mirror of https://github.com/apache/zeppelin synced 2026-05-24 09:38:26 +00:00

astroshim b7307d49de [ZEPPELIN-1567] Let JDBC interpreter use user credential information.

### What is this PR for?

This PR is for the multi-tenant of JDBC Interpreter.

User can create a user/password for JDBC account at the [Credential page](http://zeppelin.apache.org/docs/0.7.0-SNAPSHOT/security/datasource_authorization.html).
The `Entity` of `Credential` is match with JDBC interpreter group name.

If the account for JDBC is not setted in the `Interpreter property` then use `Credential`'s.
### What type of PR is it?

Improvement
### What is the Jira issue?

https://issues.apache.org/jira/browse/ZEPPELIN-1567
### How should this be tested?

Please refer to testMultiTenant() of JDBCInterpreterTest/
### Screenshots (if appropriate)
### Questions:
- Does the licenses files need update? no
- Is there breaking changes for older versions? no
- Does this needs documentation? no

Author: astroshim <hsshim@nflabs.com>

Closes #1539 from astroshim/jdbc-impersonation and squashes the following commits:

46fce31 [astroshim] add explanation of InterpreterGroup
7a92236 [astroshim] fix doc and remove persist value.
63f5ea7 [astroshim] Merge branch 'master' into jdbc-impersonation
267277a [astroshim] rebase
649ff6e [astroshim] rebase
872fb49 [astroshim] fix ScioInterpreterTestCase
4387a5b [astroshim] Merge branch 'master' into jdbc-impersonation
47c463f [astroshim] update doc and html
d4eb178 [astroshim] fix docs
59aa9ff [astroshim] Merge branch 'master' into jdbc-impersonation
bf61afd [astroshim] fix testcase
5c0f5d7 [astroshim] rebase
79ba25b [astroshim] Merge branch 'master' into jdbc-impersonation
1f9c2c0 [astroshim] clean redundant code
a2f5687 [astroshim] fix impersonation
9962181 [astroshim] fix InterpreterOutput of PySparkInterpreterTest case
b55aceb [astroshim] Merge branch 'master' into jdbc-impersonation
24a8226 [astroshim] fix doc
086dfda [astroshim] fix testcase
34fe0a6 [astroshim] fix code for more simple.
fee7086 [astroshim] fix build error.
a305eca [astroshim] Merge branch 'master' into jdbc-impersonation
df80741 [astroshim] documentation for credential.
df1b1dc [astroshim] rebase and entity name convention.
63d6a1c [astroshim] change thrift version to 0.9.2
6573c1c [astroshim] change variable name
f311f34 [astroshim] fix typo
722e333 [astroshim] change testcase name
9161937 [astroshim] clean code
3dafdf0 [astroshim] add testcase
373d5f1 [astroshim] pass replName to Interpreter and use credential info for jdbc auth.

2016-11-24 09:17:01 -08:00

3.4 KiB

Raw Blame History

layout	title	description	group
page	Data Source Authorization in Apache Zeppelin	Apache Zeppelin supports protected data sources. In case of a MySql database, every users can set up their own credentials to access it.	security

{% include JB/setup %}

Data Source Authorization in Apache Zeppelin

Overview

Data source authorization involves authenticating to the data source like a Mysql database and letting it determine user permissions. Apache Zeppelin allows users to use their own credentials to authenticate with Data Sources.

For example, let's assume you have an account in the Vertica databases with credentials. You might want to use this account to create a JDBC connection instead of a shared account with all users who are defined in conf/shiro.ini. In this case, you can add your credential information to Apache Zeppelin and use them with below simple steps.

How to save the credential information?

You can add new credentials in the dropdown menu for your data source which can be passed to interpreters.

Entity can be the key that distinguishes each credential sets.(We suggest that the convention of the Entity is [Interpreter Group].[Interpreter Name].) Please see what is interpreter group for the detailed information.

Type Username & Password for your own credentials. ex) Mysql user & password of the JDBC Interpreter.

The credentials saved as per users defined in conf/shiro.ini. If you didn't activate shiro authentication in Apache Zeppelin, your credential information will be saved as anonymous. All credential information also can be found in conf/credentials.json.

JDBC interpreter

You need to maintain per-user connection pools. The interpret method takes the user string as a parameter and executes the jdbc call using a connection in the user's connection pool.

Presto

You don't need a password if the Presto DB server runs backend code using HDFS authorization for the user.

Vertica and Mysql

You have to store the password information for users.

Please note

As a first step of data source authentication feature, ZEPPELIN-828 was proposed and implemented in Pull Request #860. Currently, only customized 3rd party interpreters can use this feature. We are planning to apply this mechanism to the community managed interpreters in the near future. Please keep track ZEPPELIN-1070.

3.4 KiB Raw Blame History