Data Solution 2019(5)Zeppelin Authentication

Data Solution 2019(5)Zeppelin Authentication

Limit the other endpoint can only be access by the localhost machine.
> docker run -d -p 127.0.0.1:9870:9870 -p 127.0.0.1:9000:9000 -p 8080:8080 -p 127.0.0.1:4040:4040 -v $(shell pwd)/zeppelin/notebook:/tool/zeppelin/notebook -v $(shell pwd)/zeppelin/conf:/tool/zeppelin/conf --name $(NAME) $(IMAGE):$(TAG)
Only 8080 can be access by out side of the world.
Set Up Hadoop Command line on Server
> wget http://mirror.olnevhost.net/pub/apache/hadoop/common/hadoop-3.2.0/hadoop-3.2.0.tar.gz
> yum install -y java-1.8.0-openjdk-devel
> cat ~/.bash_profile
# .bash_profile
# Get the aliases and functions
if [ -f ~/.bashrc ]; then
. ~/.bashrc
fi
# User specific environment and startup programs
PATH=$PATH:$HOME/bin
PATH=$PATH:/opt/hadoop/bin
JAVA_HOME=/usr/lib/jvm/java-1.8.0
export PATH
export JAVA_HOME
List from the root directory
> hdfs dfs -ls hdfs://localhost:9000/
Create a directory
> hdfs dfs -mkdir hdfs://localhost:9000/company1
List the directory again
> hdfs dfs -ls hdfs://localhost:9000/
Found 1 items
drwxr-xr-x   - root supergroup          0 2019-03-03 19:26 hdfs://localhost:9000/company1
Set Up the Authentication for Zeppelin
Find and Prepare Zeppelin configuration file zeppelin-site.xml
<property>
  <name>zeppelin.anonymous.allowed</name>
  <value>false</value>
  <description>Anonymous user allowed by default</description>
</property>
Find and set up shiro.ini
[users]
# List of users with their password allowed to access Zeppelin.
# To use a different strategy (LDAP / Database / ...) check the shiro doc at http://shiro.apache.org/configuration.html#Configuration-INISections
# To enable admin user, uncomment the following line and set an appropriate password.
admin1 = password1, admin
admin2 = password2, admin
[urls]
# This section is used for url-based security. For details see the shiro.ini documentation.
#
# You can secure interpreter, configuration and credential information by urls.
# Comment or uncomment the below urls that you want to hide:
# anon means the access is anonymous.
# authc means form based auth Security.
#
# IMPORTANT: Order matters: URL path expressions are evaluated against an incoming request
# in the order they are defined and the FIRST MATCH WINS.
#
# To allow anonymous access to all but the stated urls,
# uncomment the line second last line (/** = anon) and comment the last line (/** = authc)
#
/api/version = anon
# Allow all authenticated users to restart interpreters on a notebook page.
# Comment out the following line if you would like to authorize only admin users to restart interpreters.
/api/interpreter/setting/restart/** = authc
/api/interpreter/** = authc, roles[admin]
/api/configurations/** = authc, roles[admin]
/api/credential/** = authc, roles[admin]
#/** = anon
/** = authc
Then, we need username and password to work on Zeppelin now.
References:
http://www.voidcn.com/article/p-tmpoqwmv-yz.html
https://www.cnblogs.com/reblue520/p/7255612.html