[ZEPPELIN-3509] Notebook Authorization not working

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Not A Problem
• Affects Version/s: 0.8.0
• Component/s: security
• Assignee: Prabhjyot Singh
• Reporter: Madiha Khalid
• Created: 29/May/18 07:34
• Updated: 17/Jul/18 01:44
• Resolved: 17/Jul/18 01:44

Description

Dear Team,

In zeppelin 0.8.0 release Notebook authorization not working properly.  

Authorization Setting for User Notebook Note 1

User1 -> Runner

admin -> Owner

User1 able to update notebook permission for all (owner, runner, reader, writer )

Steps to reproduce:

1. Login as admin and give access to user 1 as a runner, shown in attached image step
2. Login as user1 open Note 1 here user 1 is able to open and update the notebook permissions shown in attached image step 2a.
3. User 1 changed Owner rights from admin to user1 and save successfully shown in attached image 2b.
4. Login as admin, open Note 1 notebook here we can see the Owner rights are changed from admin to user1 shown in attached image Step 3.

According to my understanding, User1 should not able to open Notebook permission button. I also attached my shiro.ini file.