You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@zeppelin.apache.org by kjmrknsn <gi...@git.apache.org> on 2017/11/15 13:34:27 UTC
[GitHub] zeppelin pull request #2671: [ZEPPELIN-3045] Add the option which prevents t...
GitHub user kjmrknsn opened a pull request:
https://github.com/apache/zeppelin/pull/2671
[ZEPPELIN-3045] Add the option which prevents the cron executing user from being changed to users other than the login user
### What is this PR for?
Add the option to Zeppelin, that prevents the cron executing user from being changed to users other than the login user.
Now, the cron executing user can be set to any users. That could cause a security issue when the Hadoop cluster has data access control (managed by Apache Ranger and so forth) because Zeppelin users can access the data which they ordinary cannot access by setting other users as the cron executing user.
Thus, under the circumstances strict data access control is required, it is necessary to add the option to Zeppelin, that prevents the cron executing user from being changed to users other than the login user.
### What type of PR is it?
[Improvement]
### Todos
### What is the Jira issue?
https://issues.apache.org/jira/projects/ZEPPELIN/issues/ZEPPELIN-3045
### How should this be tested?
* Tested manually
* I confirmed that when `zeppelin.notebook.cronExecutingUser.loginUserOnly` was true and "Cron executing user" was changed to users other than the login user, the "Insufficient privileges" dialog was shown and "Cron executing user" was not updated.
* <img width="1229" alt="screen shot 2017-11-15 at 22 15 29" src="https://user-images.githubusercontent.com/31149688/32838348-f1cbdfc4-ca53-11e7-9ed5-8362cba10d25.png">
### Screenshots (if appropriate)
### Questions:
* Does the licenses files need update? No.
* Is there breaking changes for older versions? No.
* Does this needs documentation? Yes. `docs/setup/operation/configuration.md` was updated.
You can merge this pull request into a Git repository by running:
$ git pull https://github.com/kjmrknsn/zeppelin ZEPPELIN-3045
Alternatively you can review and apply these changes as the patch at:
https://github.com/apache/zeppelin/pull/2671.patch
To close this pull request, make a commit to your master/trunk branch
with (at least) the following in the commit message:
This closes #2671
----
commit 6223fe6a492e052b26a6cad0af507b3b2eb87826
Author: Keiji Yoshida <kj...@gmail.com>
Date: 2017-11-15T07:21:30Z
[ZEPPELIN-3045] Add the option which prevents the cron executing user from being changed to users other than the login user
----
---
[GitHub] zeppelin pull request #2671: [ZEPPELIN-3045] Add the option which prevents t...
Posted by asfgit <gi...@git.apache.org>.
Github user asfgit closed the pull request at:
https://github.com/apache/zeppelin/pull/2671
---
[GitHub] zeppelin issue #2671: [ZEPPELIN-3045] Add the option which prevents the cron...
Posted by kjmrknsn <gi...@git.apache.org>.
Github user kjmrknsn commented on the issue:
https://github.com/apache/zeppelin/pull/2671
> Would it be much easier that we can just do not allow user to set cron executing user in frontend when this zeppelin.notebook.cronExecutingUser.loginUserOnly is true ? So that there would be less change in backend.
It seems nice. I'll try that later.
---
[GitHub] zeppelin issue #2671: [ZEPPELIN-3045] Add the option which prevents the cron...
Posted by felixcheung <gi...@git.apache.org>.
Github user felixcheung commented on the issue:
https://github.com/apache/zeppelin/pull/2671
we still want a check in the backend right, since this is a security/authentication issue.
---
[GitHub] zeppelin issue #2671: [ZEPPELIN-3045] Add the option which prevents the cron...
Posted by kjmrknsn <gi...@git.apache.org>.
Github user kjmrknsn commented on the issue:
https://github.com/apache/zeppelin/pull/2671
@felixcheung @zjffdu
> we still want a check in the backend right, since this is a security/authentication issue.
OK, thanks. So, I won't rewrite this PR to modify frontend. I'll reply to your review comments.
---
[GitHub] zeppelin issue #2671: [ZEPPELIN-3045] Add the option which prevents the cron...
Posted by kjmrknsn <gi...@git.apache.org>.
Github user kjmrknsn commented on the issue:
https://github.com/apache/zeppelin/pull/2671
@Leemoonsoo Thanks for your comment and suggestion.
> One question, how about make zeppelin.notebook.cronExecutingUser.loginUserOnly default value true? Does it make sense to you? or do you see any possible problem on making it true by default?
I'll change the default value to `true`.
I set it to `false` just because I didn't know whether I might change the default behavior of Zeppelin or not.
---
[GitHub] zeppelin issue #2671: [ZEPPELIN-3045] Add the option which prevents the cron...
Posted by zjffdu <gi...@git.apache.org>.
Github user zjffdu commented on the issue:
https://github.com/apache/zeppelin/pull/2671
Would it be much easier that we can just do not allow user to set cron executing user in frontend when this `zeppelin.notebook.cronExecutingUser.loginUserOnly` is true ? So that there would be less change in backend.
---
[GitHub] zeppelin issue #2671: [ZEPPELIN-3045] Add the option which prevents the cron...
Posted by Leemoonsoo <gi...@git.apache.org>.
Github user Leemoonsoo commented on the issue:
https://github.com/apache/zeppelin/pull/2671
Thanks @kjmrknsn for the great contribution.
One question, how about make `zeppelin.notebook.cronExecutingUser.loginUserOnly` default value `true`? Does it make sense to you? or do you see any possible problem on making it true by default?
---
[GitHub] zeppelin issue #2671: [ZEPPELIN-3045] Add the option which prevents the cron...
Posted by kjmrknsn <gi...@git.apache.org>.
Github user kjmrknsn commented on the issue:
https://github.com/apache/zeppelin/pull/2671
The build result on Travis CI turned to green by rebuilding: https://travis-ci.org/kjmrknsn/zeppelin/builds/302473619
---
[GitHub] zeppelin issue #2671: [ZEPPELIN-3045] Add the option which prevents the cron...
Posted by kjmrknsn <gi...@git.apache.org>.
Github user kjmrknsn commented on the issue:
https://github.com/apache/zeppelin/pull/2671
The default value of `zeppelin.notebook.cronExecutingUser.loginUserOnly` was changed to `true`. The Commits are squashed.
---
[GitHub] zeppelin issue #2671: [ZEPPELIN-3045] Add the option which prevents the cron...
Posted by prabhjyotsingh <gi...@git.apache.org>.
Github user prabhjyotsingh commented on the issue:
https://github.com/apache/zeppelin/pull/2671
Ping @kjmrknsn, are you still working on this?
---
[GitHub] zeppelin issue #2671: [ZEPPELIN-3045] Add the option which prevents the cron...
Posted by msk84 <gi...@git.apache.org>.
Github user msk84 commented on the issue:
https://github.com/apache/zeppelin/pull/2671
For me having the solution with the restriction to set only myself as a cron user would be perfect.
---
[GitHub] zeppelin issue #2671: [ZEPPELIN-3045] Add the option which prevents the cron...
Posted by kjmrknsn <gi...@git.apache.org>.
Github user kjmrknsn commented on the issue:
https://github.com/apache/zeppelin/pull/2671
@felixcheung @zjffdu Thanks for your reviewing. I'll rewrite this PR to modify frontend instead of backend as @zjffdu said at the beginning of next week.
---
[GitHub] zeppelin issue #2671: [ZEPPELIN-3045] Add the option which prevents the cron...
Posted by zjffdu <gi...@git.apache.org>.
Github user zjffdu commented on the issue:
https://github.com/apache/zeppelin/pull/2671
@msk84 This is what I propsed in [ZEPPELIN-3350](https://issues.apache.org/jira/browse/ZEPPELIN-3350)
---