The Websocket channel is now as secure as the HTTP channel.

apache · Dec 31, 2015 · f9b1952 · f9b1952
1 parent e2affca
commit f9b1952
Show file tree

Hide file tree

Showing 6 changed files with 58 additions and 6 deletions.
diff --git a/zeppelin-server/src/main/java/org/apache/zeppelin/socket/Message.java b/zeppelin-server/src/main/java/org/apache/zeppelin/socket/Message.java
@@ -102,6 +102,8 @@ public static enum OP {
 
   public OP op;
   public Map<String, Object> data = new HashMap<String, Object>();
+  public String ticket;
+  public String principal;
 
   public Message(OP op) {
     this.op = op;

diff --git a/zeppelin-server/src/main/java/org/apache/zeppelin/socket/NotebookServer.java b/zeppelin-server/src/main/java/org/apache/zeppelin/socket/NotebookServer.java
@@ -41,6 +41,7 @@
 import org.apache.zeppelin.scheduler.JobListener;
 import org.apache.zeppelin.server.ZeppelinServer;
 import org.apache.zeppelin.socket.Message.OP;
+import org.apache.zeppelin.ticket.TicketContainer;
 import org.apache.zeppelin.utils.SecurityUtils;
 import org.eclipse.jetty.websocket.WebSocket;
 import org.eclipse.jetty.websocket.WebSocketServlet;
@@ -96,6 +97,19 @@ public void onMessage(NotebookSocket conn, String msg) {
     try {
       Message messagereceived = deserializeMessage(msg);
       LOG.debug("RECEIVE << " + messagereceived.op);
+      LOG.debug("RECEIVE PRINCIPAL << " + messagereceived.principal);
+      LOG.debug("RECEIVE TICKET << " + messagereceived.ticket);
+      String ticket = TicketContainer.instance.getTicket(messagereceived.principal);
+      if (ticket != null && !ticket.equals(messagereceived.ticket))
+        throw new Exception("Invalid ticket " + messagereceived.ticket + " != " + ticket);
+
+      ZeppelinConfiguration conf = ZeppelinConfiguration.create();
+      boolean allowAnonymous = conf.
+          getBoolean(ZeppelinConfiguration.ConfVars.ZEPPELIN_ANONYMOUS_ALLOWED);
+      if (!allowAnonymous && messagereceived.principal.equals("anonymous")) {
+        throw new Exception("Anonymous access not allowed ");
+      }
+
       /** Lets be elegant here */
       switch (messagereceived.op) {
           case LIST_NOTES:

diff --git a/zeppelin-web/src/app/home/home.controller.js b/zeppelin-web/src/app/home/home.controller.js
@@ -14,7 +14,13 @@
 'use strict';
 
 angular.module('zeppelinWebApp').controller('HomeCtrl', function($scope, notebookListDataFactory, websocketMsgSrv, $rootScope, arrayOrderingSrv) {
-
+    if (!$rootScope.ticket) {
+        $rootScope.ticket = {
+            'principal':'anonymous',
+            'ticket':'anonymous'
+        };
+    }
+
   var vm = this;
   vm.notes = notebookListDataFactory;
   vm.websocketMsgSrv = websocketMsgSrv;

diff --git a/zeppelin-web/src/components/navbar/navbar.controller.js b/zeppelin-web/src/components/navbar/navbar.controller.js
@@ -15,14 +15,22 @@
 'use strict';
 
 angular.module('zeppelinWebApp').controller('NavCtrl', function($scope, $rootScope, $routeParams,
-    $location, notebookListDataFactory, websocketMsgSrv, arrayOrderingSrv) {
+    $location, notebookListDataFactory, websocketMsgSrv, arrayOrderingSrv, $http) {
+    if (!$rootScope.ticket) {
+        $rootScope.ticket = {
+            'principal':'anonymous',
+            'ticket':'anonymous'
+        };
+    }
+
   /** Current list of notes (ids) */
 
   var vm = this;
   vm.notes = notebookListDataFactory;
   vm.connected = websocketMsgSrv.isConnected();
   vm.websocketMsgSrv = websocketMsgSrv;
   vm.arrayOrderingSrv = arrayOrderingSrv;
+  vm.authenticated = $rootScope.ticket.principal !== 'anonymous';
 
   angular.element('#notebook-list').perfectScrollbar({suppressScrollX: true});
 
@@ -51,7 +59,27 @@ angular.module('zeppelinWebApp').controller('NavCtrl', function($scope, $rootSco
     websocketMsgSrv.getNotebookList();
   }
 
-  function isActive(noteId) {
+    /** ask for a ticket for websocket access
+     * Shiro will require credentials here
+     * */
+    $http.get('/api/security/ticket').
+    success(function(ticket, status, headers, config) {
+        if (status === 401 || status === 403) {
+            // Dislay error message here
+        }
+        else {
+            $rootScope.ticket = angular.fromJson(ticket).body;
+            vm.loadNotes = loadNotes;
+            vm.isActive = isActive;
+            vm.loadNotes();
+            vm.authenticated = $rootScope.ticket.principal !== 'anonymous';
+        }
+    }).
+    error(function(data, status, headers, config) {
+        console.log('Could not get ticket');
+    });
+
+    function isActive(noteId) {
     return ($routeParams.noteId === noteId);
   }
 

diff --git a/zeppelin-web/src/components/navbar/navbar.html b/zeppelin-web/src/components/navbar/navbar.html
@@ -73,8 +73,8 @@
         </li>
         <li class="server-status">
           <i class="fa fa-circle" ng-class="{'server-connected':navbar.connected, 'server-disconnected':!navbar.connected}"></i>
-          <span ng-show="navbar.connected">Connected</span>
-          <span ng-show="!navbar.connected">Disconnected</span>
+          <span ng-show="navbar.authenticated">{{ticket.principal}} connected</span>
+          <span ng-show="!navbar.authenticated">Disconnected</span>
         </li>
       </ul>
     </div>

diff --git a/zeppelin-web/src/components/websocketEvents/websocketEvents.factory.js b/zeppelin-web/src/components/websocketEvents/websocketEvents.factory.js
@@ -28,7 +28,9 @@ angular.module('zeppelinWebApp').factory('websocketEvents', function($rootScope,
   });
 
   websocketCalls.sendNewEvent = function(data) {
-    console.log('Send >> %o, %o', data.op, data);
+    data.principal = $rootScope.ticket.principal;
+    data.ticket = $rootScope.ticket.ticket;
+    console.log('Send >> %o, %o, %o, %o', data.op, data.principal, data.ticket, data);
     websocketCalls.ws.send(JSON.stringify(data));
   };