-
Notifications
You must be signed in to change notification settings - Fork 2.8k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Added Authentication. Once authenticated, a user has access to all notes. HTTP & Websocket channels are secured and require auth. This PR is based on #53 which also implements user ownership on notes. Author: Hayssam Saleh <hayssam.saleh@ebiznext.com> Closes #586 from hayssams/shiro-security-v2 and squashes the following commits: 47421b8 [Hayssam Saleh] Rollback classpath change since zeppelin conf dir already in classpath 5485dcd [Hayssam Saleh] Updates licences for shiro-core and shiro-web introduced in this PR 7200e77 [Hayssam Saleh] Default ticket / principal to anonymous in websocket message 30736a0 [Hayssam Saleh] Add support for cross site requests with credentials 1372231 [Hayssam Saleh] Test mode requires to user baseUrlSrv to connect to the REST API 96ec240 [Hayssam Saleh] use standard HTML tags for SECURITY-README.md 01ba543 [Hayssam Saleh] get ticket before Angular is bootstrapped 2a9e275 [Hayssam Saleh] Add implementation notes 96d1fac [Hayssam Saleh] correct comment in SECURITY-README and keep anonymous policy by default in zeppelin-site.xml.template 6fd9982 [Hayssam Saleh] Add minimal shiro.ini file for test phase 8eee51d [Hayssam Saleh] Remove cache optimization in shiro since it references stormpath and comes from there. 2017925 [Hayssam Saleh] exclude SECURITY-README from rat check f9b1952 [Hayssam Saleh] The Websocket channel is now as secure as the HTTP channel. e2affca [Hayssam Saleh] Securing the HTTP channel only. Websocket security is done in the next commit
- Loading branch information
1 parent
ff99ecb
commit 89c5924
Showing
22 changed files
with
557 additions
and
65 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,43 @@ | ||
| <!-- | ||
| Licensed under the Apache License, Version 2.0 (the "License"); | ||
| you may not use this file except in compliance with the License. | ||
| You may obtain a copy of the License at | ||
| http://www.apache.org/licenses/LICENSE-2.0 | ||
| Unless required by applicable law or agreed to in writing, software | ||
| distributed under the License is distributed on an "AS IS" BASIS, | ||
| WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| See the License for the specific language governing permissions and | ||
| limitations under the License. | ||
| --> | ||
|
|
||
| # Shiro Authentication | ||
| To connect to Zeppelin, users will be asked to enter their credentials. Once logged, a user has access to all notes including other users notes. | ||
| This a a first step toward full security as implemented by this pull request (https://github.com/apache/incubator-zeppelin/pull/53). | ||
|
|
||
| # Security setup | ||
| 1. Secure the HTTP channel: Comment the line "/** = anon" and uncomment the line "/** = authcBasic" in the file conf/shiro.ini. Read more about he shiro.ini file format at the following URL http://shiro.apache.org/configuration.html#Configuration-INISections. | ||
| 2. Secure the Websocket channel : Set to property "zeppelin.anonymous.allowed" to "false" in the file conf/zeppelin-site.xml. You can start by renaming conf/zeppelin-site.xml.template to conf/zeppelin-site.xml | ||
| 3. Start Zeppelin : bin/zeppelin.sh | ||
| 4. point your browser to http://localhost:8080 | ||
| 5. Login using one of the user/password combinations defined in the conf/shiro.ini file. | ||
|
|
||
| # Implementation notes | ||
| ## Vocabulary | ||
| username, owner and principal are used interchangeably to designate the currently authenticated user | ||
| ## What are we securing ? | ||
| Zeppelin is basically a web application that spawn remote interpreters to run commands and return HTML fragments to be displayed on the user browser. | ||
| The scope of this PR is to require credentials to access Zeppelin. To achieve this, we use Apache Shiro. | ||
| ## HTTP Endpoint security | ||
| Apache Shiro sits as a servlet filter between the browser and the exposed services and handles the required authentication without any programming required. (See Apache Shiro for more info). | ||
| ## Websocket security | ||
| Securing the HTTP endpoints is not enough, since Zeppelin also communicates with the browser through websockets. To secure this channel, we take the following approach: | ||
| 1. The browser on startup requests a ticket through HTTP | ||
| 2. The Apache Shiro Servlet filter handles the user auth | ||
| 3. Once the user is authenticated, a ticket is assigned to this user and the ticket is returned to the browser | ||
|
|
||
| All websockets communications require the username and ticket to be submitted by the browser. Upon receiving a websocket message, the server checks that the ticket received is the one assigned to the username through the HTTP request (step 3 above). | ||
|
|
||
|
|
||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,33 @@ | ||
| # | ||
| # Licensed to the Apache Software Foundation (ASF) under one or more | ||
| # contributor license agreements. See the NOTICE file distributed with | ||
| # this work for additional information regarding copyright ownership. | ||
| # The ASF licenses this file to You under the Apache License, Version 2.0 | ||
| # (the "License"); you may not use this file except in compliance with | ||
| # the License. You may obtain a copy of the License at | ||
| # | ||
| # http://www.apache.org/licenses/LICENSE-2.0 | ||
| # | ||
| # Unless required by applicable law or agreed to in writing, software | ||
| # distributed under the License is distributed on an "AS IS" BASIS, | ||
| # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| # See the License for the specific language governing permissions and | ||
| # limitations under the License. | ||
| # | ||
|
|
||
| [users] | ||
| # List of users with their password allowed to access Zeppelin. | ||
| # To use a different strategy (LDAP / Database / ...) check the shiro doc at http://shiro.apache.org/configuration.html#Configuration-INISections | ||
| admin = password1 | ||
| user1 = password2 | ||
| user2 = password3 | ||
|
|
||
|
|
||
| [urls] | ||
|
|
||
| # anon means the access is anonymous. | ||
| # authcBasic means Basic Auth Security | ||
| # To enfore security, comment the line below and uncomment the next one | ||
| /** = anon | ||
| #/** = authcBasic | ||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
74 changes: 74 additions & 0 deletions
74
zeppelin-server/src/main/java/org/apache/zeppelin/rest/SecurityRestApi.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,74 @@ | ||
| /* | ||
| * Licensed to the Apache Software Foundation (ASF) under one or more | ||
| * contributor license agreements. See the NOTICE file distributed with | ||
| * this work for additional information regarding copyright ownership. | ||
| * The ASF licenses this file to You under the Apache License, Version 2.0 | ||
| * (the "License"); you may not use this file except in compliance with | ||
| * the License. You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, | ||
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| * See the License for the specific language governing permissions and | ||
| * limitations under the License. | ||
| */ | ||
|
|
||
| package org.apache.zeppelin.rest; | ||
|
|
||
| import org.apache.zeppelin.conf.ZeppelinConfiguration; | ||
| import org.apache.zeppelin.server.JsonResponse; | ||
| import org.apache.zeppelin.ticket.TicketContainer; | ||
| import org.apache.zeppelin.utils.SecurityUtils; | ||
|
|
||
| import javax.ws.rs.GET; | ||
| import javax.ws.rs.Path; | ||
| import javax.ws.rs.Produces; | ||
| import javax.ws.rs.core.Response; | ||
| import java.util.HashMap; | ||
| import java.util.Map; | ||
|
|
||
| /** | ||
| * Zeppelin security rest api endpoint. | ||
| * | ||
| */ | ||
| @Path("/security") | ||
| @Produces("application/json") | ||
| public class SecurityRestApi { | ||
| /** | ||
| * Required by Swagger. | ||
| */ | ||
| public SecurityRestApi() { | ||
| super(); | ||
| } | ||
|
|
||
| /** | ||
| * Get ticket | ||
| * Returns username & ticket | ||
| * for anonymous access, username is always anonymous. | ||
| * After getting this ticket, access through websockets become safe | ||
| * | ||
| * @return 200 response | ||
| */ | ||
| @GET | ||
| @Path("ticket") | ||
| public Response ticket() { | ||
| ZeppelinConfiguration conf = ZeppelinConfiguration.create(); | ||
| String principal = SecurityUtils.getPrincipal(); | ||
| JsonResponse response; | ||
| // ticket set to anonymous for anonymous user. Simplify testing. | ||
| String ticket; | ||
| if ("anonymous".equals(principal)) | ||
| ticket = "anonymous"; | ||
| else | ||
| ticket = TicketContainer.instance.getTicket(principal); | ||
|
|
||
| Map<String, String> data = new HashMap<>(); | ||
| data.put("principal", principal); | ||
| data.put("ticket", ticket); | ||
|
|
||
| response = new JsonResponse(Response.Status.OK, "", data); | ||
| return response.build(); | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
82 changes: 82 additions & 0 deletions
82
zeppelin-server/src/main/java/org/apache/zeppelin/ticket/TicketContainer.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,82 @@ | ||
| /* | ||
| * Licensed to the Apache Software Foundation (ASF) under one or more | ||
| * contributor license agreements. See the NOTICE file distributed with | ||
| * this work for additional information regarding copyright ownership. | ||
| * The ASF licenses this file to You under the Apache License, Version 2.0 | ||
| * (the "License"); you may not use this file except in compliance with | ||
| * the License. You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, | ||
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| * See the License for the specific language governing permissions and | ||
| * limitations under the License. | ||
| */ | ||
|
|
||
| package org.apache.zeppelin.ticket; | ||
|
|
||
| import java.util.Calendar; | ||
| import java.util.Map; | ||
| import java.util.UUID; | ||
| import java.util.concurrent.ConcurrentHashMap; | ||
|
|
||
| /** | ||
| * Very simple ticket container | ||
| * No cleanup is done, since the same user accross different devices share the same ticket | ||
| * The Map size is at most the number of different user names having access to a Zeppelin instance | ||
| */ | ||
|
|
||
|
|
||
| public class TicketContainer { | ||
| private static class Entry { | ||
| public final String ticket; | ||
| // lastAccessTime still unused | ||
| public final long lastAccessTime; | ||
|
|
||
| Entry(String ticket) { | ||
| this.ticket = ticket; | ||
| this.lastAccessTime = Calendar.getInstance().getTimeInMillis(); | ||
| } | ||
| } | ||
|
|
||
| private Map<String, Entry> sessions = new ConcurrentHashMap<>(); | ||
|
|
||
| public static final TicketContainer instance = new TicketContainer(); | ||
|
|
||
| /** | ||
| * For test use | ||
| * @param principal | ||
| * @param ticket | ||
| * @return true if ticket assigned to principal. | ||
| */ | ||
| public boolean isValid(String principal, String ticket) { | ||
| if ("anonymous".equals(principal) && "anonymous".equals(ticket)) | ||
| return true; | ||
| Entry entry = sessions.get(principal); | ||
| return entry != null && entry.ticket.equals(ticket); | ||
| } | ||
|
|
||
| /** | ||
| * get or create ticket for Websocket authentication assigned to authenticated shiro user | ||
| * For unathenticated user (anonymous), always return ticket value "anonymous" | ||
| * @param principal | ||
| * @return | ||
| */ | ||
| public synchronized String getTicket(String principal) { | ||
| Entry entry = sessions.get(principal); | ||
| String ticket; | ||
| if (entry == null) { | ||
| if (principal.equals("anonymous")) | ||
| ticket = "anonymous"; | ||
| else | ||
| ticket = UUID.randomUUID().toString(); | ||
| } else { | ||
| ticket = entry.ticket; | ||
| } | ||
| entry = new Entry(ticket); | ||
| sessions.put(principal, entry); | ||
| return ticket; | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.