Skip to content

Commit b080d7d

Browse files
ramaswamydevarajanramaswamydevarajan
committed
Merge pull request #1 from apache/master
Merge
2 parents db8b016 + 3d4dc43 commit b080d7d

File tree

70 files changed

+818
-244
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

70 files changed

+818
-244
lines changed

‎CONTRIBUTING.md‎

Lines changed: 11 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -68,7 +68,8 @@ Here are some things you will need to build and test Zeppelin.
6868

6969
### Software Configuration Management (SCM)
7070

71-
Zeppelin uses Git for its SCM system. Hosted by github.com. `https://github.com/apache/incubator-zeppelin` you'll need git client installed in your development machine.
71+
Zeppelin uses Git for its SCM system. `http://git.apache.org/incubator-zeppelin.git` you'll need git client installed in your development machine.
72+
For write access, `https://git-wip-us.apache.org/repos/asf/incubator-zeppelin.git`
7273

7374
### Integrated Development Environment (IDE)
7475

@@ -114,26 +115,31 @@ To build the code, install
114115
* Apache Maven
115116

116117
## Getting the source code
117-
First of all, you need the Zeppelin source code. The official location for Zeppelin is [https://github.com/apache/incubator-zeppelin](https://github.com/apache/incubator-zeppelin)
118+
First of all, you need the Zeppelin source code. The official location for Zeppelin is [http://git.apache.org/incubator-zeppelin.git](http://git.apache.org/incubator-zeppelin.git).
118119

119120
### git access
120121

121122
Get the source code on your development machine using git.
122123

123124
```
124-
git clone git@github.com:apache/incubator-zeppelin.git zeppelin
125+
git clone http://git.apache.org/incubator-zeppelin.git zeppelin
125126
```
126127

127128
You may also want to develop against a specific release. For example, for branch-0.1
128129

129130
```
130-
git clone -b branch-0.1 git@github.com:apache/incubator-zeppelin.git zeppelin
131+
git clone -b branch-0.1 http://git.apache.org/incubator-zeppelin.git zeppelin
131132
```
132133

134+
or with write access
135+
136+
```
137+
git clone https://git-wip-us.apache.org/repos/asf/incubator-zeppelin.git
138+
```
133139

134140
### Fork repository
135141

136-
If you want not only build Zeppelin but also make change, then you need fork Zeppelin repository and make pull request.
142+
If you want not only build Zeppelin but also make change, then you need fork Zeppelin github mirror repository (https://github.com/apache/incubator-zeppelin) and make pull request.
137143

138144

139145
## Build

‎SECURITY-README.md‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
<!--
2+
Licensed under the Apache License, Version 2.0 (the "License");
3+
you may not use this file except in compliance with the License.
4+
You may obtain a copy of the License at
5+
6+
http://www.apache.org/licenses/LICENSE-2.0
7+
8+
Unless required by applicable law or agreed to in writing, software
9+
distributed under the License is distributed on an "AS IS" BASIS,
10+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
11+
See the License for the specific language governing permissions and
12+
limitations under the License.
13+
-->
14+
15+
# Shiro Authentication
16+
To connect to Zeppelin, users will be asked to enter their credentials. Once logged, a user has access to all notes including other users notes.
17+
This a a first step toward full security as implemented by this pull request (https://github.com/apache/incubator-zeppelin/pull/53).
18+
19+
# Security setup
20+
1. Secure the HTTP channel: Comment the line "/** = anon" and uncomment the line "/** = authcBasic" in the file conf/shiro.ini. Read more about he shiro.ini file format at the following URL http://shiro.apache.org/configuration.html#Configuration-INISections.
21+
2. Secure the Websocket channel : Set to property "zeppelin.anonymous.allowed" to "false" in the file conf/zeppelin-site.xml. You can start by renaming conf/zeppelin-site.xml.template to conf/zeppelin-site.xml
22+
3. Start Zeppelin : bin/zeppelin.sh
23+
4. point your browser to http://localhost:8080
24+
5. Login using one of the user/password combinations defined in the conf/shiro.ini file.
25+
26+
# Implementation notes
27+
## Vocabulary
28+
username, owner and principal are used interchangeably to designate the currently authenticated user
29+
## What are we securing ?
30+
Zeppelin is basically a web application that spawn remote interpreters to run commands and return HTML fragments to be displayed on the user browser.
31+
The scope of this PR is to require credentials to access Zeppelin. To achieve this, we use Apache Shiro.
32+
## HTTP Endpoint security
33+
Apache Shiro sits as a servlet filter between the browser and the exposed services and handles the required authentication without any programming required. (See Apache Shiro for more info).
34+
## Websocket security
35+
Securing the HTTP endpoints is not enough, since Zeppelin also communicates with the browser through websockets. To secure this channel, we take the following approach:
36+
1. The browser on startup requests a ticket through HTTP
37+
2. The Apache Shiro Servlet filter handles the user auth
38+
3. Once the user is authenticated, a ticket is assigned to this user and the ticket is returned to the browser
39+
40+
All websockets communications require the username and ticket to be submitted by the browser. Upon receiving a websocket message, the server checks that the ticket received is the one assigned to the username through the HTTP request (step 3 above).
41+
42+
43+

‎conf/shiro.ini‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
#
2+
# Licensed to the Apache Software Foundation (ASF) under one or more
3+
# contributor license agreements. See the NOTICE file distributed with
4+
# this work for additional information regarding copyright ownership.
5+
# The ASF licenses this file to You under the Apache License, Version 2.0
6+
# (the "License"); you may not use this file except in compliance with
7+
# the License. You may obtain a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS,
13+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
# See the License for the specific language governing permissions and
15+
# limitations under the License.
16+
#
17+
18+
[users]
19+
# List of users with their password allowed to access Zeppelin.
20+
# To use a different strategy (LDAP / Database / ...) check the shiro doc at http://shiro.apache.org/configuration.html#Configuration-INISections
21+
admin = password1
22+
user1 = password2
23+
user2 = password3
24+
25+
26+
[urls]
27+
28+
# anon means the access is anonymous.
29+
# authcBasic means Basic Auth Security
30+
# To enfore security, comment the line below and uncomment the next one
31+
/** = anon
32+
#/** = authcBasic
33+

‎conf/zeppelin-site.xml.template‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -180,5 +180,11 @@
180180
<description>Allowed sources for REST and WebSocket requests (i.e. http://onehost:8080,http://otherhost.com). If you leave * you are vulnerable to https://issues.apache.org/jira/browse/ZEPPELIN-173</description>
181181
</property>
182182

183+
<property>
184+
<name>zeppelin.anonymous.allowed</name>
185+
<value>true</value>
186+
<description>Anonymous user allowed by default</description>
187+
</property>
188+
183189
</configuration>
184190

‎dev/create_release.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -125,7 +125,7 @@ function make_binary_release() {
125125
rm -rf ${WORKING_DIR}/zeppelin-${RELEASE_NAME}-bin-${BIN_RELEASE_NAME}
126126
}
127127

128-
make_binary_release all "-Pspark-1.5 -Phadoop-2.4 -Pyarn -Ppyspark"
128+
make_binary_release all "-Pspark-1.6 -Phadoop-2.4 -Pyarn -Ppyspark"
129129

130130
# remove non release files and dirs
131131
rm -rf ${WORKING_DIR}/zeppelin

‎docs/index.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -117,7 +117,7 @@ This way, you can easily embed it as an iframe inside of your website.</p>
117117
<br />
118118
### 100% Opensource
119119

120-
Apache Zeppelin (incubating) is Apache2 Licensed software. Please check out the [source repository](https://github.com/apache/incubator-zeppelin) and [How to contribute](./development/howtocontribute.html)
120+
Apache Zeppelin (incubating) is Apache2 Licensed software. Please check out the [source repository](http://git.apache.org/incubator-zeppelin.git) and [How to contribute](./development/howtocontribute.html)
121121

122122
Zeppelin has a very active development community.
123123
Join the [Mailing list](./community.html) and report issues on our [Issue tracker](https://issues.apache.org/jira/browse/ZEPPELIN).

‎ignite/src/main/java/org/apache/zeppelin/ignite/IgniteInterpreter.java‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -211,6 +211,7 @@ private Ignite getIgnite() {
211211

212212
initEx = null;
213213
} catch (Exception e) {
214+
logger.error("Error in IgniteInterpreter while getIgnite: " , e);
214215
initEx = e;
215216
}
216217
}

‎ignite/src/main/java/org/apache/zeppelin/ignite/IgniteSqlInterpreter.java‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -154,6 +154,7 @@ public InterpreterResult interpret(String st, InterpreterContext context) {
154154
}
155155
}
156156
} catch (Exception e) {
157+
logger.error("Exception in IgniteSqlInterpreter while InterpreterResult interpret: ", e);
157158
return IgniteInterpreterUtils.buildErrorResult(e);
158159
} finally {
159160
curStmt = null;
@@ -169,6 +170,7 @@ public void cancel(InterpreterContext context) {
169170
curStmt.cancel();
170171
} catch (SQLException e) {
171172
// No-op.
173+
logger.info("No-op while cancel in IgniteSqlInterpreter", e);
172174
} finally {
173175
curStmt = null;
174176
}

‎lens/src/main/java/org/apache/zeppelin/lens/LensInterpreter.java‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -128,7 +128,7 @@ public LensInterpreter(Properties property) {
128128
s_logger.info("LensInterpreter created");
129129
}
130130
catch (Exception e) {
131-
e.printStackTrace();
131+
s_logger.error(e.toString(), e);
132132
s_logger.error("unable to create lens interpreter", e);
133133
}
134134
}
@@ -375,6 +375,7 @@ public void cancel(InterpreterContext context) {
375375
closeShell(s_paraToQH.get(context.getParagraphId()).getShell());
376376
} catch (Exception e) {
377377
// ignore
378+
s_logger.info("Exception in LensInterpreter while cancel finally, ignore", e);
378379
}
379380
s_paraToQH.remove(context.getParagraphId());
380381
closeShell(shell);

‎lens/src/main/java/org/apache/zeppelin/lens/LensJLineShellComponent.java‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,9 @@
1717

1818
import java.util.Map;
1919

20+
import org.slf4j.Logger;
21+
import org.slf4j.LoggerFactory;
22+
2023
import org.springframework.beans.BeansException;
2124
import org.springframework.beans.factory.BeanFactoryUtils;
2225
import org.springframework.beans.factory.InitializingBean;
@@ -56,6 +59,8 @@ public class LensJLineShellComponent extends JLineShell
5659
private ExecutionStrategy executionStrategy = new LensSimpleExecutionStrategy();
5760
private SimpleParser parser = new SimpleParser();
5861

62+
private static final Logger LOGGER = LoggerFactory.getLogger(LensJLineShellComponent.class);
63+
5964
public SimpleParser getSimpleParser() {
6065
return parser;
6166
}
@@ -123,7 +128,7 @@ public void waitForComplete() {
123128
try {
124129
shellThread.join();
125130
} catch (InterruptedException e) {
126-
e.printStackTrace();
131+
LOGGER.error(e.toString(), e);
127132
}
128133
}
129134

0 commit comments

Comments
 (0)