ZEPPELIN-3526: Zeppelin auth mechanisms (LDAP or password based) should be mutually exclusive

prabhjyotsingh · prabhjyotsingh · commit 529ab3e0e429 · 2018-06-05T12:01:25.000+05:30
Change-Id: I9e0602c41462997c14a2dbb7378489ffab3ca0b4
diff --git a/zeppelin-server/src/main/java/org/apache/zeppelin/server/ZeppelinServer.java b/zeppelin-server/src/main/java/org/apache/zeppelin/server/ZeppelinServer.java
@@ -16,8 +16,12 @@
  */
 package org.apache.zeppelin.server;
 
+import java.util.Collection;
 import org.apache.commons.lang.StringUtils;
+import org.apache.shiro.realm.Realm;
+import org.apache.shiro.realm.text.IniRealm;
 import org.apache.shiro.web.env.EnvironmentLoaderListener;
+import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
 import org.apache.shiro.web.servlet.ShiroFilter;
 import org.eclipse.jetty.http.HttpVersion;
 import org.eclipse.jetty.server.HttpConfiguration;
@@ -98,6 +102,21 @@ public class ZeppelinServer extends Application {
 
   public ZeppelinServer() throws Exception {
     ZeppelinConfiguration conf = ZeppelinConfiguration.create();
+    Collection<Realm> realms = ((DefaultWebSecurityManager) org.apache.shiro.SecurityUtils
+        .getSecurityManager()).getRealms();
+    if (realms.size() > 1) {
+      Boolean isIniRealmEnabled = false;
+      for (Object realm : realms) {
+        if (realm instanceof IniRealm && ((IniRealm) realm).getIni().get("users") != null) {
+          isIniRealmEnabled = true;
+          break;
+        }
+      }
+      if (isIniRealmEnabled) {
+        throw new Exception("IniRealm/password based auth mechanisms should be exclusive. "
+            + "Consider removing [users] block from shiro.ini");
+      }
+    }
 
     InterpreterOutput.limit = conf.getInt(ConfVars.ZEPPELIN_INTERPRETER_OUTPUT_LIMIT);
 
