[ZEPPELIN-5258] Add Knox realm support to ShiroAuthenticationService.getAssociatedRoles

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 0.9.0
• Fix Version/s: 0.9.1, 0.10.0
• Component/s: zeppelin-server
• Assignee: Adam Binford
• Reporter: Adam Binford
• Created: 21/Feb/21 15:42
• Updated: 28/Feb/21 16:00
• Resolved: 28/Feb/21 15:56

Description

The KnoxJwtRealm was added as another form of shiro authentication, and works for the native shiro URL authorization. We need to add special handling to ShiroAuthenticationService.getAssociatedRoles so that we can obtain groups for Knox realm users and use them for notebook authorization.

A better long term approach would probably be to eliminate the need for getAssociatedRoles all together and better natively use the shiro API, but for now this would at least add better Knox support.