question Re: How to restrict specific ActiveDirectory users to access zeppelin in Archives of Support Questions (Read Only)

How to restrict specific ActiveDirectory users to access zeppelin

haaris292 — Wed, 26 Apr 2017 20:28:59 GMT

Hi,

I am trying to restrict a specific group of ActiveDirectory users to access zeppelin.

My shiro looks something like below, can you please suggest where i have to add the group name or make the changes so that the group of users are not able to login to zeppelin.

[users]
# List of users with their password allowed to access Zeppelin.
# To use a different strategy (LDAP / Database / ...) check the shiro doc at http://shiro.apache.org/configuration.html#Configuration-INISections
#admin = password1
#user1 = password2, role1, role2
#user2 = password3, role3
#user3 = password4, role2
# Sample LDAP configuration, for user Authentication, currently tested for single Realm
[main]
activeDirectoryRealm = org.apache.zeppelin.server.ActiveDirectoryGroupRealm
activeDirectoryRealm.systemUsername = cn=ldap-reader,ou=ServiceUsers,dc=lab,dc=hortonworks,dc=net
activeDirectoryRealm.systemPassword = badPassword
#activeDirectoryRealm.hadoopSecurityCredentialPath = jceks://user/zeppelin/conf/zeppelin.jceks
activeDirectoryRealm.searchBase = dc=lab,dc=hortonworks,dc=net
activeDirectoryRealm.url = ldap://ad.example.net:389
activeDirectoryRealm.groupRolesMap = "cn=ldap-admin,ou=ServiceUsers,dc=lab,dc=hortonworks,dc=net":"admin"
activeDirectoryRealm.authorizationCachingEnabled =false
sessionManager = org.apache.shiro.web.session.mgt.DefaultWebSessionManager
securityManager.sessionManager = $sessionManager
securityManager.realms = $activeDirectoryRealm
# 86,400,000 milliseconds = 24 hour
securityManager.sessionManager.globalSessionTimeout =86400000
shiro.loginUrl =/api/login
[urls]
# anon means the access is anonymous.
# authcBasic means Basic Auth Security
# To enfore security, comment the line below and uncomment the next one
/api/version = anon
#/** = anon
/api/interpreter/** = authc, roles[admin]
/api/configurations/** = authc, roles[admin]
/api/credential/** = authc, roles[admin]
/** = authc

Please suggest,

Thanks

Re: How to restrict specific ActiveDirectory users to access zeppelin

VR46 — Thu, 27 Apr 2017 01:46:57 GMT

Hello @Haaris Khan,

The following applied to HDP 2.5.3.0 and above. You can restrict AD groups to access different components of Zeppelin (interpreter, configurations, credentials) like this:

1. Add all your AD groups against some role(s). To do this, you have the following in the [main] section:

activeDirectoryRealm.groupRolesMap = "cn=hr,ou=CorpUsers,dc=lab,dc=hortonworks,dc=net":"endusers","cn=legal,ou=CorpUsers,dc=lab,dc=hortonworks,dc=net":"admin","cn=sales,ou=CorpUsers,dc=lab,dc=hortonworks,dc=net":"readonly"

Note: You can create roles with any name that you like.

2. Next, define the access for these roles in the [urls] section:

[urls]
/api/version = anon
/api/interpreter/** = authc, roles[endusers,readonly]
/api/configurations/** = authc, roles[readonly]
/api/credential/** = authc, roles[admin]
/** = authc
#/** = anon

With these two, your LDAP group should be authorized to access the only the specific URLs.

Hope this helps.

Re: How to restrict specific ActiveDirectory users to access zeppelin

rguruvannagari — Sun, 28 May 2017 15:36:43 GMT

@Haaris Khan

In Zeppelin 0.7, HDP2.6 we have new LdapRealm, that allows to specify search filter. With the search filter we can restrict login based on groups. Below is one such example I tested in my lab. Please note that this works only in HDP2.6 or zeppelin 0.7 and above.

In HDP2.5 this was not possible because active directory realm was based on UserPrincipalName attribute and there was no way to filter the users based on groups so login cannot be restricted, but with Authorization(as mentioned by @Vipin Rathor you can restrict the users accessing specific urls based on group role map)

[main]
ldapADGCRealm = org.apache.zeppelin.realm.LdapRealm 
ldapADGCRealm.contextFactory.systemUsername = hadoopadmin@lab.hortonworks.net
ldapADGCRealm.contextFactory.systemPassword = <Password>
ldapADGCRealm.searchBase = "dc=lab,dc=hortonworks,dc=net" 
ldapADGCRealm.userSearchBase = "dc=lab,dc=hortonworks,dc=net"
ldapADGCRealm.userSearchFilter=(&(objectclass=user)(sAMAccountName={0})(|(memberOf=CN=hr,OU=CorpUsers,DC=lab,DC=hortonworks,DC=net)(memberOf=CN=hadoop-admins,OU=CorpUsers,DC=lab,DC=hortonworks,DC=net)(memberOf=CN=sales,OU=CorpUsers,DC=lab,DC=hortonworks,DC=net)))
ldapADGCRealm.contextFactory.url = ldap://LdapServer:389 
#ldapADGCRealm.userSearchAttributeName = sAMAccountName 
ldapADGCRealm.contextFactory.authenticationMechanism = simple 
#ldapADGCRealm.userObjectClass = user 
ldapADGCRealm.groupObjectClass = group 
ldapADGCRealm.memberAttribute = member 
sessionManager = org.apache.shiro.web.session.mgt.DefaultWebSessionManager
securityManager.sessionManager = $sessionManager
securityManager.sessionManager.globalSessionTimeout = 86400000
shiro.loginUrl = /api/login

Re: How to restrict specific ActiveDirectory users to access zeppelin

VR46 — Sun, 28 May 2017 18:52:05 GMT

Thanks @rguruvannagari for the mention. That pushed me to write my pending article. I cover the new LDAP/AD options available in Apache Zeppelin 0.7.0 / HDP 2.6 in this article. Please check.

Re: How to restrict specific ActiveDirectory users to access zeppelin

haaris292 — Mon, 19 Jun 2017 14:43:03 GMT

Thanks @rguruvannagari, your suggestion works perfectly fine for me in HDP2.6 - zeppelin 0.7