Added Shiro security

Security-README.md

@@ -0,0 +1,63 @@
+# Vocabulary
+username, owner and principal are used interchangeably to designate the currently authenticated user
+# What are we securing ?
+Zeppelin is basically a web application that spawn remote interpreters to run commands and return HTML fragments to be displayed on the user browser.
+The scope of this PR is to secure the access to the notebooks. A user has access to his notebooks and only his notebooks. To achieve this, we use Apache Shiro. 
+## HTTP Endpoint security
+Apache Shiro sits as a servlet filter between the browser and the exposed services and handles the required authentication without any programming required. (See Apache Shiro for more info).
+## Websocket security
+Securing the HTTP endpoints is not enough, since Zeppelin also communicates with the browser through websockets. To secure this channel, we take the following approach:
+1. The browser on startup requests a ticket through HTTP
+2. The Apache Shiro Servlet filter handles the user auth
+3. Once the user is authenticated, a ticket is assigned to this user and the ticket is returned to the browser
+
+All websockets communications require the username and ticket to be submitted by the browser. Upon receiving a websocket message, the server checks that the ticket received is the one assigned to the username through the HTTP request (step 3 above).
+
+# Strategies to access the principal
+Apache Shiro expose the principal through the following call
+
+	org.apache.shiro.SecurityUtils.getSubject().getPrincipal()
+
+Apache Shiro stores the `principal` and the `subject` in a thread local variable.
+
+That makes it possible to get the principal from wherever we need it in the application as long as we are in the context of a HTTP synchronous request.
+
+Two strategies are possible : (1) Rely on the Thread local (anti ?)pattern to get the principal whenever we need it or (2) modify the interfaces of the NotebookRepo and SearchService classes to require the owner to be passed as a parameter.
+
+## Relying on ThreadLocal
+The Shiro ThreadLocal subject is available only for HTTP request which is not enough since we need to access notes through websockets (NotebookServer class) where the Shiro filter is not involved. 
+
+We could however explicitly create the Shiro `subject` on each websocket request using the provided username and ticket in the web socket request. 
+
+The drawback of this approach is that it makes it impossible to write async services and/or multithreaded code involving access to the Shiro principal (The subject is available in the current thread only).
+
+On the other side, the main benefit of this approach is that it does not require any change to the NotebookRepo and the SearchService interfaces.
+
+## Updating the service interfaces
+Coming from an actor based concurrent & distributed programming background I have decided to go for this approach. This required me to add the owner parameter to a couple of method.
+
+	trait NotebookRepo {
+	...
+	public List<NoteInfo> list(String owner) throws IOException;
+	public Note get(String noteId, String owner) throws IOException;
+	...
+	}
+	trait SearchService {
+ public List<~> query(String queryStr, String owner);
+	}
+
+
+As you can guess the has a significant impact on the existing code since the owner parameter had to be made available explicitly along the code that is executed to handle the request.
+
+# How Notes are stored
+TODO
+# Future : How Permissions could be implemented (note sharing, accessible features in iframes …)
+TODO
+
+
+
+
+
+\`\`\`
+\`
+\`\`\`\`

pom.xml

@@ -208,6 +208,19 @@
  <version>4.11</version>
  <scope>test</scope>
  </dependency>
+
+
+ <!-- Apache Shiro -->
+ <dependency>
+ <groupId>org.apache.shiro</groupId>
+ <artifactId>shiro-core</artifactId>
+ <version>1.2.3</version>
+ </dependency>
+ <dependency>
+ <groupId>org.apache.shiro</groupId>
+ <artifactId>shiro-web</artifactId>
+ <version>1.2.3</version>
+ </dependency>
  </dependencies>
  </dependencyManagement>
 

zeppelin-interpreter/src/main/java/org/apache/zeppelin/display/AngularObject.java

@@ -33,7 +33,7 @@
 public class AngularObject<T> {
  private String name;
  private T object;
-
+private String principal;
  private transient AngularObjectListener listener;
  private transient List<AngularObjectWatcher> watchers
  = new LinkedList<AngularObjectWatcher>();
@@ -64,6 +64,14 @@ public boolean isGlobal() {
  return noteId == null;
  }
 
+ public String getPrincipal() {
+ return principal;
+ }
+
+ public void setPrincipal(String principal) {
+ this.principal = principal;
+ }
+
  @Override
  public boolean equals(Object o) {
  if (o instanceof AngularObject) {

zeppelin-interpreter/src/main/java/org/apache/zeppelin/display/AngularObjectRegistry.java

@@ -119,7 +119,7 @@ public AngularObject remove(String name, String noteId, boolean emit) {
  Map<String, AngularObject> r = getRegistryForKey(noteId);
  AngularObject o = r.remove(name);
  if (listener != null && emit) {
- listener.onRemove(interpreterId, name, noteId);;
+ listener.onRemove(interpreterId, o);
  }
  return o;
  }

zeppelin-interpreter/src/main/java/org/apache/zeppelin/display/AngularObjectRegistryListener.java

@@ -24,5 +24,5 @@
 public interface AngularObjectRegistryListener {
  public void onAdd(String interpreterGroupId, AngularObject object);
  public void onUpdate(String interpreterGroupId, AngularObject object);
- public void onRemove(String interpreterGroupId, String name, String noteId);
+ public void onRemove(String interpreterGroupId, AngularObject object);
 }

zeppelin-interpreter/src/main/java/org/apache/zeppelin/interpreter/remote/RemoteInterpreterServer.java

@@ -432,10 +432,10 @@ public void onUpdate(String interpreterGroupId, AngularObject object) {
  }
 
  @Override
- public void onRemove(String interpreterGroupId, String name, String noteId) {
+ public void onRemove(String interpreterGroupId, AngularObject object) {
  Map<String, String> removeObject = new HashMap<String, String>();
- removeObject.put("name", name);
- removeObject.put("noteId", noteId);
+ removeObject.put("name", object.getName());
+ removeObject.put("noteId", object.getNoteId());
 
  sendEvent(new RemoteInterpreterEvent(
  RemoteInterpreterEventType.ANGULAR_OBJECT_REMOVE, gson.toJson(removeObject)));
@@ -468,7 +468,6 @@ public RemoteInterpreterEvent getEvent() throws TException {
 
  /**
  * called when object is updated in client (web) side.
- * @param className
  * @param name
  * @param noteId noteId where the update issues
  * @param object

zeppelin-interpreter/src/test/java/org/apache/zeppelin/display/AngularObjectRegistryTest.java

@@ -45,7 +45,7 @@ public void onUpdate(String interpreterGroupId, AngularObject object) {
  }
 
  @Override
- public void onRemove(String interpreterGroupId, String name, String noteId) {
+ public void onRemove(String interpreterGroupId, AngularObject object) {
  onRemove.incrementAndGet();
  }
  });

zeppelin-interpreter/src/test/java/org/apache/zeppelin/interpreter/remote/RemoteAngularObjectTest.java

@@ -184,7 +184,7 @@ public void onUpdate(String interpreterGroupId, AngularObject object) {
  }
 
  @Override
- public void onRemove(String interpreterGroupId, String name, String noteId) {
+ public void onRemove(String interpreterGroupId, AngularObject object) {
  onRemove.incrementAndGet();
  }
 

zeppelin-server/pom.xml

@@ -269,6 +269,16 @@
  <version>1.9.0</version>
  <scope>test</scope>
  </dependency>
+
+ <!-- Apache Shiro -->
+ <dependency>
+ <groupId>org.apache.shiro</groupId>
+ <artifactId>shiro-core</artifactId>
+ </dependency>
+ <dependency>
+ <groupId>org.apache.shiro</groupId>
+ <artifactId>shiro-web</artifactId>
+ </dependency>
  </dependencies>
 
  <build>