To connect to Zeppelin, users will be asked to enter their credentials. Once logged, a user has access to all notes including other users notes. This a a first step toward full security as implemented by this pull request (apache#53).
Please check Shiro authentication in Apache Zeppelin in our official website for more detailed information(e.g. How to setup the security, How to configure user groups and permissions, and etc).
username, owner and principal are used interchangeably to designate the currently authenticated user
Zeppelin is basically a web application that spawn remote interpreters to run commands and return HTML fragments to be displayed on the user browser. The scope of this PR is to require credentials to access Zeppelin. To achieve this, we use Apache Shiro.
Apache Shiro sits as a servlet filter between the browser and the exposed services and handles the required authentication without any programming required. (See Apache Shiro for more info).
Securing the HTTP endpoints is not enough, since Zeppelin also communicates with the browser through websockets. To secure this channel, we take the following approach:
- The browser on startup requests a ticket through HTTP
- The Apache Shiro Servlet filter handles the user auth
- Once the user is authenticated, a ticket is assigned to this user and the ticket is returned to the browser
All websockets communications require the username and ticket to be submitted by the browser. Upon receiving a websocket message, the server checks that the ticket received is the one assigned to the username through the HTTP request (step 3 above).