[main]
ldapRealm=org.apache.zeppelin.realm.LdapRealm
ldapRealm.contextFactory.authenticationMechanism=simple
ldapRealm.contextFactory.url=ldap://10.252.143.193:389
ldapRealm.userDnTemplate=uid={0},ou=people,dc=gwmedc,dc=com
ldapRealm.pagingSize = 200
ldapRealm.authorizationEnabled=true
ldapRealm.searchBase=dc=gwmedc,dc=com
ldapRealm.userSearchBase = ou=people,dc=gwmedc,dc=com
ldapRealm.groupSearchBase = ou=group,dc=gwmedc,dc=com
ldapRealm.groupObjectClass=posixGroup
ldapRealm.userLowerCase = true
ldapRealm.memberAttribute = memberuid
ldapRealm.groupSearchFilter=(&(objectClass=posixGroup)(memberuid={0}))
ldapRealm.userSearchScope = subtree
ldapRealm.groupSearchScope = subtree
ldapRealm.contextFactory.systemUsername= cn=admin,dc=gwmedc,dc=com
### 我的cn=admin,dc=domain,dc=com密码设置的是admin，这里需要替换成用户自己设置的密码
ldapRealm.contextFactory.systemPassword = admin
ldapRealm.groupSearchEnableMatchingRuleInChain = false
### 将Ldap上的admin group映射成zeppelin的admin角色, user group映射成zeppelin的user_role角色
ldapRealm.rolesByGroup = admin:admin,user:user_role
securityManager.realms = $ldapRealm

sessionManager = org.apache.shiro.web.session.mgt.DefaultWebSessionManager
cookie = org.apache.shiro.web.servlet.SimpleCookie
cookie.name = JSESSIONID
cookie.httpOnly = true
sessionManager.sessionIdCookie = $cookie
securityManager.sessionManager = $sessionManager
securityManager.sessionManager.globalSessionTimeout = 86400000
shiro.loginUrl = /api/login
securityManager.sessionManager = $sessionManager
securityManager.realms = $ldapRealm

sessionManager = org.apache.shiro.web.session.mgt.DefaultWebSessionManager
### Enables 'HttpOnly' flag in Zeppelin cookies
cookie = org.apache.shiro.web.servlet.SimpleCookie
cookie.name = JSESSIONID
cookie.httpOnly = true
### Uncomment the below line only when Zeppelin is running over HTTPS
#cookie.secure = true
sessionManager.sessionIdCookie = $cookie
securityManager.sessionManager = $sessionManager
# 86,400,000 milliseconds = 24 hour
securityManager.sessionManager.globalSessionTimeout = 86400000
shiro.loginUrl = /api/login

[roles]
#devops = *
#admin = *

[urls]
/api/version = anon
/api/interpreter/setting/restart/** = authc
/api/interpreter/** = authc, roles[admin]
/api/configurations/** = authc, roles[admin]
/api/credential/** = authc, roles[admin]
#/** = anon
/** = authc