You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@zeppelin.apache.org by prabhjyotsingh <gi...@git.apache.org> on 2016/06/10 06:37:02 UTC
[GitHub] zeppelin pull request #986: [Zeppelin 946] [WIP] Permissions not honoring gr...
GitHub user prabhjyotsingh opened a pull request:
https://github.com/apache/zeppelin/pull/986
[Zeppelin 946] [WIP] Permissions not honoring group
### What is this PR for?
Error:
Insufficient privileges to write notebook.
Allowed users or roles: [admin, zeppelinWrite]
But the user randerson belongs to: [randerson]
It's seems clear that user randerson isn't mapped to any roles, or groups (even though he of course is a member of the zeppelinWrite group in AD and as a result also part of the local admin Role). A TCPDUMP reveals that during login, all of my group memberships are in fact returned during the ldap bind operation. However, when I attempt to modify a notebook, a call is never made to AD, to pull back my group memberships. It doesn't seem to look at my local group memberships (/etc/group) either.
### What type of PR is it?
[Bug Fix]
### Todos
* [x] - fix for permissions not honoring group
* [x] - read roles from shiro.ini
* [x] - at times group name was displaying instead of user/principal name.
* [ ] - doc
### What is the Jira issue?
[ZEPPELIN-946](https://issues.apache.org/jira/browse/ZEPPELIN-946)
### How should this be tested?
Use one of the following setting for LDAP/AD in shiro.ini
[main]
activeDirectoryRealm = org.apache.zeppelin.server.ActiveDirectoryGroupRealm
activeDirectoryRealm.systemUsername = userNameA
activeDirectoryRealm.systemPassword = passwordA
activeDirectoryRealm.searchBase = CN=Users,DC=SOME_GROUP,DC=COMPANY,DC=COM
activeDirectoryRealm.url = ldap://ldap.test.com:389
activeDirectoryRealm.groupRolesMap = "CN=aGroupName,OU=groups,DC=SOME_GROUP,DC=COMPANY,DC=COM":"group1"
ldapRealm = org.apache.zeppelin.server.LdapGroupRealm
# search base for ldap groups (only relevant for LdapGroupRealm):
ldapRealm.contextFactory.environment[ldap.searchBase] = dc=COMPANY,dc=COM
ldapRealm.contextFactory.url = ldap://ldap.test.com:389
ldapRealm.userDnTemplate = uid={0},ou=Users,dc=COMPANY,dc=COM
ldapRealm.contextFactory.authenticationMechanism = SIMPLE
[roles]
group1 = *
group2 = *
group3 = *
[urls]
/api/version = anon
#/** = anon
/** = authc
### Screenshots (if appropriate)
### Questions:
* Does the licenses files need update? no
* Is there breaking changes for older versions? no
* Does this needs documentation? no
You can merge this pull request into a Git repository by running:
$ git pull https://github.com/prabhjyotsingh/incubator-zeppelin ZEPPELIN-946
Alternatively you can review and apply these changes as the patch at:
https://github.com/apache/zeppelin/pull/986.patch
To close this pull request, make a commit to your master/trunk branch
with (at least) the following in the commit message:
This closes #986
----
commit 4194f931f723f22331c3931cb5811d79b1ad1a78
Author: Prabhjyot Singh <pr...@gmail.com>
Date: 2016-06-09T11:51:11Z
sometime it dispalys groupName instead of principal
commit e8f1f97756d325f3f01545b02e889808b809740a
Author: Prabhjyot Singh <pr...@gmail.com>
Date: 2016-06-09T11:51:48Z
fix for permissions not honoring group
commit ed54a92194bdb52bac2be0e16d9d27272b2379b1
Author: Prabhjyot Singh <pr...@gmail.com>
Date: 2016-06-09T18:06:00Z
read roles from shiro.ini
----
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
[GitHub] zeppelin issue #986: [Zeppelin 946] Permissions not honoring group
Posted by prabhjyotsingh <gi...@git.apache.org>.
Github user prabhjyotsingh commented on the issue:
https://github.com/apache/zeppelin/pull/986
Can you run ldapsearch like
`ldapsearch -D "user1" -w pwd -H ldaps://testcore.test.dir.org.com:636 -b "DC=testcore,DC=test,DC=dir,DC=org,DC=com" -s sub "(&(objectClass=*)(userPrincipalName=user1))"`
and look for key "memberOf", this should tell you to which all groups "user1" belongs.
Alternatively, set log level to debug, then try to login into UI and look for string `Groups found for user [<<user_id>>]: ` this will also give the same group information about what group this user belongs.
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
[GitHub] zeppelin issue #986: [Zeppelin 946] Permissions not honoring group
Posted by prabhjyotsingh <gi...@git.apache.org>.
Github user prabhjyotsingh commented on the issue:
https://github.com/apache/zeppelin/pull/986
Ready for review
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
[GitHub] zeppelin issue #986: [Zeppelin 946] Permissions not honoring group
Posted by Leemoonsoo <gi...@git.apache.org>.
Github user Leemoonsoo commented on the issue:
https://github.com/apache/zeppelin/pull/986
Thanks @prabhjyotsingh for the fix. Tested and looks good to me!
I think it'll be great to have a unittest for it, either in this pr or later in separate pr.
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
[GitHub] zeppelin issue #986: [Zeppelin 946] Permissions not honoring group
Posted by prabhjyotsingh <gi...@git.apache.org>.
Github user prabhjyotsingh commented on the issue:
https://github.com/apache/zeppelin/pull/986
@vinayshukla, Yes, this fix is for both Active Directory and LDAP. Have tested this with configuring Active Directory running on Windows Server 2008, and on an open LDAP running on CentOS6.4.
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
[GitHub] zeppelin issue #986: [Zeppelin 946] Permissions not honoring group
Posted by prabhjyotsingh <gi...@git.apache.org>.
Github user prabhjyotsingh commented on the issue:
https://github.com/apache/zeppelin/pull/986
@ekantheshwara this sounds like a bug, can you create a JIRA, will try to address it.
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
[GitHub] zeppelin issue #986: [Zeppelin 946] Permissions not honoring group
Posted by rja1 <gi...@git.apache.org>.
Github user rja1 commented on the issue:
https://github.com/apache/zeppelin/pull/986
Thanks for your work on this! I built and deployed the zeppelin-946 branch. Unfortunately, I'm unable to authenticate against AD. Looking at the tcpdump, it appears activeDirectoryRealm.principalSuffix isn't honored. As a result, the bind request searches for randerson, rather than randerson@company.com...
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
[GitHub] zeppelin issue #986: [Zeppelin 946] Permissions not honoring group
Posted by ekantheshwara <gi...@git.apache.org>.
Github user ekantheshwara commented on the issue:
https://github.com/apache/zeppelin/pull/986
@prabhjyotsingh
This is my complete shiro config:
[users]
admin = password1
# Sample LDAP configuration, for user Authentication, currently tested for single Realm
[main]
activeDirectoryRealm = org.apache.zeppelin.server.ActiveDirectoryGroupRealm
activeDirectoryRealm.systemUsername = user1
activeDirectoryRealm.systemPassword = pwd
#activeDirectoryRealm.hadoopSecurityCredentialPath = jceks://user/zeppelin/zeppelin.jceks
activeDirectoryRealm.searchBase = DC=testcore,DC=test,DC=dir,DC=org,DC=com
activeDirectoryRealm.url = ldaps://testcore.test.dir.org.com:636
activeDirectoryRealm.groupRolesMap = "CN=APPADMIN,OU=Managed,OU=Groups,DC=testcore,DC=test,DC=dir,DC=org,DC=com":"admin"
activeDirectoryRealm.authorizationCachingEnabled = true
activeDirectoryRealm.principalSuffix = @testcore.test.dir.org.com
sessionManager = org.apache.shiro.web.session.mgt.DefaultWebSessionManager
securityManager.sessionManager = $sessionManager
securityManager.sessionManager.globalSessionTimeout = 86400000
shiro.loginUrl = /api/login
securityManager.realms = $activeDirectoryRealm
[roles]
admin = *
[urls]
/api/version = anon
/api/interpreter/** = authc, roles[admin]
/api/configurations/** = authc, roles[admin]
/api/credential/** = authc, roles[admin]
#/** = anon
/** = authc
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
[GitHub] zeppelin issue #986: [Zeppelin 946] Permissions not honoring group
Posted by prabhjyotsingh <gi...@git.apache.org>.
Github user prabhjyotsingh commented on the issue:
https://github.com/apache/zeppelin/pull/986
I think we should as this is to do with AD auth.
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
[GitHub] zeppelin issue #986: [Zeppelin 946] Permissions not honoring group
Posted by ChrisMcVey <gi...@git.apache.org>.
Github user ChrisMcVey commented on the issue:
https://github.com/apache/zeppelin/pull/986
Well... I'm back again. :)
Apparently, Office 365 requires that userPrincipalName be changed to the user's routable email address in order for it to be used in any cloud environments. Company-wide I have found that where I am currently working, no sAMAccountNames match userPrincipalNames. Further, no usernames match the new userPrincipalNames set for compliance with Office 365.
So, the current design of the provider will implicitly not work with AD going forward.
https://blogs.technet.microsoft.com/askpfeplat/2013/09/01/office-365-single-sign-on-how-to-handle-different-userprincipalname-upn-values/
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
[GitHub] zeppelin issue #986: [Zeppelin 946] Permissions not honoring group
Posted by rja1 <gi...@git.apache.org>.
Github user rja1 commented on the issue:
https://github.com/apache/zeppelin/pull/986
Thanks once again @prabhjyotsingh. I really appreciate your work. The activeDirectoryRealm.principalSuffix works now. I do have some concerns about the number of ldap calls made and the amount of data pulled back.
It looks like the app:
1) makes ldap bindRequest as null@mydomain.com and fails.
2) makes ldap bindRequest as username@mydomain.com and succeeds.
3) makes a bindRequest as activeDirectoryRealm.systemUsername@mydomain.com and succeeds
4) does a searchRequest for the wholeSubTree
Step 4 pulls back about 5mb of data, which is a lot. Could add quite a lot of load to AD, if lots of users are simultaneously using the UI... I can limit the result set by more fully qualifying the activeDirectoryRealm.searchBase, however, then it seems to miss the group data. Seems like there should really just be only be a couple lightweight calls.
1) bind the username
2) pull back the group memberships for username (if step one was a success).
Not sure if there's a more concise way to make these queries in java. I can do it via command line the following way: ldapsearch -xLLL -h ldapServer -b "dc=company,dc=com" -D "CN=LDAP Bind,OU=Special,Accounts,DC=company,DC=com" -W uid=randerson. This returns everything about the uid: randerson, including all group memberships. The total size of the data is 60k...
In addition, my groups / roles are still not mapped to my username, regardless of if the app searches the whole tree or not. I'm not sure why. Perhaps I've missed something along the way.
Here's my shiro.ini:
[main]
activeDirectoryRealm = org.apache.zeppelin.server.ActiveDirectoryGroupRealm
activeDirectoryRealm.systemUsername = username
activeDirectoryRealm.systemPassword = password
activeDirectoryRealm.searchBase = dc=company,dc=com
activeDirectoryRealm.url = ldap://server:389
activeDirectoryRealm.groupRolesMap = "cn=g.acl.ops.bigdata,ou=unix groups,ou=groups,ou=accounts,cn=users,dc=company,dc=com":"admin"
activeDirectoryRealm.authorizationCachingEnabled=false
activeDirectoryRealm.principalSuffix=@DOMAIN.COM
shiro.loginUrl = /api/login
sessionManager = org.apache.shiro.web.session.mgt.DefaultWebSessionManager
securityManager.sessionManager = $sessionManager
securityManager.sessionManager.globalSessionTimeout = 86400000
shiro.loginUrl = /api/login
[roles]
admin = *
[urls]
/api/version = anon
/** = authc
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
[GitHub] zeppelin issue #986: [Zeppelin 946] Permissions not honoring group
Posted by ekantheshwara <gi...@git.apache.org>.
Github user ekantheshwara commented on the issue:
https://github.com/apache/zeppelin/pull/986
@prabhjyotsingh
Thanks a lot for your response.
I am using AD and the authentication is working fine. I have a user User1 who is a member of AD_Group1 which is associated with the "admin" role in Shiro. I have a dashboard for which I have configured AD_Group1 as reader, writer and owner.
When I login as User1 and try to access the dashboard, I am getting the message "But the user User1 belongs to: [User1]". Clearly, Zeppelin is not aware of the group membership of the user.
Can you please advise what could have gone wrong here ?
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
[GitHub] zeppelin issue #986: [Zeppelin 946] Permissions not honoring group
Posted by ekantheshwara <gi...@git.apache.org>.
Github user ekantheshwara commented on the issue:
https://github.com/apache/zeppelin/pull/986
@prabhjyotsingh
My Zeppelin version is 0.6.0.2.5.0.0-1245
Is this version supposed to have your fix ? I am facing the same issue and am wondering if I am missing your fix or something else.
Please let me know.
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
[GitHub] zeppelin issue #986: [Zeppelin 946] Permissions not honoring group
Posted by ChrisMcVey <gi...@git.apache.org>.
Github user ChrisMcVey commented on the issue:
https://github.com/apache/zeppelin/pull/986
Well through some more testing, I've found that it it will accept logins as _either_ the userPrincipalName (without the realm) _or_ the sAMAccountName. This true if the principal suffix is NOT set in shiro.
I.E.
If the object has these two defined in AD:
sAMAccountName=userexample
userPrincipalName=userex/hostname1.domain.com@REALM.COM
AND shiro.ini does not have the principal suffix:
#activeDirectoryRealm.principalSuffix = @REALM.COM
Then I am able to login to the UI with either userexample or userex/hostname1.domain.com as the username.
If the principal suffix is enabled:
activeDirectoryRealm.principalSuffix = @REALM.COM
Then, I cannot login to the UI with any form of userex/hostname1.domain.com but I can login with userexample. Logging in with userexample is useless because userexample@REALM.COM will not be found for group mappings by the UPN search filter.
Adding all this for clarity... Zeppelin ActiveDirectoryGroupRealm does not explicity authentication the user using sAMAccountName but it does permit it. It will also accept UPN. In most cases, these match. In some cases, they may not.
The more I look at this, it is becoming apparent that as an AD provider and not an LDAP provider, they are assuming that running ktpass for a keytab as we have done is not a valid user for this provider.
Hopefully, this info is at least helpful if someone else has this same odd config!
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
[GitHub] zeppelin issue #986: [Zeppelin 946] Permissions not honoring group
Posted by ChrisMcVey <gi...@git.apache.org>.
Github user ChrisMcVey commented on the issue:
https://github.com/apache/zeppelin/pull/986
FYI... I have been having similar issues and above and until reading this thread in detail did I realize it is searching against userPrincipalName and not sAMAccountName which is a better option.
Above it is mentioned the builtin user filter/subsearch is "(&(objectClass=*)(userPrincipalName=user1))"
However, if a user ever runs ktpass on AD to export a keytab with a different principal name, the userPrincipalName can end up differing from sAMAccountName.
It does not make sense to authenticate users via sAMAccountName successfully, then search for them again using a *different* AD property userPrincipalName... especially when these can differ. userPrincipalName is set for Kerberos which is not always gonna to be consistent with LDAP logins which is what AD provider is doing.
Spent a lot of time scratching my head! Thanks for the detailed post above about the search filter. I'm quite certain my case where sAMAccountName differs from UPN is the exception to the rule but there is no reason not to match these up just in case.
Best Regards
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
[GitHub] zeppelin pull request #986: [Zeppelin 946] Permissions not honoring group
Posted by asfgit <gi...@git.apache.org>.
Github user asfgit closed the pull request at:
https://github.com/apache/zeppelin/pull/986
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
[GitHub] zeppelin issue #986: [Zeppelin 946] Permissions not honoring group
Posted by prabhjyotsingh <gi...@git.apache.org>.
Github user prabhjyotsingh commented on the issue:
https://github.com/apache/zeppelin/pull/986
@rja1, Thank you for much detailed analysis.
- I have made another commit, this should take care of `makes ldap bindRequest as null@mydomain.com and fails.`
- I cannot do anything for `activeDirectoryRealm.systemUsername@mydomain.com ` as this binding is required for searching the LDAP/AD tree.
- For the following
> Step 4 pulls back about 5mb of data, which is a lot.
I will recommend, tuning the shiro app by
```
activeDirectoryRealm.authorizationCachingEnabled = true
cacheManager = org.apache.shiro.cache.MemoryConstrainedCacheManager
securityManager.cacheManager = $cacheManager
```
- And for
> In addition, my groups / roles are still not mapped to my username
Can you try and execute command below, and see if that works;
```
ldapsearch -h ldapServer -x -D "CN=${activeDirectoryRealm.systemUsername},${activeDirectoryRealm.searchBase}" -w ${activeDirectoryRealm.systemPassword} -b "${activeDirectoryRealm.groupRolesMap[0]}"
```
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
[GitHub] zeppelin issue #986: [Zeppelin 946] Permissions not honoring group
Posted by ekantheshwara <gi...@git.apache.org>.
Github user ekantheshwara commented on the issue:
https://github.com/apache/zeppelin/pull/986
@prabhjyotsingh
I dont see a call made to AD to check the group membership when a Notebook is accessed. These are the logs that I see when I access the Notebook:
ssion,outgoing=org.eclipse.jetty.websocket.server.WebSocketServerConnection]
DEBUG [2017-04-11 10:34:39,042] ({qtp1170794006-15} AbstractEventDriver.java[incomingFrame]:103) - incomingFrame(TEXT[len=126,fin=true,rsv=...,masked=true])
DEBUG [2017-04-11 10:34:39,042] ({qtp1170794006-15} NotebookServer.java[onMessage]:106) - RECEIVE << GET_NOTE
DEBUG [2017-04-11 10:34:39,042] ({qtp1170794006-15} NotebookServer.java[onMessage]:107) - RECEIVE PRINCIPAL << user1
DEBUG [2017-04-11 10:34:39,042] ({qtp1170794006-15} NotebookServer.java[onMessage]:108) - RECEIVE TICKET << b2512330-0a0f-4631-9913-c688d1c9d7f2
DEBUG [2017-04-11 10:34:39,043] ({qtp1170794006-15} NotebookServer.java[onMessage]:109) - RECEIVE ROLES << []
INFO [2017-04-11 10:34:39,043] ({qtp1170794006-15} NotebookServer.java[sendNote]:423) - New operation from 10.60.179.195 : 49895 : user1 : GET_NOTE : 2CC4Z4DEX
INFO [2017-04-11 10:34:39,043] ({qtp1170794006-15} NotebookServer.java[permissionError]:411) - Cannot read. Connection readers [user1]. Allowed readers [APPADMIN]
DEBUG [2017-04-11 10:34:39,044] ({qtp1170794006-15} WebSocketRemoteEndpoint.java[sendString]:385) - sendString with HeapByteBuffer@669d45be[p=0,l=235,c=235,r=235]={<<<{"op":"AUTH_INFO"...us","roles":""}>>>}
However, when I access the "interpreter" or "configurations" url, I get the below logs which explain why the config is effective for URLs:
DEBUG [2017-04-11 10:38:58,087] ({qtp1170794006-16 - /api/interpreter/setting} ActiveDirectoryGroupRealm.java[getRoleNamesForUser]:286) - Groups found for user [d786090]: [CN=APPADMIN,OU=Managed,OU=Groups,DC=testcore,DC=test,DC=dir,DC=org,DC=com]
DEBUG [2017-04-11 10:38:58,087] ({qtp1170794006-16 - /api/interpreter/setting} ActiveDirectoryGroupRealm.java[getRoleNamesForGroups]:316) - User is member of group [CN=APPADMIN,OU=Managed,OU=Groups,DC=testcore,DC=test,DC=dir,DC=telstra,DC=com] so adding role [admin]
This makes me think that your fix may not be available in the Zeppelin version that I am using. Can you please let me know if there is any other way of verifying if your fix is available in my Zeppelin ?
Looking forward to your response.
Regards,
Ekantheshwara
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
[GitHub] zeppelin issue #986: [Zeppelin 946] Permissions not honoring group
Posted by prabhjyotsingh <gi...@git.apache.org>.
Github user prabhjyotsingh commented on the issue:
https://github.com/apache/zeppelin/pull/986
@Leemoonsoo thank you for taking a look at it. Have added a selenium test case for the same.
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
[GitHub] zeppelin issue #986: [Zeppelin 946] Permissions not honoring group
Posted by ekantheshwara <gi...@git.apache.org>.
Github user ekantheshwara commented on the issue:
https://github.com/apache/zeppelin/pull/986
@prabhjyotsingh
The issue got resolved. I had to take out the line "securityManager.realms = $activeDirectoryRealm" from my config and that resolved the issue. I dont see anything wrong in the line I took out. However, I believe this is an optional config.
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
[GitHub] zeppelin issue #986: [Zeppelin 946] Permissions not honoring group
Posted by zlosim <gi...@git.apache.org>.
Github user zlosim commented on the issue:
https://github.com/apache/zeppelin/pull/986
@prabhjyotsingh i was strugling few days as my groups were not honored and found this thread :)
I`m having issues described by @ChrisMcVey - using microsoft AD, UPN is not the same as username + activeDirectoryRealm.principalSuffix
I was not able to find any follow up, is there anything i can do to help solve this?
---
[GitHub] zeppelin issue #986: [Zeppelin 946] Permissions not honoring group
Posted by rja1 <gi...@git.apache.org>.
Github user rja1 commented on the issue:
https://github.com/apache/zeppelin/pull/986
Nice job @prabhjyotsingh, thanks for your work! I don't see the extra ldap call anymore (step 1). I also don't see the large ldap call any longer (step 4). In addition, all of my roles are mapped as expected.
I'm not sure if all of these changes are related to your latest commit, or if I missed something along the way, that I picked up in the latest 946 branch. At any rate, looks good!
I'll continue to test it today and will let you know if I see any other issues.
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
[GitHub] zeppelin issue #986: [Zeppelin 946] Permissions not honoring group
Posted by ekantheshwara <gi...@git.apache.org>.
Github user ekantheshwara commented on the issue:
https://github.com/apache/zeppelin/pull/986
@prabhjyotsingh
I set the log level to debug and checked the "Groups found for user". I could definitely see the group that has been configured as "admin" in shiro. Also, the [urls] section is effective i.e. if I login as a different user who is not a member of the group defined as "admin", then I can not see the interpreter, configurations etc.
The problem is only with the Note permissions. I have tried configuring the "AD group name", "full DN of the AD group" and also the "corresponding role in shiro" as the Readers of the Notebook. But when I try to access the Notebook, all I get is "But the user user1belongs to: [user1]".
Another observation:
While setting the note permissions, I am able to search the AD users but not the AD groups. So, I am just entering the AD group name and saving it even though the search does not resolve it. The search does not resolve even if I enter the full group DN or the role name. Any idea why I am not able to look up the group names in Note permissions section ?
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
[GitHub] zeppelin issue #986: [Zeppelin 946] Permissions not honoring group
Posted by prabhjyotsingh <gi...@git.apache.org>.
Github user prabhjyotsingh commented on the issue:
https://github.com/apache/zeppelin/pull/986
@rja1 have made some changes, hope this(188ac170c7a0921044f301ae703bf580a71b2cdf) solves for "activeDirectoryRealm.principalSuffix isn't honoured"
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
[GitHub] zeppelin issue #986: [Zeppelin 946] Permissions not honoring group
Posted by prabhjyotsingh <gi...@git.apache.org>.
Github user prabhjyotsingh commented on the issue:
https://github.com/apache/zeppelin/pull/986
@rja1 Good to know, I'm able to resolve what you asked for.
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
[GitHub] zeppelin issue #986: [Zeppelin 946] Permissions not honoring group
Posted by Leemoonsoo <gi...@git.apache.org>.
Github user Leemoonsoo commented on the issue:
https://github.com/apache/zeppelin/pull/986
@prabhjyotsingh is it going to be merged to 0.6-branch, too?
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
[GitHub] zeppelin issue #986: [Zeppelin 946] Permissions not honoring group
Posted by prabhjyotsingh <gi...@git.apache.org>.
Github user prabhjyotsingh commented on the issue:
https://github.com/apache/zeppelin/pull/986
Hi @rja1,
I see two issues in your request;
1. Your AD require you to pass @domainName; I understand in some of the cases, depending on how you have configured AD, it requires you to pass "@domainName". And in your case this seem to be the issue, and hence when you pass randerson with @company.com, it works.
2. Roles are not being assigned to the user; for this, here is what I recommend
* make sure you have something like this configured in you shiro.ini `activeDirectoryRealm.groupRolesMap = "CN=admin,OU=groups,DC=SOME_GROUP,DC=COMPANY,DC=COM":"admin","CN=finance,OU=groups,DC=SOME_GROUP,DC=COMPANY,DC=COM":"finance","CN=hr,OU=groups,DC=SOME_GROUP,DC=COMPANY,DC=COM":"hr"`
* and corresponding to each group you have a roles entry in shiro.ini
```
[roles]
admin = *
hr = *
finance = *
group1 = *
```
For your reference here is my shiro.ini, and on this configured AD server both `zeppelin` and `zeppelin@SUB.MYDOMAIN.COM` user work fine. Let me know if this resolves the issue.
[main]
activeDirectoryRealm = org.apache.zeppelin.server.ActiveDirectoryGroupRealm
activeDirectoryRealm.principalSuffix = @SUB.MYDOMAIN.COM
activeDirectoryRealm.systemUsername = manager
activeDirectoryRealm.systemPassword = TestUser123
activeDirectoryRealm.searchBase = CN=Users,DC=SUB,DC=MYDOMAIN,DC=COM
activeDirectoryRealm.url = ldap://mydomain.com:389
activeDirectoryRealm.groupRolesMap = "CN=admin,OU=groups,DC=SUB,DC=MYDOMAIN,DC=COM":"admin"
activeDirectoryRealm.authorizationCachingEnabled = false
sessionManager = org.apache.shiro.web.session.mgt.DefaultWebSessionManager
securityManager.sessionManager = $sessionManager
securityManager.sessionManager.globalSessionTimeout = 86400000
shiro.loginUrl = /api/login
[roles]
admin = *
[urls]
/api/version = anon
/** = authc
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
[GitHub] zeppelin issue #986: [Zeppelin 946] Permissions not honoring group
Posted by prabhjyotsingh <gi...@git.apache.org>.
Github user prabhjyotsingh commented on the issue:
https://github.com/apache/zeppelin/pull/986
Sounds like `activeDirectoryRealm.groupRolesMap = "CN=aGroupName,OU=groups,DC=SOME_GROUP,DC=COMPANY,DC=COM":"group1"` not configured correctly.
I would recommend
- configure it something like `activeDirectoryRealm.groupRolesMap = "CN=admin,OU=groups,DC=SOME_GROUP,DC=COMPANY,DC=COM":"admin","CN=finance,OU=groups,DC=SOME_GROUP,DC=COMPANY,DC=COM":"finance","CN=hr,OU=groups,DC=SOME_GROUP,DC=COMPANY,DC=COM":"hr"`
Just confirm with your AD admin, regarding what all users belongs to what all groups.
If you are still unsure about what user belongs to what group, set you log4j to debug mode and grep for this https://github.com/apache/zeppelin/blob/v0.6.0/zeppelin-server/src/main/java/org/apache/zeppelin/server/ActiveDirectoryGroupRealm.java#L198. This should give you all details.
In my case, there were these three groups i.e. admin, finance, and hr.
- After the `[main]` section and before `[urls]` make sure you have `[roles]` defined something like this.
```
[roles]
admin = *
finance = *
hr = *
```
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
[GitHub] zeppelin issue #986: [Zeppelin 946] Permissions not honoring group
Posted by ekantheshwara <gi...@git.apache.org>.
Github user ekantheshwara commented on the issue:
https://github.com/apache/zeppelin/pull/986
@prabhjyotsingh
Is there any other way of verifying if the fix is available in my version of Zeppelin? I dont see a call made to AD to check the group membership when a Notebook is accessed.
Please suggest. Your inputs will be really helpful.
Thanks,
Ekantheshwara
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
[GitHub] zeppelin issue #986: [Zeppelin 946] Permissions not honoring group
Posted by ekantheshwara <gi...@git.apache.org>.
Github user ekantheshwara commented on the issue:
https://github.com/apache/zeppelin/pull/986
@prabhjyotsingh
I have created one:
https://issues.apache.org/jira/browse/ZEPPELIN-2550
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
[GitHub] zeppelin issue #986: [Zeppelin 946] Permissions not honoring group
Posted by prabhjyotsingh <gi...@git.apache.org>.
Github user prabhjyotsingh commented on the issue:
https://github.com/apache/zeppelin/pull/986
@ekantheshwara yes, this version should have the above-mentioned fix.
Could be a configuration issue, if you can share what exactly are you trying with i.e. is it with file based auth, LDAP or AD.
Also you can look into log file `zeppelin-{machine-name}-{machine-id}.local.log` for more logs when you login, with something like this `({qtp1846406218-26} LoginRestApi.java[postLogin]:115) - {"status":"OK","message":"","body":{"principal":"hr1","ticket":"98569477-5809-43c6-acb4-7b22e78d7541","roles":"[admin]"}}`
If you see `"roles":"[admin]"` means user hr1 is assigned to role->admin in this example, but if `"roles":"[]"` i.e. it is empty, then it means there if problem with configuration.
Here is a doc to help you out http://zeppelin.apache.org/docs/0.6.1/security/shiroauthentication.html.
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
[GitHub] zeppelin issue #986: [Zeppelin 946] Permissions not honoring group
Posted by prabhjyotsingh <gi...@git.apache.org>.
Github user prabhjyotsingh commented on the issue:
https://github.com/apache/zeppelin/pull/986
Merging this if no more discussion.
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
[GitHub] zeppelin issue #986: [Zeppelin 946] Permissions not honoring group
Posted by prabhjyotsingh <gi...@git.apache.org>.
Github user prabhjyotsingh commented on the issue:
https://github.com/apache/zeppelin/pull/986
@ChrisMcVey Thank you for providing so much inside, is it possible for you to create a JIRA, with if possible some steps to reproduce, or even dump of these comments will do, and will try to resolve.
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
[GitHub] zeppelin issue #986: [Zeppelin 946] Permissions not honoring group
Posted by ekantheshwara <gi...@git.apache.org>.
Github user ekantheshwara commented on the issue:
https://github.com/apache/zeppelin/pull/986
@prabhjyotsingh
You are right. The log shows:
WARN [2017-04-10 16:37:27,945] ({qtp1577213552-13} LoginRestApi.java[postLogin]:111) - {"status":"OK","message":"","body":{"principal":"<user_id>","ticket":"f7e3dc96-3aea-43ab-9b5a-5d5020eb56fb","roles":"[]"}}
The groupRolesMap property is set as shown:
activeDirectoryRealm.groupRolesMap = "CN=APPADMIN,OU=Managed,OU=Groups,DC=testcore,DC=test,DC=dir,DC=<org>,DC=com":"admin"
I have double checked and the group DN is correct. The roles and the url sections in shiro are as shown below:
[roles]
admin = *
[urls]
/api/version = anon
/api/interpreter/** = authc, roles[admin]
/api/configurations/** = authc, roles[admin]
/api/credential/** = authc, roles[admin]
#/** = anon
/** = authc
What else could have gone wrong ?
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---