Hi - I opened a jira for that: https://issues.apache.org/jira/browse/KYLIN-1234
Thanks! Marek 2015-12-14 16:03 GMT+01:00 Marek Wiewiorka <[email protected]>: > Sure I can do that :) ! > Just could you please try to double check the second problem because > maybe I do not get something and I wouldn't like to confuse anyone. > Once I know how to set up security e2e with ACLs correctly I will draft > the Kylin security manual :) > > Thanks again! > Marek > > 2015-12-14 15:58 GMT+01:00 ShaoFeng Shi <[email protected]>: > >> Hi Marek, >> >> If you're familiar with Spring Security framework, the "ROLE_" prefix is >> added by that when converting the user groups to role authorities. You can >> check http://fmanea.blogspot.com/2015/04/spring-security-role-prefix.html, >> or search Google for more discussions. It is a little tricky, we should >> have a specific document on this. And we welcome contribution from the >> community, if you'd like to do a summary from an Kylin end user's >> pespective, that would be very nice. I believe you know more about LDAP >> setup and configurations than me :) >> >> Regarding the problem you described, we will double check. In the >> meanwhile you can report a JIRA at >> https://issues.apache.org/jira/browse/KYLIN and we will follow up it >> there. Thanks! >> >> >> 2015-12-14 21:25 GMT+08:00 Marek Wiewiorka <[email protected]>: >> >>> Ok - I found the rootcause for the point 1-it was just a typo. >>> But I still do not understand how to proceed with ACLs. >>> >>> Thanks and I'm sorry for the confusion. >>> BTW the part with prefixing entries with "ROLE_" is tricky and I do not >>> it it's documented anywhere. >>> >>> Regards, >>> Marek >>> >>> >>> 2015-12-14 14:07 GMT+01:00 Marek Wiewiorka <[email protected]>: >>> >>>> Hi - thanks! >>>> >>>> Regarding my first question - I tried as follows: >>>> >>>> #properties: >>>> acl.adminRole=ROLE_KYLIN_ADMINS >>>> >>>> #LDAP: >>>> [image: Obraz w treści 1] >>>> >>>> Debug output: >>>> >>>> [http-bio-7070-exec-5]:[2015-12-14 >>>> 12:57:14,757][DEBUG][org.springframework.security.ldap.SpringSecurityLdapTemplate.searchForSingleAttributeValues(SpringSecurityLdapTemplate.java:152)] >>>> - Using filter: (member=uid=kylinadmin,ou=users,dc=example,dc=net) >>>> [http-bio-7070-exec-5]:[2015-12-14 >>>> 12:57:14,757][DEBUG][org.springframework.security.ldap.SpringSecurityLdapTemplate.searchForSingleAttributeValues(SpringSecurityLdapTemplate.java:152)] >>>> - Using filter: (member=uid=kylinadmin,ou=users,dc=example,dc=net) >>>> [http-bio-7070-exec-5]:[2015-12-14 >>>> 12:57:14,763][DEBUG][org.springframework.security.ldap.userdetails.DefaultLdapAuthoritiesPopulator.getGroupMembershipRoles(DefaultLdapAuthoritiesPopulator.java:219)] >>>> - Roles from search: [KYLIN_ADMINS] >>>> [http-bio-7070-exec-5]:[2015-12-14 >>>> 12:57:14,763][DEBUG][org.springframework.security.ldap.userdetails.DefaultLdapAuthoritiesPopulator.getGroupMembershipRoles(DefaultLdapAuthoritiesPopulator.java:219)] >>>> - Roles from search: [KYLIN_ADMINS] >>>> [http-bio-7070-exec-5]:[2015-12-14 >>>> 12:57:14,763][DEBUG][org.springframework.security.ldap.userdetails.LdapUserDetailsMapper.mapUserFromContext(LdapUserDetailsMapper.java:51)] >>>> - Mapping user details from context with DN: >>>> uid=kylinadmin,ou=users,dc=example,dc=net >>>> [http-bio-7070-exec-5]:[2015-12-14 >>>> 12:57:14,763][DEBUG][org.springframework.security.ldap.userdetails.LdapUserDetailsMapper.mapUserFromContext(LdapUserDetailsMapper.java:51)] >>>> - Mapping user details from context with DN: >>>> uid=kylinadmin,ou=users,dc=example,dc=net >>>> >>>> still I do not have admin rights (particulary I cannot see admin tab in >>>> the UI) >>>> >>>> 2)What I meant is that cubes ACL do not work for me as well. >>>> I'm calling REST api with a sql query with a user that isn't in any ACL >>>> - so does not have even read right. >>>> User is authenticated using LDAP, isn't a member of any group, default >>>> acl role isn't set at all but the call does not fail - user can read data >>>> from the cube via rest api. >>>> I assume it's wrong and by default no one should be allowed to read the >>>> data unless is a member of a group that has at least CUBE_READ privilege, >>>> right? >>>> >>>> >>>> Marek >>>> >>>> >>>> >>>> >>>> >>>> 2015-12-13 13:41 GMT+01:00 ShaoFeng Shi <[email protected]>: >>>> > >>>> > For question 1) map a LDAP group to admin role in Kylin >>>> > >>>> > In conf/kylin.properties there are two properties: >>>> > acl.adminRole= >>>> > acl.defaultRole= >>>> > >>>> > "acl.adminRole" is mapped to the LDAP group which you want to grant >>>> the admin role in Kylin. For example, in LDAP you create a group called >>>> "KYLIN_ADMINS", then here you should set the property value to >>>> "ROLE_KYLIN_ADMINS". Then when a user from this group logins Kylin, he will >>>> have the admin authority (can see the "Admin" tab and doing all actions) >>>> > >>>> > "acl.defaultRole" is the default roles that you want to grant to all >>>> authenticated user; In our case, we set this property to >>>> "ROLE_ANALYST,ROLE_MODELER", which means every login user has analyst and >>>> modeler role. >>>> > >>>> > Beside this, you can grant the permissions at cube level, please find >>>> the "Access" tab when expanding a cube. >>>> > >>>> > For question 2), I didn't get your point, a sample case should be >>>> helpful. >>>> > >>>> > 2015-12-12 22:03 GMT+08:00 Marek Wiewiorka <[email protected] >>>> >: >>>> >> >>>> >> I would be extreme grateful!!! >>>> >> In the first place if you could please write a few hints on how to >>>> configure cubes ACLs + admin role mapping with LDAP. >>>> >> >>>> >> Many thanks in advance! >>>> >> Marek >>>> >> >>>> >> 2015-12-12 12:28 GMT+01:00 Shaofeng Shi <[email protected]>: >>>> >>> >>>> >>> I planned to write a doc on this, but seems it need be prioritized >>>> now. >>>> >>> >>>> >>> Marek Wiewiorka <[email protected]>编写： >>>> >>> >>>> >>> >>>> >>> Hi All - I managed to get LDAP authentication working but I'm >>>> unable to setup proper authorization. >>>> >>> >>>> >>> Does anybody of you got it working properly - roles mapping, >>>> privileges on cubes with LDAP? >>>> >>> >>>> >>> I will summarize briefly what I wasn't able to do: >>>> >>> 1)map a LDAP group to admin role in Kylin >>>> >>> 2)Despite granting only one group 'cube query' privilege on a cube >>>> everyone who is properly authenticated can query the data which is >>>> obviously wrong. >>>> >>> >>>> >>> Any help more than welcome! >>>> >>> >>>> >>> Marek >>>> >>> >>>> >>> >>>> >> >>>> >> >>>> > >>>> > >>>> > >>>> > -- >>>> > Best regards, >>>> > >>>> > Shaofeng Shi >>>> > >>>> >>> >>> >> >> >> -- >> Best regards, >> >> Shaofeng Shi >> >> >
