question Zeppelin + shiro authorization in Archives of Support Questions (Read Only)

Zeppelin + shiro authorization

frank93 — Wed, 07 Sep 2016 17:55:23 GMT

Hi,

I am using Zeppelin 0.6.0 with HDP 2.3.4. I have configure LDAP sync. I would like to revoke access to "Interpreter" section to all users except "admin". I tried to configure it by [urls] section in shiro.ini. Something like

[urls]

/api/login = anon

/api/notebook = authc

/api/interpreter = roles[admin]

but it does not work. Could somebody explain me how it works, or is there anyother solution to this?

Re: Zeppelin + shiro authorization

prabhjyot_singh — Wed, 07 Sep 2016 18:16:44 GMT

Here is the setting that I use on my cluster, that works for me.

/api/version = anon
/api/interpreter/** = authc, roles[admin]
/api/configurations/** = authc, roles[admin]
/api/credential/** = authc, roles[admin]
/** = authc

Re: Zeppelin + shiro authorization

frank93 — Wed, 07 Sep 2016 18:20:10 GMT

Thank you, could you please also share your [roles] section?

In the value roles[admin] the "admin" is a name of role or permission?

Re: Zeppelin + shiro authorization

prabhjyot_singh — Thu, 08 Sep 2016 12:17:27 GMT

it can be any, username or role, and inside of "[]" it accepts CSV. So, you can typically give

/api/interpreter/** = authc, roles[adminUser, adminRole, managerRole]

etc.