diff --git a/hadoop/CDH/defaults/main.yml b/hadoop/CDH/defaults/main.yml index 47b09700..2be08887 100644 --- a/hadoop/CDH/defaults/main.yml +++ b/hadoop/CDH/defaults/main.yml @@ -45,7 +45,37 @@ cdh_zeppelin_work_dirs: - '{{ cdh_zeppelin_home }}/log' - '{{ cdh_zeppelin_home }}/run' - '{{ cdh_zeppelin_home }}/base_tmp/tmp' -cdh_zeppelin_ldap_auth: True -cdh_zeppelin_dedicated_node: False -cdh_impala_load_balancer: False \ No newline at end of file +cdh_zeppelin_conf_files: + - zeppelin-env.sh + - shiro.ini + - zeppelin-site.xml +cdh_zeppelin_ldap_auth: True +cdh_zeppelin_notebook_public: 'false' +cdh_zeppelin_dedicated_node: False + +cdh_impala_load_balancer: False + +cdh_zeppelin_ldap_enabled: False +cdh_zeppelin_ldap_advanced_config: True +cdh_zeppelin_ldap_starttls: 'true' +cdh_zeppelin_search_bind_authentication: 'false' +cdh_zeppelin_username_pattern: "uid={0},ou=People,dc=mycompany,dc=com" +cdh_zeppelin_ldap_search_base: "dc=mycompany,dc=com" +cdh_zeppelin_ldap_users_base: "ou=People,dc=mycompany,dc=com" +cdh_zeppelin_user_objectclass: posixUser +cdh_zeppelin_ldap_group_base: "ou=Groups,dc=mycompany,dc=com" +cdh_zeppelin_ldap_group_obj_class: groupofnames +cdh_zeppelin_group_template: "cn={0},ou=Groups,dc=mycompany,dc=com" +cdh_zeppelin_group_search_filter: '(memberUid={0})' +cdh_zeppelin_ldap_nested_groups: 'false' +cdh_zeppelin_ldap_roles_by_group: 'cdh_hadoop: userrole, cdh_admin: adminrole' +cdh_zeppelin_ldap_bind_u: zeppelin +#cdh_zeppelin_ldap_bind_pwd: "use a vault file" + +cdh_zeppelin_ldap_user_attr: uid +cdh_zeppelin_ldap_member_attr: member +cdh_zeppelin_ldap_group: zeppelin_hadoop +cdh_zeppelin_ldap_url: 'ldap://ldap.test.com:389' +cdh_zeppelin_secure_urls: True +cdh_zeppelin_secure_roles: 'authc, roles[adminrole]' diff --git a/hadoop/CDH/tasks/zeppelin.yml b/hadoop/CDH/tasks/zeppelin.yml index fe40c43f..14e81a4e 100644 --- a/hadoop/CDH/tasks/zeppelin.yml +++ b/hadoop/CDH/tasks/zeppelin.yml @@ -21,9 +21,11 @@ - name: zeppelin wants to write into the conf directory file: dest={{ cdh_zeppelin_home }}/{{ cdh_zeppelin_dir }}/conf owner={{ cdh_zeppelin_user }} group={{ cdh_zeppelin_group }} - - name: Install the zeppelin env file - template: src=zeppelin-env.sh dest={{ cdh_zeppelin_home }}/{{ cdh_zeppelin_dir }}/conf/zeppelin-env.sh owner=root group=root mode=0444 + - name: Install the zeppelin configuration files + template: src={{ item }} dest={{ cdh_zeppelin_home }}/{{ cdh_zeppelin_dir }}/conf/{{ item }} owner=root group={{ cdh_zeppelin_group }} mode=0440 + with_items: '{{ cdh_zeppelin_conf_files }}' notify: Restart zeppelin + tags: [ 'cdh', 'zeppelin', 'zeppelin_conf' ] - name: Install the zeppelin upstart startup script template: src=zeppelin_upstart.conf dest=/etc/init/zeppelin.conf diff --git a/hadoop/CDH/templates/shiro.ini b/hadoop/CDH/templates/shiro.ini index 0a3187a6..f8705327 100644 --- a/hadoop/CDH/templates/shiro.ini +++ b/hadoop/CDH/templates/shiro.ini @@ -18,32 +18,53 @@ [users] # List of users with their password allowed to access Zeppelin. # To use a different strategy (LDAP / Database / ...) check the shiro doc at http://shiro.apache.org/configuration.html#Configuration-INISections -admin = password1, admin -user1 = password2, role1, role2 -user2 = password3, role3 -user3 = password4, role2 - +{% if not cdh_zeppelin_ldap_enabled %} +admin = {{ cdh_zeppelin_admin_password | default('admin') }}, admin +{% endif %} # Sample LDAP configuration, for user Authentication, currently tested for single Realm [main] -### A sample for configuring Active Directory Realm -#activeDirectoryRealm = org.apache.zeppelin.realm.ActiveDirectoryGroupRealm -#activeDirectoryRealm.systemUsername = userNameA - -#use either systemPassword or hadoopSecurityCredentialPath, more details in http://zeppelin.apache.org/docs/latest/security/shiroauthentication.html -#activeDirectoryRealm.systemPassword = passwordA -#activeDirectoryRealm.hadoopSecurityCredentialPath = jceks://file/user/zeppelin/zeppelin.jceks -#activeDirectoryRealm.searchBase = CN=Users,DC=SOME_GROUP,DC=COMPANY,DC=COM -#activeDirectoryRealm.url = ldap://ldap.test.com:389 -#activeDirectoryRealm.groupRolesMap = "CN=admin,OU=groups,DC=SOME_GROUP,DC=COMPANY,DC=COM":"admin","CN=finance,OU=groups,DC=SOME_GROUP,DC=COMPANY,DC=COM":"finance","CN=hr,OU=groups,DC=SOME_GROUP,DC=COMPANY,DC=COM":"hr" -#activeDirectoryRealm.authorizationCachingEnabled = false - +{% if cdh_zeppelin_ldap_enabled %} +{% if cdh_zeppelin_ldap_advanced_config %} +ldapRealm = org.apache.zeppelin.realm.LdapRealm +ldapRealm.contextFactory.url = {{ cdh_zeppelin_ldap_url }} +ldapRealm.contextFactory.authenticationMechanism=simple +ldapRealm.contextFactory.systemUsername = {{ cdh_zeppelin_ldap_bind_u }} +ldapRealm.contextFactory.systemPassword = {{ cdh_zeppelin_ldap_bind_pwd }} +ldapRealm.authorizationEnabled = true +#ldapRealm.userDnTemplate = {{ cdh_zeppelin_username_pattern }} +# Ability to set ldap paging Size if needed default is 100 +#ldapRealm.pagingSize = 200 +#ldapRealm.searchBase = {{ cdh_zeppelin_ldap_search_base }} +ldapRealm.userSearchBase = {{ cdh_zeppelin_ldap_users_base }} +ldapRealm.userObjectClass = {{ cdh_zeppelin_user_objectclass }} +ldapRealm.groupSearchBase = {{ cdh_zeppelin_ldap_group_base }} +ldapRealm.groupObjectClass = {{ cdh_zeppelin_ldap_group_obj_class }} +ldapRealm.groupSearchFilter = '{{ cdh_zeppelin_group_search_filter }}' +# Allow userSearchAttribute to be customized +ldapRealm.userSearchAttributeName = {{ cdh_zeppelin_ldap_user_attr }} +ldapRealm.memberAttribute = {{ cdh_zeppelin_ldap_member_attr }} +# force usernames returned from ldap to lowercase useful for AD +#ldapRealm.userLowerCase = true +#ldapRealm.memberAttributeValueTemplate = {{cdh_zeppelin_group_template}} +# enable support for nested groups using the LDAPMATCHINGRULEINCHAIN operator +#ldapRealm.groupSearchEnableMatchingRuleInChain = {{ cdh_zeppelin_ldap_nested_groups }} +# optional mapping from physical groups to logical application roles +ldapRealm.rolesByGroup = {{ cdh_zeppelin_ldap_roles_by_group }} +# optional list of roles that are allowed to authenticate. In case not present all groups are allowed to authenticate (login). +# This changes nothing for url specific permissions that will continue to work as specified in [urls]. +#ldapRealm.allowedRolesForAuthentication = adminrole,userrole +#ldapRealm.permissionsByRole = userrole = *:ToDoItem::*, adminrole = * +{% else %} ### A sample for configuring LDAP Directory Realm -#ldapRealm = org.apache.zeppelin.realm.LdapGroupRealm +ldapRealm = org.apache.zeppelin.realm.LdapGroupRealm ## search base for ldap groups (only relevant for LdapGroupRealm): -#ldapRealm.contextFactory.environment[ldap.searchBase] = dc=COMPANY,dc=COM -#ldapRealm.contextFactory.url = ldap://ldap.test.com:389 -#ldapRealm.userDnTemplate = uid={0},ou=Users,dc=COMPANY,dc=COM -#ldapRealm.contextFactory.authenticationMechanism = simple +ldapRealm.contextFactory.environment[ldap.searchBase] = {{ cdh_zeppelin_ldap_search_base }} +ldapRealm.contextFactory.url = {{ cdh_zeppelin_ldap_url }} +ldapRealm.userDnTemplate = {{ cdh_zeppelin_username_pattern }} +ldapRealm.contextFactory.authenticationMechanism = simple +{% endif %} +securityManager.realms = $ldapRealm +{% endif %} ### A sample PAM configuration #pamRealm=org.apache.zeppelin.realm.PamRealm @@ -61,16 +82,22 @@ sessionManager = org.apache.shiro.web.session.mgt.DefaultWebSessionManager #cacheManager = org.apache.shiro.cache.MemoryConstrainedCacheManager #securityManager.cacheManager = $cacheManager +### Enables 'HttpOnly' flag in Zeppelin cookies +cookie = org.apache.shiro.web.servlet.SimpleCookie +cookie.name = JSESSIONID +cookie.httpOnly = true +### Uncomment the below line only when Zeppelin is running over HTTPS +cookie.secure = true +sessionManager.sessionIdCookie = $cookie + securityManager.sessionManager = $sessionManager # 86,400,000 milliseconds = 24 hour securityManager.sessionManager.globalSessionTimeout = 86400000 shiro.loginUrl = /api/login [roles] -role1 = * -role2 = * -role3 = * admin = * +user = * [urls] # This section is used for url-based security. @@ -79,8 +106,17 @@ admin = * # authc means Form based Auth Security # To enfore security, comment the line below and uncomment the next one /api/version = anon -#/api/interpreter/** = authc, roles[admin] -#/api/configurations/** = authc, roles[admin] -#/api/credential/** = authc, roles[admin] -#/** = anon +{% if not cdh_zeppelin_secure_urls %} +/** = anon +{% else %} +{% if cdh_zeppelin_ldap_advanced_config %} +/api/interpreter/setting/restart/** = authc +/api/interpreter/** = {{ cdh_zeppelin_secure_roles }} +/api/configurations/** = {{ cdh_zeppelin_secure_roles }} +/api/credential/** = {{ cdh_zeppelin_secure_roles }} /** = authc +{% else %} +/** = authc +{% endif %} +{% endif %} + diff --git a/hadoop/CDH/templates/zeppelin-site.xml b/hadoop/CDH/templates/zeppelin-site.xml new file mode 100644 index 00000000..aaf5f0e0 --- /dev/null +++ b/hadoop/CDH/templates/zeppelin-site.xml @@ -0,0 +1,360 @@ + + + + + + + + zeppelin.server.addr + 0.0.0.0 + Server address + + + + zeppelin.server.port + 8080 + Server port. + + + + zeppelin.server.ssl.port + 8443 + Server ssl port. (used when ssl property is set to true) + + + + zeppelin.server.context.path + / + Context Path of the Web Application + + + + zeppelin.war.tempdir + webapps + Location of jetty temporary directory + + + + zeppelin.notebook.dir + notebook + path or URI for notebook persist + + + + zeppelin.notebook.homescreen + + id of notebook to be displayed in homescreen. ex) 2A94M5J1Z Empty value displays default home screen + + + + zeppelin.notebook.homescreen.hide + false + hide homescreen notebook from list when this value set to true + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + zeppelin.notebook.storage + org.apache.zeppelin.notebook.repo.GitNotebookRepo + versioned notebook persistence layer implementation + + + + zeppelin.notebook.one.way.sync + false + If there are multiple notebook storages, should we treat the first one as the only source of truth? + + + + zeppelin.interpreter.dir + interpreter + Interpreter implementation base directory + + + + zeppelin.interpreter.localRepo + local-repo + Local repository for interpreter's additional dependency loading + + + + zeppelin.interpreter.dep.mvnRepo + http://repo1.maven.org/maven2/ + Remote principal repository for interpreter's additional dependency loading + + + + zeppelin.dep.localrepo + local-repo + Local repository for dependency loader + + + + zeppelin.helium.npm.registry + http://registry.npmjs.org/ + Remote Npm registry for Helium dependency loader + + + + zeppelin.interpreters + org.apache.zeppelin.spark.SparkInterpreter,org.apache.zeppelin.spark.PySparkInterpreter,org.apache.zeppelin.rinterpreter.RRepl,org.apache.zeppelin.rinterpreter.KnitR,org.apache.zeppelin.spark.SparkRInterpreter,org.apache.zeppelin.spark.SparkSqlInterpreter,org.apache.zeppelin.spark.DepInterpreter,org.apache.zeppelin.markdown.Markdown,org.apache.zeppelin.angular.AngularInterpreter,org.apache.zeppelin.shell.ShellInterpreter,org.apache.zeppelin.file.HDFSFileInterpreter,org.apache.zeppelin.flink.FlinkInterpreter,,org.apache.zeppelin.python.PythonInterpreter,org.apache.zeppelin.python.PythonInterpreterPandasSql,org.apache.zeppelin.python.PythonCondaInterpreter,org.apache.zeppelin.python.PythonDockerInterpreter,org.apache.zeppelin.lens.LensInterpreter,org.apache.zeppelin.ignite.IgniteInterpreter,org.apache.zeppelin.ignite.IgniteSqlInterpreter,org.apache.zeppelin.cassandra.CassandraInterpreter,org.apache.zeppelin.geode.GeodeOqlInterpreter,org.apache.zeppelin.postgresql.PostgreSqlInterpreter,org.apache.zeppelin.jdbc.JDBCInterpreter,org.apache.zeppelin.kylin.KylinInterpreter,org.apache.zeppelin.elasticsearch.ElasticsearchInterpreter,org.apache.zeppelin.scalding.ScaldingInterpreter,org.apache.zeppelin.alluxio.AlluxioInterpreter,org.apache.zeppelin.hbase.HbaseInterpreter,org.apache.zeppelin.livy.LivySparkInterpreter,org.apache.zeppelin.livy.LivyPySparkInterpreter,org.apache.zeppelin.livy.LivyPySpark3Interpreter,org.apache.zeppelin.livy.LivySparkRInterpreter,org.apache.zeppelin.livy.LivySparkSQLInterpreter,org.apache.zeppelin.bigquery.BigQueryInterpreter,org.apache.zeppelin.beam.BeamInterpreter,org.apache.zeppelin.pig.PigInterpreter,org.apache.zeppelin.pig.PigQueryInterpreter,org.apache.zeppelin.scio.ScioInterpreter + Comma separated interpreter configurations. First interpreter become a default + + + + zeppelin.interpreter.group.order + spark,md,angular,sh,livy,alluxio,file,psql,flink,python,ignite,lens,cassandra,geode,kylin,elasticsearch,scalding,jdbc,hbase,bigquery,beam + + + + + zeppelin.interpreter.connect.timeout + 30000 + Interpreter process connect timeout in msec. + + + + zeppelin.interpreter.output.limit + 102400 + Output message from interpreter exceeding the limit will be truncated + + + + zeppelin.ssl + false + Should SSL be used by the servers? + + + + zeppelin.ssl.client.auth + false + Should client authentication be used for SSL connections? + + + + zeppelin.ssl.keystore.path + keystore + Path to keystore relative to Zeppelin configuration directory + + + + zeppelin.ssl.keystore.type + JKS + The format of the given keystore (e.g. JKS or PKCS12) + + + + zeppelin.ssl.keystore.password + change me + Keystore password. Can be obfuscated by the Jetty Password tool + + + + + + zeppelin.ssl.truststore.path + truststore + Path to truststore relative to Zeppelin configuration directory. Defaults to the keystore path + + + + zeppelin.ssl.truststore.type + JKS + The format of the given truststore (e.g. JKS or PKCS12). Defaults to the same type as the keystore type + + + + + + zeppelin.server.allowed.origins + * + Allowed sources for REST and WebSocket requests (i.e. http://onehost:8080,http://otherhost.com). If you leave * you are vulnerable to https://issues.apache.org/jira/browse/ZEPPELIN-173 + + + + zeppelin.anonymous.allowed + true + Anonymous user allowed by default + + + + zeppelin.notebook.public + {{ cdh_zeppelin_notebook_public }} + Make notebook public by default when created, private otherwise + + + + zeppelin.websocket.max.text.message.size + 1024000 + Size in characters of the maximum text message to be received by websocket. Defaults to 1024000 + + + + zeppelin.server.default.dir.allowed + false + Enable directory listings on server. + + + + + + + +