  3. Click OK to install

Download and Install Additional IIS Modules

Download and install the following:

  1. URL Rewrite

  2. Application Request Routing

They will be automatically added to IIS (you may need to close IIS and re-open for URL Rewrite to appear).

Step 1: Add Your Website

  1. Open IIS Manager.

    https://lh7-rt.googleusercontent.com/docsz/AD_4nXf3uYCkaR82Xa31DMy-AjuCi5Yx3RjKWAxsm0z8xtDAEMZ2trN0CljqDR-FYWNix3lTqfMft7SY1cnp6pne8s8J9jwsf-r3edyxkGr0_zKFLSQwnXWGeXrLdxqOY_fF7oDrJiZgbg?key=1-7OvJ_PVppJ7PmTg7LUeuIV

  2. Right-click Sites and select Add Website.

    https://lh7-rt.googleusercontent.com/docsz/AD_4nXcHHFs_0FVwEY77ZV-E1dIMMO_gqJbGZhHIMVhgHi-Ht7EXRYX8KOhcp8gvmQyfHh4UhGz6y1qh_FxQPDYeXeWI-Ibc6QHC6cE2qthKO4uJGT3Z43FVkrI4E1t2mC_M1-0A_PCHTA?key=1-7OvJ_PVppJ7PmTg7LUeuIV

  3. Fill out the following fields using your values:

    https://lh7-rt.googleusercontent.com/docsz/AD_4nXdvGkFsWqZ2KLvx6aoX3qFCeRvPBzH_tEDHNsiYNPapnLv4XkgAAyqy2PI-EUnSoyib8DSjvOGfV89_hRWqG20qXRJMpDMKVV9p8Sc8JsK_5_Wax-wQcbr0EDagiZCeBA0_4Aj-?key=1-7OvJ_PVppJ7PmTg7LUeuIV

    • Site name: The name of your site as it will appear in IIS

      • Suggestions:

        • Shinydocs Pro Control Center

        • Shinydocs Pro Dashboards

    • Physical path: C:\inetpub\wwwroot\ShinydocsPro

      • You can choose any physical path you like, it will create the web.config file for IIS in this directory.

    • Type: HTTPS

    • IP address: All Unassigned

    • Port: 444 (you can use 443 if you are not using it for Shinydocs Control Center)

      • 🛑Ensure that this port is not currently in use

      • You can use any port you would like that is available

    • Host name: Your hostname

    • SSL certificate: Select your certificate (e.g., my self-signed certificate JARVIS)

  4. Click OK to create the site.

Step 2: Configure the Reverse Proxy

  1. Select your website in IIS Manager, then click URL Rewrite.

    https://lh7-rt.googleusercontent.com/docsz/AD_4nXdcGVGm_cHckVX4k4G5BOY7Hn6xCRMIwFTIU9tXj-Oc-2pE0iTAT-e6tZ9c_aZcQiDkqi3gWaVv8L8HynFS1ewZEICP-cIRu0RykqiemVkZQY5jzcMnHGy9qJtQ5ZcHtrqofOBhKQ?key=1-7OvJ_PVppJ7PmTg7LUeuIV

  2. In the Actions panel, click Add Rules.

    urlrewritepage-20241212-141827.png

  3. Select Reverse Proxy and click OK.

    https://lh7-rt.googleusercontent.com/docsz/AD_4nXeLnV1i4oA7byeLjmA4jnfdiAkKXWAkp2V-EknAFNDp8TRVpdx9ETW2cEa3Yd58RKwDI8bj66zGQ0_AGNcn8Rcq1skSVvFubmyENKjtPlV53FNPiFqRNGT1AWivtg8uQP-8aE4VAQ?key=1-7OvJ_PVppJ7PmTg7LUeuIV

  4. Enable Rewriting of domain names under Outbound Rules

  5. Set the inbound URL and the outbound URL.

    image-20241212-142246.png

    1. For inbound rules:

      1. Dashboards: localhost:5601

    2. For Outbound rules

      1. From: localhost:5601

      2. To: your machine hostname

  6. Click OK to save the settings.

Step 3: Configure Server Variables

  1. With your site selected, go to URL Rewrite and click View Server Variables.

    servervars-20241212-142941.png

  2. Add these variables:

    • HTTP_ACCEPT_ENCODING

      https://lh7-rt.googleusercontent.com/docsz/AD_4nXeD8xjv7HojQ3o_Bbh3Q9t4hcr6WnqmnuvlHUHw_XLqlBDXIMBw7oFd3_UgvTfebWVvKHFb3Hf6xMP_KM4_8o_IDd1E-iKVb8bYC-b4GvXnQD6un6IZ_motbY9kR2Blry9X1ZsB?key=1-7OvJ_PVppJ7PmTg7LUeuIV

    • HTTP_X_ORIGINAL_ACCEPT_ENCODING

      https://lh7-rt.googleusercontent.com/docsz/AD_4nXdWNP7UWgwAIvMvn23o9PYvEKgzyjWlfmFpVwoHQ57_qx9HM_nbFQAH9lgeXq90xGIIQZR58s5iX9fm3WuuqXMZSmf8kYMXfjsmTP7QlOegAXaZjYfnYcobkOigZMdLsJtdpqAwQA?key=1-7OvJ_PVppJ7PmTg7LUeuIV

  3. Go back, select the Inbound Rule in URL Rewrite and click Edit.

    editinbound-20241212-143130.png

    • Under Server Variables

      https://lh7-rt.googleusercontent.com/docsz/AD_4nXdsy9_dSag29gMZSh5XRRjOAHjqfpx46fQeIW7DMWfJW5nUVGGUPBq5yvVgjwwXhEODzZCpgePRXNnjcfS6tcA6wVaXsFv0fbWPXT0KBqn5DqpFcRi-NDg9TiwgyBvsdlu-zAS8pQ?key=1-7OvJ_PVppJ7PmTg7LUeuIV

      • Add HTTP_X_ORIGINAL_ACCEPT_ENCODING to {HTTP_ACCEPT_ENCODING}.

        https://lh7-rt.googleusercontent.com/docsz/AD_4nXcWGkM_or4YW5fjJyKfaiRA_IZ7ZBgGZAGQ-V4jNic8gBpmZPSTMGUGgkvojVLomDg6olpq5m7091W1HIhfX5axmjcSPuNwIcXC7-kADI5qEravZiECe0zyo7OSoiV-oNrmC8Um?key=1-7OvJ_PVppJ7PmTg7LUeuIV

      • Add HTTP_ACCEPT_ENCODING with a placeholder value (e.g., abc).

        https://lh7-rt.googleusercontent.com/docsz/AD_4nXdxRQw5R4M8WTsa6t0PMprxmbq979UJLPy-qM_qCZQMRR8RwJarcIXFPAMeE-WXsA_bZZWTbb0XU0hNbFAAx9_rIZtLWX4Pb6tIsFDT3jKkk9oPzXHhZIK9tk32vU-U7BUTOEnkWQ?key=1-7OvJ_PVppJ7PmTg7LUeuIV

  4. Click Apply (top-right) to save the configuration.

  5. Edit the web.config file in your site's directory (C:\inetpub\wwwroot\ShinydocsPro):

    • Replace the placeholder value (abc) with an empty string.

      https://lh7-rt.googleusercontent.com/docsz/AD_4nXe1rpCh5daV8I1dg0rhI8UPRZ2k_CG01DC9q6Dav48Ho9cDmUoypsnGz_Gp43oEGzOh-caXZbl8X1hTEzPxwL7_bB6nUSsVXTi7AHOUUCCvnJhe7uj4fub1HEDb4T_OQnRsJkl_6A?key=1-7OvJ_PVppJ7PmTg7LUeuIV
      https://lh7-rt.googleusercontent.com/docsz/AD_4nXfEhAVRcFgSwyR4PlflDnIhJxjtajbvPevIolyAh5DqTU_5tv_mPw58KuJ5xJFTbMXhU3nUY2ge_gOMBWciCJzSEhgmsl9tg628ce3I12949Psf5lcOH-iw4BjeS8ojeB8aeUN2Dw?key=1-7OvJ_PVppJ7PmTg7LUeuIV

    • Add the following under <configuration>:

      <system.web>
    <httpRuntime requestPathInvalidCharacters="" relaxedUrlToFileSystemMapping="true" />
</system.web>
      https://lh7-rt.googleusercontent.com/docsz/AD_4nXdDz5z5qteGHoZY2eDZ_xQ8YAfy1Be6GrrfgJyvPvfBf1LBT872cnfDeWJa5jxTxAjSqRcvMnzadC7VRaUrMGzz2p5WD2unnICL3I7RMX1awjbYG2ni1X_QCAFrGtLYzNR5mSvD6Q?key=1-7OvJ_PVppJ7PmTg7LUeuIV

  6. Save the file.

  7. Go to URL Rewrite and click Add Rules. Choose Blank Rule under Outbound Rules

    https://lh7-rt.googleusercontent.com/docsz/AD_4nXfPQt74hWg_c2Itns-B_mHcUj6Bwq3lvxDUHUbkQVzjqRELkrOBagkp-LeTBuj0VowYXmkEEOOaLLZAWarERVQ0l2Mbx0TzhctUjuzGmHufO6SvS1x5R2Y6XlXfgDYa9b6nAUd3JA?key=1-7OvJ_PVppJ7PmTg7LUeuIV

  8. Name the rule RestoreAcceptEncoding. In the settings, choose <Create New Precondition…>.

    https://lh7-rt.googleusercontent.com/docsz/AD_4nXcNc5-ivJHoiofK0waH2DffPZgkehxcZumQEsstuwqQk6z59_dwaHo2ntzCocXW9v85p_MXa3qoTPE3CPnWuQaEpFgmHNq2cNW2xUG8p6OemkDeRgfMd8jtVb6sFXcHuNnM5KvUyg?key=1-7OvJ_PVppJ7PmTg7LUeuIV

  9. Name the rule NeedsRestoringAcceptEncoding, check Using is set to Regular Expressions and Logical grouping is set to Match All.

  10. Add a condition to the precondition:

    https://lh7-rt.googleusercontent.com/docsz/AD_4nXdjRhsk9uApi3ZZA-ST4InPoHOjpRW6_jLVmF_JmUAcn7jZAJ-3qt_TOkAo9bIBxwQ4ANuT0jqayHNcx7H2cmRkDwXXFcrSqY_McYnIk0LBH5duwLyGoujs1srCq4rq6jDdSqQBHg?key=1-7OvJ_PVppJ7PmTg7LUeuIV

    • For Condition input, type {HTTP_X_ORIGINAL_ACCEPT_ENCODING} (include the curly braces).

    • For Pattern, type .+.

    • Click OK twice to close the condition setup.

      https://lh7-rt.googleusercontent.com/docsz/AD_4nXeerbzTuf9ae1ZdICwz2KtAIr399tWR6g9Sr79V8zKZ98RmiH2xOJcTHJG2ZhbEhkV5OhpGmo__TKqBaR5eLJDWA5K2CS1STMtZkIQgUyXE7i_Ps11Fz6S2AipXRKIhp37M0bUsLA?key=1-7OvJ_PVppJ7PmTg7LUeuIV

  11. Back in the rule settings, go to Match and set Matching Scope to Server Variable.

    https://lh7-rt.googleusercontent.com/docsz/AD_4nXc8oFLej9z5_fPnAtROsJf27HW8ydYPbryQOWx0K4K96ZPgqCksC0iWvBSNsY5AAJHtUBmhHmbQcf9AwiLs71qQ4IkfFhJSIf5OIH_db5fWYFzzWIPJPdIY24mwPM1jSPxnLSVcRQ?key=1-7OvJ_PVppJ7PmTg7LUeuIV

    • For Variable name, type HTTP_ACCEPT_ENCODING.

    • For Pattern, type ^(.*).

  12. In the Action section, do the following:

    • Set Action type to Rewrite.

    • For Value, type {HTTP_X_ORIGINAL_ACCEPT_ENCODING} (include the curly braces).

      https://lh7-rt.googleusercontent.com/docsz/AD_4nXexI_DuLGc6brRDAKoi1ZG-RjBHqxr04KzGS8ANyU6DZBZHGZ9cXY3jNqm82N0mvBWcU_WD60Cv35AIe-ggN2OHnRbtckLR64wSqf6qe-2A_dnAj2yk8-JckX-zak47jy6VbKZF?key=1-7OvJ_PVppJ7PmTg7LUeuIV

  13. Click Apply to save the rule.

Step 5: Configure User Authentication

  1. Select your site in IIS Manager and click Authentication.

    https://lh7-rt.googleusercontent.com/docsz/AD_4nXepU8njgKpYNy5aKf_5DzwJH_2G-XNLQM6Jp2Jfy7ZL5C5xTRw1nRDsO6gfOEs0zP81w2wSGtceVValLBiB44ix0UsbKrtgYY6HiT_Ze5Y5Lm678smjEXWpgiXxv9rsiw30Q448IQ?key=1-7OvJ_PVppJ7PmTg7LUeuIV

  2. Disable Anonymous Authentication and enable Windows Authentication.

    https://lh7-rt.googleusercontent.com/docsz/AD_4nXedORrpg-KyJJH3RjHdTt3jK1hGAg0vr_kMVgVu57ep9K1I5qPwd1TRvDS-63lWAU5dDA9PBQ_RXJCR9QIPKJI3ftNOsDNgJeTLNhBagUL3p3C5oGCsrrUe8_5xc676X3cio_p_AA?key=1-7OvJ_PVppJ7PmTg7LUeuIV

  3. If you use an FQDN via DNS, you likely need to disable Kernel-mode authentication. You will know to disable this if accessing the dashboard URL causes a looping Windows authentication. To disable it, in IIS's Authentication section, select Windows Authentication > Advanced Settings > uncheck Enable Kernel-mode authentication.

    image-20260408-134330.png

  4. Go back to the main IIS screen and select .NET Authorization Rules or Authorization Rules (whichever is available on your computer).

    https://lh7-rt.googleusercontent.com/docsz/AD_4nXdrl-o8k9ozfhPWtXWxcToTS2BEAJ633WbNodhlT0owVsNX9w8RE42acpaaiH7IsOfbfscAwiDoWLYEhchJzDB-rDUebdS94qq2FbsY8LkMjh6pJOFoIKoOAmcI9BY8xQ9LFqfO7A?key=1-7OvJ_PVppJ7PmTg7LUeuIV

  5. Delete the default Allow All Users rule.

  6. Choose one of the following options based on your needs:

    1. All users: Allows everyone to access the web content. Use this only if there are no security concerns about unrestricted access.

    2. All anonymous users: Not recommended.

    3. Specified roles or user groups: Restricts access to specific user groups. Use this option only when you want users in certain groups, such as administrators, to have access.

    4. Specified users: Limits access to specific individuals. Use this for precise control over who can access the content.

  7. Add an allow rule for the service account (or user account) that will be used to authenticate the connection between Shinydocs Pro and Dashboards

    1. Add Allow Rule.

    2. Select Specified users.

    3. Enter the name of the account (ex. svcshinydocs).

    4. Click OK to add the rule.

  8. Configure the service account (or user account) in Shinydocs Pro

    1. In Shinydocs Pro Control Center (https://localhost:9701) go to Settings.

    2. Go to the Services setting page.

    3. Under Search dashboards:

      image-20250310-134351.png

      1. Set the URL to the reverse proxy URL (ie. https://servername:443/)

      2. Click on the key image-20250310-134001.png icon under Search dashboards.

      3. Enter the username and password for the Service account (or user account) used in Step 6.

      4. Check Allow invalidated certificates.

    4. Click Save changes.

Your Shinydocs Pro site should now be accessible securely and configured with user authentication. Try right-clicking on the site in IIS Manager > Manage Website > Browse. If you experience any issues, review the steps and ensure all configurations match the guide.