The use case is to use Zeppelin and all tools/applications that belongs to the
SaaS layer authenticate and authorize users via 1 AuthN and AuthZ server which
is not Apache Shiro. So all the users, groups, roles, entitlements and
policies are stored on the AuthN and AuthZ server and apps just use it.
If Zeppelin only relies on Shiro then all the user, groups, roles,
entitlements and policies stored in the AuthN and AuthZ server have to be
transferred to Shiro DB as well.
Correct?
So then info get duplicated. That’s what I mean.
BR,
---
Mário Batista
NOKIA
Product Owner
MN GS DE Tools NPO Automation
---
From: Jeff Zhang [mailto:zjf...@gmail.com]
Sent: Monday, March 27, 2017 11:04 AM
To: Batista, Mario (Nokia - PT/Amadora) <mario.bati...@nokia.com>
Cc: users@zeppelin.apache.org
Subject: Re: Zeppelin should support standard protocols for authN and AuthZ
>>> Pluging in Apache Shiro can be an option but it still means that you still
>>> have duplicate identities, groups, roles etc
Don't understand this, why it would have duplicated identities, groups ?
Currently only shiro authentication is integrated in zeppelin, as long we
integrate shiro authorization, there should be only one central place for
authentication and authorization.
Batista, Mario (Nokia - PT/Amadora)
<mario.bati...@nokia.com<mailto:mario.bati...@nokia.com>>于2017年3月27日周一 下午5:50写道：
You dont need to remove Shiro but it would be nice if you had a way to set
Zeppelin to use external Authentication & Authorization servers.
Of course that requires that Zeppelin is able to interpret and enforce the
policies that are stored in the central authorization server.
Pluging in Apache Shiro can be an option but it still means that you still have
duplicate identities, groups, roles etc
So the ideia was to put the permission handling logic inside zeppelin and you
could use whatever authorization server you might use….as long as you use the
standard protocols…
---
Mário Batista
NOKIA
Product Owner
MN GS DE Tools NPO Automation
---
From: Jeff Zhang [mailto:zjf...@gmail.com<mailto:zjf...@gmail.com>]
Sent: Friday, March 24, 2017 2:37 AM
To: users@zeppelin.apache.org<mailto:users@zeppelin.apache.org>
Subject: Re: Zeppelin should support standard protocols for authN and AuthZ
Do you mean to remove shiro ? shiro is pluggable, maybe it supports the
protocols you mentioned
Batista, Mario (Nokia - PT/Amadora)
<mario.bati...@nokia.com<mailto:mario.bati...@nokia.com>>于2017年3月24日周五 上午2:04写道：
Hi,
Yes of course.
Currently as far as I understand Authentication and authorization is
implemented by making use of Apache Shiro, correct?
The intention here is to detach or not-bind Zeppelin to a specific solution by
making use of standard protocols for Authentication and Authorization.
Example use case:
---
Mário Batista
NOKIA
Product Owner
MN GS DE Tools NPO Automation
---
From: Jongyoul Lee [mailto:jongy...@gmail.com<mailto:jongy...@gmail.com>]
Sent: Monday, March 20, 2017 11:22 AM
To: users@zeppelin.apache.org<mailto:users@zeppelin.apache.org>
Cc:
us...@zeppelin.incubator.apache.org<mailto:us...@zeppelin.incubator.apache.org>
Subject: Re: Zeppelin should support standard protocols for authN and AuthZ
Hi,
Can you explain or give me an idea for it more detail?
On Mon, Mar 20, 2017 at 7:02 PM, mbatista
<mario.bati...@nokia.com<mailto:mario.bati...@nokia.com>> wrote:
In order to make Zeppelin more easy to integrate in the modern cloud
environments where authentication and authorization are done by having a
centralized server for all the apps, Zeppelin shall support standard
protocols for IAM purposes.
Regarding authentication
-OpenId connect protocol
Authorization
-UMA protocol (user access management), which is a OAuth2.0 profile.
This allows Resources owners to write their access control policies on the
Authorization server and make the policy enforcement point in Zeppelin
itself, for instance.
A common language for policy expression can be XACML or the emerging ALFA
language.
--
View this message in context:
http://apache-zeppelin-users-incubating-mailing-list.75479.x6.nabble.com/Zeppelin-should-support-standard-protocols-for-authN-and-AuthZ-tp5247.html
Sent from the Apache Zeppelin Users (incubating) mailing list mailing list
archive at Nabble.com.
--
이종열, Jongyoul Lee, 李宗烈
http://madeng.net
