From 8be7970205bde10ebdecf71259acf0eca63065d7 Mon Sep 17 00:00:00 2001 From: AhyoungRyu Date: Fri, 10 Jun 2016 12:36:42 -0700 Subject: [PATCH 1/7] Change authcBasic -> authc --- SECURITY-README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/SECURITY-README.md b/SECURITY-README.md index f9f6645ff5b..4a6ca9493fe 100644 --- a/SECURITY-README.md +++ b/SECURITY-README.md @@ -17,7 +17,7 @@ To connect to Zeppelin, users will be asked to enter their credentials. Once log This a a first step toward full security as implemented by this pull request (https://github.com/apache/zeppelin/pull/53). # Security setup -1. Secure the HTTP channel: Comment the line "/** = anon" and uncomment the line "/** = authcBasic" in the file conf/shiro.ini. Read more about he shiro.ini file format at the following URL http://shiro.apache.org/configuration.html#Configuration-INISections. +1. Secure the HTTP channel: Comment the line "/** = anon" and uncomment the line "/** = authc" in the file conf/shiro.ini. Read more about he shiro.ini file format at the following URL http://shiro.apache.org/configuration.html#Configuration-INISections. 2. Secure the Websocket channel : Set to property "zeppelin.anonymous.allowed" to "false" in the file conf/zeppelin-site.xml. You can start by renaming conf/zeppelin-site.xml.template to conf/zeppelin-site.xml 3. Start Zeppelin : bin/zeppelin.sh 4. point your browser to http://localhost:8080 From d3a81d5e2cc4d129f3a9630faa0002a408e663fc Mon Sep 17 00:00:00 2001 From: AhyoungRyu Date: Fri, 10 Jun 2016 12:37:12 -0700 Subject: [PATCH 2/7] Update shiro authentication docs --- docs/security/shiroauthentication.md | 33 ++++++++++++++++++++++------ 1 file changed, 26 insertions(+), 7 deletions(-) diff --git a/docs/security/shiroauthentication.md b/docs/security/shiroauthentication.md index 733ff11b673..a5c9c317b36 100644 --- a/docs/security/shiroauthentication.md +++ b/docs/security/shiroauthentication.md @@ -66,13 +66,17 @@ Finally, you can login using one of the below **username/password** combinations
``` -admin = password1 -user1 = password2 -user2 = password3 +[users] + +admin = password1, admin +user1 = password2, role1, role2 +user2 = password3, role3 +user3 = password4, role2 ``` +You can set the roles for each users next to the password. -### 5. Groups and permissions (optional) -In case you want to leverage user groups and permissions, use one of the following configuration for LDAP or AD under `[main]` segment in `shiro.ini` +## Groups and permissions (optional) +In case you want to leverage user groups and permissions, use one of the following configuration for LDAP or AD under `[main]` segment in `shiro.ini`. ``` activeDirectoryRealm = org.apache.zeppelin.server.ActiveDirectoryGroupRealm @@ -101,6 +105,21 @@ finance = * group1 = * ``` -All of above configurations are defined in the `conf/shiro.ini` file. +## Secure your Zeppelin information (optional) +By default, anyone who defined in `[users]` can share **Interpreter Setting**, **Credential** and **Configuration** information in Apache Zeppelin. +Sometimes you might want to hide these information for your use case. +Since Shiro provides **url-based security**, you can hide the information by commenting or uncommenting these below lines in `conf/shiro.ini`. + +``` +[urls] + +/api/interpreter/** = authc, roles[admin] +/api/configurations/** = authc, roles[admin] +/api/credential/** = authc, roles[admin] +``` + +In this case, only who have `admin` role can see **Interpreter Setting**, **Credential** and **Configuration** information. +If you want to grant this permission to other users, you can change **roles[ ]** as you defined at `[users]` section. -> **NOTE :** This documentation is originally from [SECURITY-README.md](https://github.com/apache/zeppelin/blob/master/SECURITY-README.md). +
+> **NOTE :** All of the above configurations are defined in the `conf/shiro.ini` file. This documentation is originally from [SECURITY-README.md](https://github.com/apache/zeppelin/blob/master/SECURITY-README.md). From 2a054d4b55de4f9b0e2de55e6ee2e585f775f430 Mon Sep 17 00:00:00 2001 From: AhyoungRyu Date: Fri, 10 Jun 2016 12:41:15 -0700 Subject: [PATCH 3/7] Add interpreter, credential and configuration urls to shiro.ini --- conf/shiro.ini | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/conf/shiro.ini b/conf/shiro.ini index ced9776f6e0..0584709b3bb 100644 --- a/conf/shiro.ini +++ b/conf/shiro.ini @@ -18,7 +18,7 @@ [users] # List of users with their password allowed to access Zeppelin. # To use a different strategy (LDAP / Database / ...) check the shiro doc at http://shiro.apache.org/configuration.html#Configuration-INISections -admin = password1 +admin = password1, admin user1 = password2, role1, role2 user2 = password3, role3 user3 = password4, role2 @@ -60,10 +60,14 @@ role2 = * role3 = * [urls] +# This section is used for url-based security. +# You can secure interpreter, configuration and credential information by urls. Comment or uncomment the below urls that you want to hide. # anon means the access is anonymous. -# authcBasic means Basic Auth Security # authc means Form based Auth Security # To enfore security, comment the line below and uncomment the next one /api/version = anon +#/api/interpreter/** = authc, roles[admin] +#/api/configurations/** = authc, roles[admin] +#/api/credential/** = authc, roles[admin] /** = anon #/** = authc From 5c9242c3ed5b51b4fe0a79874552866ded68ffb1 Mon Sep 17 00:00:00 2001 From: AhyoungRyu Date: Sat, 9 Jul 2016 23:58:01 +0900 Subject: [PATCH 4/7] Redirect to home with error message when status is 401 --- .../app/configuration/configuration.controller.js | 12 +++++++++++- .../src/app/interpreter/interpreter.controller.js | 10 ++++++++++ 2 files changed, 21 insertions(+), 1 deletion(-) diff --git a/zeppelin-web/src/app/configuration/configuration.controller.js b/zeppelin-web/src/app/configuration/configuration.controller.js index 9c77a33bf3a..6ac3065a7b4 100644 --- a/zeppelin-web/src/app/configuration/configuration.controller.js +++ b/zeppelin-web/src/app/configuration/configuration.controller.js @@ -14,7 +14,7 @@ 'use strict'; angular.module('zeppelinWebApp').controller('ConfigurationCtrl', function($scope, $route, $routeParams, $location, - $rootScope, $http, baseUrlSrv) { + $rootScope, $http, baseUrlSrv, ngToast) { $scope.configrations = []; $scope._ = _; @@ -24,6 +24,16 @@ angular.module('zeppelinWebApp').controller('ConfigurationCtrl', function($scope $scope.configurations = data.body; }). error(function(data, status, headers, config) { + if (status === 401) { + ngToast.danger({ + content: 'You don\'t have permission on this page', + verticalPosition: 'bottom', + timeout: '3000' + }); + setTimeout(function() { + window.location.replace('/'); + }, 3000); + } console.log('Error %o %o', status, data.message); }); }; diff --git a/zeppelin-web/src/app/interpreter/interpreter.controller.js b/zeppelin-web/src/app/interpreter/interpreter.controller.js index 5a90b79cd26..be64c7809f1 100644 --- a/zeppelin-web/src/app/interpreter/interpreter.controller.js +++ b/zeppelin-web/src/app/interpreter/interpreter.controller.js @@ -27,6 +27,16 @@ angular.module('zeppelinWebApp').controller('InterpreterCtrl', $http.get(baseUrlSrv.getRestApiBase() + '/interpreter/setting').success(function(data, status, headers, config) { $scope.interpreterSettings = data.body; }).error(function(data, status, headers, config) { + if (status === 401) { + ngToast.danger({ + content: 'You don\'t have permission on this page', + verticalPosition: 'bottom', + timeout: '3000' + }); + setTimeout(function() { + window.location.replace('/'); + }, 3000); + } console.log('Error %o %o', status, data.message); }); }; From 4411188d80747aee1bd9ee8dd06894464cab2126 Mon Sep 17 00:00:00 2001 From: AhyoungRyu Date: Sun, 10 Jul 2016 16:58:25 +0900 Subject: [PATCH 5/7] Address @prabhjyotsingh feedback --- conf/shiro.ini | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/conf/shiro.ini b/conf/shiro.ini index 0584709b3bb..c2fd2b5173b 100644 --- a/conf/shiro.ini +++ b/conf/shiro.ini @@ -58,6 +58,7 @@ shiro.loginUrl = /api/login role1 = * role2 = * role3 = * +admin = * [urls] # This section is used for url-based security. @@ -66,8 +67,8 @@ role3 = * # authc means Form based Auth Security # To enfore security, comment the line below and uncomment the next one /api/version = anon -#/api/interpreter/** = authc, roles[admin] -#/api/configurations/** = authc, roles[admin] -#/api/credential/** = authc, roles[admin] -/** = anon -#/** = authc +/api/interpreter/** = authc, roles[admin] +/api/configurations/** = authc, roles[admin] +/api/credential/** = authc, roles[admin] +#/** = anon +/** = authc From 5896c12a0ac5d0cc3fb19bd51c3a16d33e92d028 Mon Sep 17 00:00:00 2001 From: AhyoungRyu Date: Sun, 10 Jul 2016 17:06:47 +0900 Subject: [PATCH 6/7] Revert shiro setting --- conf/shiro.ini | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/conf/shiro.ini b/conf/shiro.ini index c2fd2b5173b..be9828c96e8 100644 --- a/conf/shiro.ini +++ b/conf/shiro.ini @@ -66,9 +66,9 @@ admin = * # anon means the access is anonymous. # authc means Form based Auth Security # To enfore security, comment the line below and uncomment the next one -/api/version = anon -/api/interpreter/** = authc, roles[admin] -/api/configurations/** = authc, roles[admin] -/api/credential/** = authc, roles[admin] -#/** = anon -/** = authc +# /api/version = anon +# /api/interpreter/** = authc, roles[admin] +# /api/configurations/** = authc, roles[admin] +# /api/credential/** = authc, roles[admin] +/** = anon +#/** = authc From 1d291accdddf4ca90059dc8289ea753d38566916 Mon Sep 17 00:00:00 2001 From: AhyoungRyu Date: Mon, 11 Jul 2016 18:31:58 +0900 Subject: [PATCH 7/7] Redirect to home when unauthorized user click 'credentials' --- conf/shiro.ini | 8 ++++---- .../src/app/credential/credential.controller.js | 10 ++++++++++ 2 files changed, 14 insertions(+), 4 deletions(-) diff --git a/conf/shiro.ini b/conf/shiro.ini index be9828c96e8..ca5afe3471b 100644 --- a/conf/shiro.ini +++ b/conf/shiro.ini @@ -66,9 +66,9 @@ admin = * # anon means the access is anonymous. # authc means Form based Auth Security # To enfore security, comment the line below and uncomment the next one -# /api/version = anon -# /api/interpreter/** = authc, roles[admin] -# /api/configurations/** = authc, roles[admin] -# /api/credential/** = authc, roles[admin] +/api/version = anon +#/api/interpreter/** = authc, roles[admin] +#/api/configurations/** = authc, roles[admin] +#/api/credential/** = authc, roles[admin] /** = anon #/** = authc diff --git a/zeppelin-web/src/app/credential/credential.controller.js b/zeppelin-web/src/app/credential/credential.controller.js index 621e499ce7f..47450a27e88 100644 --- a/zeppelin-web/src/app/credential/credential.controller.js +++ b/zeppelin-web/src/app/credential/credential.controller.js @@ -30,6 +30,16 @@ angular.module('zeppelinWebApp').controller('CredentialCtrl', function($scope, $ console.log('Success %o %o', status, $scope.credentialInfo); }). error(function(data, status, headers, config) { + if (status === 401) { + ngToast.danger({ + content: 'You don\'t have permission on this page', + verticalPosition: 'bottom', + timeout: '3000' + }); + setTimeout(function() { + window.location.replace('/'); + }, 3000); + } console.log('Error %o %o', status, data.message); }); };