[ZEPPELIN-1237] Auto-suggestion of notebook permissions should list roles as well

[prabhjyotsingh]

What is this PR for?

Auto-suggestion of notebook permissions should list roles as well

What type of PR is it?

[Improvement]

Todos

• - Fix test case (selenium)
• - select2 in bower.json

What is the Jira issue?

• ZEPPELIN-1237

How should this be tested?

Search for group/roles in notebook permission, it should get listed

Screenshots (if appropriate)

Questions:

• Does the licenses files need update? n/a
• Is there breaking changes for older versions? n/a
• Does this needs documentation? n/a

[r-kamath]

unused

[r-kamath]

@prabhjyotsingh 404 for /userlist api call when clicked on text fields.
user: anonymous

[prabhjyotsingh]

@r-kamath have implement your feedback.

[felixcheung]

is it a bit of an information disclosure security issue though, that we should all user name when someone type the first character?

[prabhjyotsingh]

I've looked up few products of which the popular ones Outlook (app) limit to 8 results, Outlook (web i.e. owa) limit to 5 results and JIRA does not limits.

I don't have a strong opinion on this, can change according to recommendation.

[rconline]

@felixcheung i think this will continue to remain a problem, till the time we allow all user roles to setup/modify these permissions. Unless we can recognize and separate this as an admin (superuser) action, this seems okay to me. There will be cases when the LDAP user id's will end up in zeppelin/POSIX systems as 'a1890xx', based upon conversion rules, when users who setup these permissions will find it very hard to use. Hence for now, showing all users is a reasonable approach.

[felixcheung]

I'm ok with it - maybe open a JIRA to track role-based access control on user names?

[prabhjyotsingh]

I think a part of this problem is solved by #993 (ZEPPELIN-987). But, yes I agree this has scope for improvising.

Will merge this if no more discussion.