Note Permission: If userName does not exist in the shiro.ini file, can't be saved!

zeppelin-server/src/main/java/org/apache/zeppelin/rest/NotebookRestApi.java

@@ -50,6 +50,7 @@
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
+import com.google.common.collect.Sets;
 import com.google.gson.Gson;
 import com.google.gson.reflect.TypeToken;
 import com.google.gson.GsonBuilder;
@@ -99,6 +100,10 @@ String ownerPermissionError(Set<String> current,
             "Allowed owners: " + allowed.toString() + "\n\n" +
             "User belongs to: " + current.toString();
   }
+
+  String userNamePermissionError(String userName) throws IOException {
+    return "User： " + userName + " not Exists，Please Check ！";
+  }
 
   /**
    * set note authorization information
@@ -119,6 +124,14 @@ public Response putNotePermissions(@PathParam("noteId") String noteId, String re
             permMap.get("readers"),
             permMap.get("writers")
     );
+
+    String noExistUser = checkUser(permMap);
+
+    if (!"".equals(noExistUser)) {
+
+      return new JsonResponse<>(Status.FORBIDDEN, userNamePermissionError(noExistUser)).build();
+
+    }
 
     HashSet<String> userAndRoles = new HashSet<String>();
     userAndRoles.add(principal);
@@ -127,9 +140,29 @@ public Response putNotePermissions(@PathParam("noteId") String noteId, String re
       return new JsonResponse<>(Status.FORBIDDEN, ownerPermissionError(userAndRoles,
               notebookAuthorization.getOwners(noteId))).build();
     }
-    notebookAuthorization.setOwners(noteId, permMap.get("owners"));
-    notebookAuthorization.setReaders(noteId, permMap.get("readers"));
-    notebookAuthorization.setWriters(noteId, permMap.get("writers"));
+
+    HashSet readers = permMap.get("readers");
+    HashSet owners = permMap.get("owners");
+    HashSet writers = permMap.get("writers");
+    // Set readers, if writers and owners is empty -> set to user requesting the change
+    if (readers != null && !readers.isEmpty()) {
+      if (writers.isEmpty()) {
+        writers = Sets.newHashSet(SecurityUtils.getPrincipal());
+      }
+      if (owners.isEmpty()) {
+        owners = Sets.newHashSet(SecurityUtils.getPrincipal());
+      }
+    }
+    // Set writers, if owners is empty -> set to user requesting the change
+    if ( writers != null && !writers.isEmpty()) {
+      if (owners.isEmpty()) {
+        owners = Sets.newHashSet(SecurityUtils.getPrincipal());
+      }
+    }
+
+    notebookAuthorization.setReaders(noteId, readers);
+    notebookAuthorization.setWriters(noteId, writers);
+    notebookAuthorization.setOwners(noteId, owners);
     LOG.debug("After set permissions {} {} {}",
             notebookAuthorization.getOwners(noteId),
             notebookAuthorization.getReaders(noteId),
@@ -138,6 +171,37 @@ public Response putNotePermissions(@PathParam("noteId") String noteId, String re
     notebookServer.broadcastNote(note);
     return new JsonResponse<>(Status.OK).build();
   }
+
+  private static String checkUser(HashMap<String, HashSet> permMap) {
+
+    String userName = "";
+
+    HashSet<String> owners = permMap.get("owners");
+    HashSet<String> readers = permMap.get("readers");
+    HashSet<String> writers = permMap.get("writers");
+
+    HashSet<String> users = new HashSet<String>();
+    users.addAll(owners);
+    users.addAll(readers);
+    users.addAll(writers);
+
+    for (String tmpUser : users) {
+
+      if (!"*".equals(tmpUser)) {
+        if (!org.apache.zeppelin.utils.SecurityUtils.hasUser(tmpUser)) {
+
+          userName = tmpUser;
+
+          break;
+
+        }
+      }
+
+    }
+
+    return userName;
+
+  }
 
   /**
    * bind a setting to note
@@ -644,14 +708,29 @@ public Response getCronJob(@PathParam("notebookId") String notebookId) throws
   }  
 
   /**
-   * Search for a Notes
+   * Search for a Notes with permissions
    */
   @GET
   @Path("search")
   public Response search(@QueryParam("q") String queryTerm) {
     LOG.info("Searching notebooks for: {}", queryTerm);
+    String principal = SecurityUtils.getPrincipal();
+    HashSet<String> roles = SecurityUtils.getRoles();
+    HashSet<String> userAndRoles = new HashSet<String>();
+    userAndRoles.add(principal);
+    userAndRoles.addAll(roles);
     List<Map<String, String>> notebooksFound = notebookIndex.query(queryTerm);
-    LOG.info("{} notbooks found", notebooksFound.size());
+    for (int i = 0; i < notebooksFound.size(); i++) {
+      String[] Id = notebooksFound.get(i).get("id").split("/", 2);
+      String noteId = Id[0];
+      if (!notebookAuthorization.isOwner(noteId, userAndRoles) &&
+              !notebookAuthorization.isReader(noteId, userAndRoles) &&
+              !notebookAuthorization.isWriter(noteId, userAndRoles)) {
+        notebooksFound.remove(i);
+        i--;
+      }
+    }
+    LOG.info("{} notebooks found", notebooksFound.size());
     return new JsonResponse<>(Status.OK, notebooksFound).build();
   }
 

zeppelin-server/src/main/java/org/apache/zeppelin/utils/SecurityUtils.java

@@ -17,6 +17,10 @@
 package org.apache.zeppelin.utils;
 
 import org.apache.shiro.subject.Subject;
+import org.apache.shiro.realm.Realm;
+import org.apache.shiro.realm.SimpleAccountRealm;
+import org.apache.shiro.mgt.DefaultSecurityManager;
+import org.apache.shiro.mgt.SecurityManager;
 import org.apache.zeppelin.conf.ZeppelinConfiguration;
 
 import java.net.InetAddress;
@@ -25,6 +29,8 @@
 import java.net.UnknownHostException;
 import java.util.Arrays;
 import java.util.HashSet;
+import java.util.Iterator;
+import java.util.List;
 
 /**
  * Tools for securing Zeppelin
@@ -83,5 +89,51 @@ public static HashSet<String> getRoles() {
     }
     return roles;
   }
+
+  public static boolean hasUser(String userName) {
+
+    boolean state = false;
+
+    SecurityManager sm = (SecurityManager) org.apache.shiro.SecurityUtils.getSecurityManager();
+
+    DefaultSecurityManager defSecurityManager = null;
+    if (sm instanceof DefaultSecurityManager) {
+
+      defSecurityManager = (DefaultSecurityManager) sm;
+
+    } else {
+
+      return true;
+
+    }
+
+    List realms = (List) defSecurityManager.getRealms();
+
+    org.apache.shiro.realm.SimpleAccountRealm simpleRealm = null;
+    Iterator iter = realms.iterator();
+
+    while (iter.hasNext()) {
+
+      Realm realm = (Realm) iter.next();
+
+      if (realm instanceof SimpleAccountRealm) {
+
+        simpleRealm = (SimpleAccountRealm) realm;
+
+        break;
+
+      }
+
+    }
+
+    if (simpleRealm != null) {
+
+      state = simpleRealm.accountExists(userName);
+
+    }
+
+    return state;
+
+  }
 
 }