Hi, I have been struggling for weeks to get LDAP to work in Zeppelin now. Unfortunately for me, I cannot use websockets unless also using LDAP for authentication. So if I use the anonymous user, I just get a blank home page. Zeppelin leaves no configuration option to disable web sockets. My company has their own cert authority, which I have added to my trust store.
When I try logging in to Zeppelin using my LDAP, I get
“SunCertPathBuilderException: unable to find valid certification path to
requested target”. I have attached the full stack trace. Note that I am using
ldaps over 636. Basically it’s like saying that my trust store does not
identify my LDAP server as a trusted web server. I am certain that my JKS file
is configured right, I have had a co-worker double check it for me.
To troubleshoot, we did:
Export JAVA_OPTS=’-Djavax.net.debug=all’
Now we are seeing all of the SSL verbose logs in the zeppelin--…..out file.
I was surprised to see this:
…
keyStore is :
keyStore type is : jks
keyStore provider is :
init keystore
init keymanager of type SunX509
trustStore is: /application/jdk1.8.0_101/jre/lib/security/cacerts
trustStore type is : jks
trustStore provider is :
init truststore
…
So it looks like the application is not truly using the trust store I have
configured. I have this in my zeppelin-site.xml:
<property>
<name>zeppelin.ssl.truststore.path</name>
<value>/application/zeppelin/conf/zeppelin-truststore.jks</value>
<description>Path to truststore relative to Zeppelin configuration
directory. Defaults to the keystore path</description>
</property>
It seems to me like the key and trust store are not getting used to connect to
the LDAP server.
Other factors:
· I am using a corporate proxy
· I have dockerized Zeppelin
Unrelated comments:
· Every time I want to test a change in Zeppelin, the NPMInstaller
wastes a minute of my life trying to download some files. It fails every time,
and it prints a stack trace in my logs every time. I would like to disable it,
but I looked through your code, there is no way to do it. Your code also does
not provide any opportunity to configure a proxy, so there is no chance this
would work for me. I am even thinking of making a pull request to fix this,
it’s quite annoying. I don’t know why the authors assume that other people are
ok with this pattern.
· I am also getting an exception in the logs stating: No operation
matching request path
"/api/login;JSESSIONID=92e79cbe-9113-473d-b76a-165666c3f221" is found. Is this
a bug in Zeppelin?
Does anybody know why this is not working? Or how I can fix it?
Michael Knapp
________________________________________________________
The information contained in this e-mail is confidential and/or proprietary to
Capital One and/or its affiliates and may only be used solely in performance of
work or services for Capital One. The information transmitted herewith is
intended only for use by the individual or entity to which it is addressed. If
the reader of this message is not the intended recipient, you are hereby
notified that any review, retransmission, dissemination, distribution, copying
or other use of, or taking of any action in reliance upon this information is
strictly prohibited. If you have received this communication in error, please
contact the sender and delete the material from your computer.
zeppelin-failure.log
Description: zeppelin-failure.log
