This is related to ticket https://issues.apache.org/jira/browse/ZEPPELIN-2929.
This is the flow of a ZeppelinContext run request, when you want to run a paragraph from a given notebook: 1. ZeppelinContext.run uses ZeppelinContext.getInterpreterContextRunner to obtain a list of InterpreterContextRunner. The call to ZeppelinContext.getInterpreterContextRunner: 1.1 Obtains the RemoteWorksController from the interpreter context (the only implementation is RemoteInterpreterServer.ZeppelinRemoteWorksController) 1.2 Calls the method ZeppelinRemoteWorksController.getRemoteContextRunner to obtain a list of InterpreterContextRunner. The call to ZeppelinRemoteWorksController.getRemoteContextRunner: 1.2.1 Creates a ZeppelinServerResourceParagraphRunner and pass it to RemoteInterpreterEventClient.getZeppelinServerNoteRunner of the RemoteInterpreterServer passed to ZeppelinRemoteWorksController. 1.2.2 RemoteInterpreterEventClient.getZeppelinServerNoteRunner creates a RemoteZeppelinServerResource, of type RemoteZeppelinServerResource.Type.PARAGRAPH_RUNNERS, with the ZeppelinServerResourceParagraphRunner as data, and sends it as the JSON payload of the event RemoteInterpreterEventType.REMOTE_ZEPPELIN_SERVER_RESOURCE. 2. ZeppelinContext.run calls the run method of each of the InterpreterContextRunner that it gets from ZeppelinContext.getInterpreterContextRunner. I found that the only place where the event RemoteInterpreterEventType.REMOTE_ZEPPELIN_SERVER_RESOURCE is handled is in the run method of RemoteInterpreterEventPoller: 1. The RemoteZeppelinServerResource is deserialised and passed to RemoteInterpreterEventPoller.progressRemoteZeppelinControlEvent: 1.1. Setup a callback using the method RemoteInterpreterProcessListener.onGetParagraphRunners. 1.2. The callback will create one ZeppelinServerResourceParagraphRunner per InterpreterContextRunner received. 1.3. It will create a RemoteZeppelinServerResource, with the list of ZeppelinServerResourceParagraphRunner, as data and sends it using a RemoteInterpreterService.Client. No I think that this RemoteZeppelinServerResource is handled by RemoteInterpreterServer.onReceivedZeppelinResource that create a ParagraphRunner per element in the arraylist that you get as the payload of RemoteZeppelinServerResource I added several log messages to be sure that the previous flow was correct, but I can't see any message coming from the callback passed to RemoteInterpreterProcessListener.onGetParagraphRunners; the other methods are called in the right sequence. The changes I have done to try fixing the credentials propagation are the following: 1. Add the AuthenticationInfo to InterpreterContextRunner. 2. Add the AuthenticationInfo to ParagraphRunner. 3. Add a RemoteWorksController.getRemoteContextRunner that receives AuthenticationInfo as a 3rd parameter (ZeppelinContext.getInterpreterContextRunner is calling this method passing the AuthenticationInfo from the InterpreterContext) 4. Add the AuthenticationInfo to RemoteInterpreterContextRunner. 5. Add the AuthenticationInfo to RemoteInterpreterProcessListener.onRemoteRunParagraph. 6. Recover and propagate AuthenticationInfo in RemoteInterpreterEventPoller.run (call to listener.onRemoteRunParagraph) 7. Recover AuthenticationInfo in RemoteInterpreterServer.onReceivedZeppelinResource and create ParagraphRunners using that. 8. Change RemoteInterpreterService.thrift to add authenticationInfo as a String to ZeppelinServerResourceParagraphRunner. 9. Change NotebookServer.onRemoteRunParagraph to accept AuthenticationInfo as a 3rd parameter; if it's not null, use it instead of getting the AuthenticationInfo from Shiro. But so far no luck, the paragraph is still ran as the anonymous user. Is there anything I'm missing? -- Luis Angel Vicente Sanchez zeppelin-us...@bigcente.ch