mirror of
https://github.com/apache/zeppelin
synced 2026-05-24 09:38:26 +00:00
85d4df4f0c
### What is this PR for? As more and more document pages are added, it's really hard to find specific pages. So I added searching feature to Zeppelin documentation site([jekyll](https://jekyllrb.com/) based site) using [lunr.js](http://lunrjs.com/). - **How does it work?** I created [`search_data.json`](6e02423f54/docs/search_data.json) which is used for docs info template. `lunr.js` combines all of the text from all of the docs in `docs/` into `_site/search_data.json`. It looks like below.  All the info are comes from [Jekyll YAML front matter](https://jekyllrb.com/docs/frontmatter/) variables. (i.e. title, group, description.. that's why I rewrote all docs' title and description.) [search.js](6e02423f54/docs/assets/themes/zeppelin/js/search.js) will do this job using this data! ### What type of PR is it? Improvement & Feature ### Todos * [x] - Keep consistency for all docs pages' `Title` * [x] - Add some overview sentences to all docs pages' `Description` section (this will be used as the result preview) * [x] - Add apache license header to all docs page (some pages are missing the license header currently) * [x] - Add LICENSE for `lunr.min.js` ### What is the Jira issue? [ZEPPELIN-1219](https://issues.apache.org/jira/browse/ZEPPELIN-1219) ### How should this be tested? 1. Apply this patch and build `ZEPPELIN_HOME/docs` dir -> please see [docs/README.md#build-documentation](https://github.com/apache/zeppelin/tree/master/docs#build-documentation) 2. Click `search` icon in navbar and go to `search.html` page 3. Type anything you want to search in the search bar (i.e. type `python`, `spark`, `dynamic` ... ) ### Screenshots (if appropriate)   ### Questions: * Does the licenses files need update? Yes, for `lunr.min.js` * Is there breaking changes for older versions? no * Does this needs documentation? no Author: AhyoungRyu <fbdkdud93@hanmail.net> Closes #1266 from AhyoungRyu/ZEPPELIN-1219 and squashes the following commits:7ec8854[AhyoungRyu] Modify 'no result' sentence91b71a7[AhyoungRyu] Remove Apache license header since JSON doesn't allow comment34afd5d[AhyoungRyu] Add Apache license header to search_data.json6784282[AhyoungRyu] Minor search page UI update0389d28[AhyoungRyu] Make index.md not to be searched9f1ba42[AhyoungRyu] Disable enterkey press & change iconbd4956a[AhyoungRyu] Add docs.js & search.js to exclude list in pom.xml624b051[AhyoungRyu] Add Apache license header to search.js1381152[AhyoungRyu] Fix search result skipping issue6e775f5[AhyoungRyu] Make pleasecontribute.md not to be searchedee11136[AhyoungRyu] Fix some typosfa01299[AhyoungRyu] Refine 'description' in some docs as @bzz suggestedda0cff9[AhyoungRyu] Exclude lunr.min.js36ba7f1[AhyoungRyu] Add lunr.min.js license infof6a05a6[AhyoungRyu] Apply css style for the search results68eb997[AhyoungRyu] Attach 'Apache Zeppelin ZEPPELIN_VERSION Documentation: ' to titled908c37[AhyoungRyu] Add searching pagea951fa6[AhyoungRyu] Add search icon to navbar0688a79[AhyoungRyu] Keep consistency all docs' front matter for the right search result040f532[AhyoungRyu] Add template for storing docs info based on jekyll front matter0705bd6[AhyoungRyu] Add js files: lunr.min.js & search.js
60 lines
3.2 KiB
Markdown
60 lines
3.2 KiB
Markdown
---
|
|
layout: page
|
|
title: "Notebook Authorization in Apache Zeppelin"
|
|
description: "This page will guide you how you can set the permission for Zeppelin notebooks. This document assumes that Apache Shiro authentication was set up."
|
|
group: security
|
|
---
|
|
<!--
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
See the License for the specific language governing permissions and
|
|
limitations under the License.
|
|
-->
|
|
{% include JB/setup %}
|
|
|
|
# Zeppelin Notebook Authorization
|
|
|
|
<div id="toc"></div>
|
|
|
|
## Overview
|
|
We assume that there is an **Shiro Authentication** component that associates a user string and a set of group strings with every NotebookSocket.
|
|
If you don't set the authentication components yet, please check [Shiro authentication for Apache Zeppelin](./shiroauthentication.html) first.
|
|
|
|
## Authorization Setting
|
|
You can set Zeppelin notebook permissions in each notebooks. Of course only **notebook owners** can change this configuration.
|
|
Just click **Lock icon** and open the permission setting page in your notebook.
|
|
|
|
As you can see, each Zeppelin notebooks has 3 entities :
|
|
|
|
* Owners ( users or groups )
|
|
* Readers ( users or groups )
|
|
* Writers ( users or groups )
|
|
|
|
<center><img src="../assets/themes/zeppelin/img/docs-img/permission_setting.png"></center>
|
|
|
|
Fill out the each forms with comma seperated **users** and **groups** configured in `conf/shiro.ini` file.
|
|
If the form is empty (*), it means that any users can perform that operation.
|
|
|
|
If someone who doesn't have **read** permission is trying to access the notebook or someone who doesn't have **write** permission is trying to edit the notebook, Zeppelin will ask to login or block the user.
|
|
|
|
<center><img src="../assets/themes/zeppelin/img/docs-img/insufficient_privileges.png"></center>
|
|
|
|
## How it works
|
|
In this section, we will explain the detail about how the notebook authorization works in backend side.
|
|
|
|
### NotebookServer
|
|
The [NotebookServer](https://github.com/apache/zeppelin/blob/master/zeppelin-server/src/main/java/org/apache/zeppelin/socket/NotebookServer.java) classifies every notebook operations into three categories: **Read**, **Write**, **Manage**.
|
|
Before executing a notebook operation, it checks if the user and the groups associated with the `NotebookSocket` have permissions.
|
|
For example, before executing a **Read** operation, it checks if the user and the groups have at least one entity that belongs to the **Reader** entities.
|
|
|
|
### Notebook REST API call
|
|
Zeppelin executes a [REST API call](https://github.com/apache/zeppelin/blob/master/zeppelin-server/src/main/java/org/apache/zeppelin/rest/NotebookRestApi.java) for the notebook permission information.
|
|
In the backend side, Zeppelin gets the user information for the connection and allows the operation if the users and groups
|
|
associated with the current user have at least one entity that belongs to owner entities for the notebook.
|