You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@kylin.apache.org by sh...@apache.org on 2015/12/14 03:48:07 UTC
kylin git commit: KYLIN-1219 support SSO with Spring SAML, bug fix
Repository: kylin
Updated Branches:
refs/heads/2.x-staging af889ca00 -> b331bf13e
KYLIN-1219 support SSO with Spring SAML, bug fix
Project: http://git-wip-us.apache.org/repos/asf/kylin/repo
Commit: http://git-wip-us.apache.org/repos/asf/kylin/commit/b331bf13
Tree: http://git-wip-us.apache.org/repos/asf/kylin/tree/b331bf13
Diff: http://git-wip-us.apache.org/repos/asf/kylin/diff/b331bf13
Branch: refs/heads/2.x-staging
Commit: b331bf13e9b901d03f3957de79c1d576937be22c
Parents: af889ca
Author: shaofengshi <sh...@apache.org>
Authored: Mon Dec 14 10:47:31 2015 +0800
Committer: shaofengshi <sh...@apache.org>
Committed: Mon Dec 14 10:47:57 2015 +0800
----------------------------------------------------------------------
build/bin/kylin.sh | 15 ++++++++-------
server/src/main/resources/kylinSecurity.xml | 17 ++++++++++-------
2 files changed, 18 insertions(+), 14 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/kylin/blob/b331bf13/build/bin/kylin.sh
----------------------------------------------------------------------
diff --git a/build/bin/kylin.sh b/build/bin/kylin.sh
index 50c5ce2..7f296cd 100644
--- a/build/bin/kylin.sh
+++ b/build/bin/kylin.sh
@@ -47,9 +47,14 @@ then
#In this way we no longer need to explicitly configure hadoop/hbase related classpath for tomcat,
#hbase command will do all the dirty tasks for us:
-
-
spring_profile=`sh ${dir}/get-properties.sh kylin.security.profile`
+ if [ -z "$spring_profile" ]
+ then
+ echo 'please set kylin.security.profile in kylin.properties, options are: testing, ldap, saml.'
+ exit 1
+ else
+ echo "kylin.security.profile is set to $spring_profile"
+ fi
#retrive $hive_dependency and $hbase_dependency
source ${dir}/find-hive-dependency.sh
@@ -81,11 +86,7 @@ then
-Dspring.profiles.active=${spring_profile} \
org.apache.hadoop.util.RunJar ${tomcat_root}/bin/bootstrap.jar org.apache.catalina.startup.Bootstrap start >> ${KYLIN_HOME}/logs/kylin.log 2>&1 & echo $! > ${KYLIN_HOME}/pid &
echo "A new Kylin instance is started by $USER, stop it using \"kylin.sh stop\""
- if [ "$useSandbox" = "true" ]
- then echo "Please visit http://<your_sandbox_ip>:7070/kylin to play with the cubes! (Useranme: ADMIN, Password: KYLIN)"
- else
- echo "Please visit http://<ip>:7070/kylin"
- fi
+ echo "Please visit http://<ip>:7070/kylin"
echo "You can check the log at ${KYLIN_HOME}/logs/kylin.log"
exit 0
http://git-wip-us.apache.org/repos/asf/kylin/blob/b331bf13/server/src/main/resources/kylinSecurity.xml
----------------------------------------------------------------------
diff --git a/server/src/main/resources/kylinSecurity.xml b/server/src/main/resources/kylinSecurity.xml
index 3b2125a..522571d 100644
--- a/server/src/main/resources/kylinSecurity.xml
+++ b/server/src/main/resources/kylinSecurity.xml
@@ -22,12 +22,6 @@
<constructor-arg ref="aclService" />
<property name="permissionFactory" ref="aclPermissionFactory" />
</bean>
-
- <bean id="ldapSource" class="org.springframework.security.ldap.DefaultSpringSecurityContextSource">
- <constructor-arg value="${ldap.server}" />
- <property name="userDn" value="${ldap.username}" />
- <property name="password" value="${ldap.password}" />
- </bean>
<bean id="aclAuthorizationStrategy"
class="org.springframework.security.acls.domain.AclAuthorizationStrategyImpl">
@@ -52,8 +46,17 @@
<bean id="permissionGrantingStrategy" class="org.springframework.security.acls.domain.DefaultPermissionGrantingStrategy">
<constructor-arg ref="auditLogger" />
</bean>
+
+ <beans profile="ldap,saml">
+ <bean id="ldapSource" class="org.springframework.security.ldap.DefaultSpringSecurityContextSource">
+ <constructor-arg value="${ldap.server}" />
+ <property name="userDn" value="${ldap.username}" />
+ <property name="password" value="${ldap.password}" />
+ </bean>
+ </beans>
<beans profile="ldap">
+
<bean id="kylinUserAuthProvider" class="org.apache.kylin.rest.security.KylinAuthenticationProvider">
<constructor-arg>
<bean id="ldapUserAuthenticationProvider" class="org.springframework.security.ldap.authentication.LdapAuthenticationProvider">
@@ -172,7 +175,7 @@
<scr:http security="none" pattern="/js/**"/>
<scr:http security="none" pattern="/login/**"/>
<scr:http security="none" pattern="/api/projects" />
-
+
<!-- Secured pages with SAML as entry point -->
<scr:http entry-point-ref="samlEntryPoint" use-expressions="false">
<scr:intercept-url pattern="/**" access="IS_AUTHENTICATED_FULLY"/>