一、開(kāi)啟 Shiro 配置
- 在
conf目錄下的shiro.ini.template文件為 Shiro 的樣例配置文件净捅，我們通過(guò) copy 的方式來(lái)創(chuàng)建一個(gè)新的配置文件
cd conf/
cp shiro.ini.template shiro.ini
二疑枯、配置Shiro
2.1 配置使用明文密碼
vim shiro.ini
[users]
# List of users with their password allowed to access Zeppelin.
# To use a different strategy (LDAP / Database / ...) check the shiro doc at http://shiro.apache.org/configuration.html#Configuration-INISections
# To enable admin user, uncomment the following line and set an appropriate password.
# 使用明文密碼
admin = admin, admin
luke = luke, analysis
# 配置角色
[roles]
admin = *
analysis = *
# 配置所有 url的訪(fǎng)問(wèn)都需要驗(yàn)證
[urls]
# This section is used for url-based security. For details see the shiro.ini documentation.
#
# You can secure interpreter, configuration and credential information by urls.
# Comment or uncomment the below urls that you want to hide:
# anon means the access is anonymous.
# authc means form based auth Security.
#
# IMPORTANT: Order matters: URL path expressions are evaluated against an incoming request
# in the order they are defined and the FIRST MATCH WINS.
#
# To allow anonymous access to all but the stated urls,
# uncomment the line second last line (/** = anon) and comment the last line (/** = authc)
#
/api/version = authc
/api/cluster/address = authc
# Allow all authenticated users to restart interpreters on a notebook page.
# Comment out the following line if you would like to authorize only admin users to restart interpreters.
/api/interpreter/setting/restart/** = authc
/api/interpreter/** = authc, roles[admin]
/api/notebook-repositories/** = authc, roles[admin]
/api/configurations/** = authc, roles[admin]
/api/credential/** = authc, roles[admin]
/api/admin/** = authc, roles[admin]
#/** = anon
/** = authc
重啟服務(wù)
./zeppelin-daemon.sh restart
使用admin賬號(hào)登錄成功
image.png
image.png
2.2 為了密碼安全，使用加密后的密碼
使用 Command Line Hasher 對(duì) 用戶(hù)密碼進(jìn)行加密
## build Command Line Hasher tool
mvn dependency:get -DgroupId=org.apache.shiro.tools -DartifactId=shiro-tools-hasher -Dclassifier=cli -Dversion=1.7.0
## 使用打包好的 tool 對(duì)用戶(hù)進(jìn)行加密
java -jar ~/.m2/repository/org/apache/shiro/tools/shiro-tools-hasher/1.7.0/shiro-tools-hasher-1.7.0-cli.jar -p
Password to hash:
Password to hash (confirm):
$shiro1$SHA-256$500000$ybTZ7NhAdqsYUyD8ytJ95A==$+LP9EVgd/Dnokwp6V1n8cg1BQHx1J1LlxwCAGX+QLMY=
需要在 [main] 做如下配置蛔六，確保 隱式 iniRelam 使用一個(gè) 知道如何對(duì)安全的哈希密碼進(jìn)行校驗(yàn)的 CredentialsMatcher
[main]
passwordMatcher = org.apache.shiro.authc.credential.PasswordMatcher
iniRealm.credentialsMatcher = $passwordMatcher
配置用戶(hù)密碼
[users]
# List of users with their password allowed to access Zeppelin.
# To use a different strategy (LDAP / Database / ...) check the shiro doc at http://shiro.apache.org/configuration.html#Configuration-INISections
# To enable admin user, uncomment the following line and set an appropriate password.
admin = $shiro1$SHA-256$500000$ybTZ7NhAdqsYUyD8ytJ95A==$+LP9EVgd/Dnokwp6V1n8cg1BQHx1J1LlxwCAGX+QLMY=, admin
luke = $shiro1$SHA-256$500000$ybTZ7NhAdqsYUyD8ytJ95A==$+LP9EVgd/Dnokwp6V1n8cg1BQHx1J1LlxwCAGX+QLMY=, analysis
重啟服務(wù)生效
./zeppelin-daemon.sh restart
