{"push_id":1163428941,"size":1,"distinct_size":1,"ref":"refs/heads/master","head":"24922e1036c5e410b676fd9b513d008cb046424e","before":"1c3373937aad403a6146451001d262c7778edbf0","commits":[{"sha":"24922e1036c5e410b676fd9b513d008cb046424e","author":{"name":"Prabhjyot Singh","email":"16939c64a2c467204b8f4217860bc4618e2aeacb@gmail.com"},"message":"[Zeppelin 946] Permissions not honoring group\n\n### What is this PR for?\nError:\nInsufficient privileges to write notebook.\nAllowed users or roles: [admin, zeppelinWrite]\nBut the user randerson belongs to: [randerson]\nIt's seems clear that user randerson isn't mapped to any roles, or groups (even though he of course is a member of the zeppelinWrite group in AD and as a result also part of the local admin Role). A TCPDUMP reveals that during login, all of my group memberships are in fact returned during the ldap bind operation. However, when I attempt to modify a notebook, a call is never made to AD, to pull back my group memberships. It doesn't seem to look at my local group memberships (/etc/group) either.\n\n### What type of PR is it?\n[Bug Fix]\n\n### Todos\n* [x] - fix for permissions not honoring group\n* [x] - read roles from shiro.ini\n* [x] - at times group name was displaying instead of user/principal name.\n* [x] - doc\n\n### What is the Jira issue?\n[ZEPPELIN-946](https://issues.apache.org/jira/browse/ZEPPELIN-946)\n\n### Screenshots/How should this be tested?\nUse one of the following setting for IniRealm, LDAP or AD in shiro.ini\n\n    [main]\n    admin = password1, admin\n    finance1 = finance1, finance\n    finance2 = finance2, finance\n    hr1 = hr1, hr\n    hr2 = hr2, hr\n\n    activeDirectoryRealm = org.apache.zeppelin.server.ActiveDirectoryGroupRealm\n    activeDirectoryRealm.systemUsername = userNameA\n    activeDirectoryRealm.systemPassword = passwordA\n    activeDirectoryRealm.searchBase = CN=Users,DC=SOME_GROUP,DC=COMPANY,DC=COM\n    activeDirectoryRealm.url = ldap://ldap.test.com:389\n    activeDirectoryRealm.groupRolesMap = \"CN=admin,OU=groups,DC=SOME_GROUP,DC=COMPANY,DC=COM\":\"admin\",\"CN=finance,OU=groups,DC=SOME_GROUP,DC=COMPANY,DC=COM\":\"finance\",\"CN=hr,OU=groups,DC=SOME_GROUP,DC=COMPANY,DC=COM\":\"hr\"\n    activeDirectoryRealm.authorizationCachingEnabled = false\n\n    ldapRealm = org.apache.zeppelin.server.LdapGroupRealm\n    # search base for ldap groups (only relevant for LdapGroupRealm):\n    ldapRealm.contextFactory.environment[ldap.searchBase] = dc=COMPANY,dc=COM\n    ldapRealm.contextFactory.url = ldap://ldap.test.com:389\n    ldapRealm.userDnTemplate = uid={0},ou=Users,dc=COMPANY,dc=COM\n    ldapRealm.contextFactory.authenticationMechanism = SIMPLE\n\n    [roles]\n    admin = *\n    hr = *\n    finance = *\n    group1 = *\n\n    [urls]\n    /api/version = anon\n    /** = authc\n\nLogin as user1 (say finance1), and set a permission of a notebook as \"finance\"\n<img width=\"1282\" alt=\"screen shot 2016-06-11 at 9 50 32 am\" src=\"https://cloud.githubusercontent.com/assets/674497/15983178/aad710ee-2fbc-11e6-861d-508ecc8c7b74.png\">\n\nSave setting\n<img width=\"1281\" alt=\"screen shot 2016-06-11 at 9 51 05 am\" src=\"https://cloud.githubusercontent.com/assets/674497/15983180/aad86ea8-2fbc-11e6-8b68-4571496ec733.png\">\n\nNow logout and login as user2 (say finance2) which belong to the same group as above \"finance\", verify that you have access to the same notebook.\n<img width=\"1282\" alt=\"screen shot 2016-06-11 at 9 51 25 am\" src=\"https://cloud.githubusercontent.com/assets/674497/15983181/aad9a78c-2fbc-11e6-8a41-a3dc108cabdc.png\">\n\nLogout and login again, this time as a user that does not belong to the group \"finance\", a user say hr1. Verify that this user does not have permission to view the same notebook.\n<img width=\"1281\" alt=\"screen shot 2016-06-11 at 9 51 42 am\" src=\"https://cloud.githubusercontent.com/assets/674497/15983179/aad7794e-2fbc-11e6-9002-f7b0fc54ac59.png\">\n\n### Questions:\n* Does the licenses files need update? no\n* Is there breaking changes for older versions? no\n* Does this needs documentation? no\n\nAuthor: Prabhjyot Singh <prabhjyotsingh@gmail.com>\n\nCloses #986 from prabhjyotsingh/ZEPPELIN-946 and squashes the following commits:\n\ne04c145 [Prabhjyot Singh] add sample LDAP and AD realm setting in comments\n3e443d7 [Prabhjyot Singh] imporoving performance of ActiveDirectoryGroupRealm\n188ac17 [Prabhjyot Singh] activeDirectoryRealm.principalSuffix isn't honoured\n293853e [Prabhjyot Singh] fix failing selenium test case\n8d41149 [Prabhjyot Singh] try maximize browser\n41bb23b [Prabhjyot Singh] selenium test case\n3149417 [Prabhjyot Singh] Merge remote-tracking branch 'origin/master' into ZEPPELIN-946\n310a81d [Prabhjyot Singh] make `[roles]` optional in shiro.ini\n966a96c [Prabhjyot Singh] update doc\ned54a92 [Prabhjyot Singh] read roles from shiro.ini\ne8f1f97 [Prabhjyot Singh] fix for permissions not honoring group\n4194f93 [Prabhjyot Singh] sometime it dispalys groupName instead of principal","distinct":true,"url":"https://api.github.com/repos/apache/zeppelin/commits/24922e1036c5e410b676fd9b513d008cb046424e"}]}
{"actor":{"display_login":"asfgit"}}