How Can I enable SSO login to Apache Zeppelin on AWS EMR

Question

I created a AWS EMR Cluster using (http://docs.aws.amazon.com/emr/latest/ReleaseGuide/emr-spark-launch.html, I chose the application - "Spark: Spark 2.1.0 on Hadoop 2.7.3 YARN with Ganglia 3.7.2 and Zeppelin 0.7.0 while creating the cluster") and I am able to access Apache Zeppelin.

Now I want to give Zeppelin access to a new user using their Gmail or Google SSO or any other login. How can do this? Please point me to any documentation or steps.

*The SAML /SSO logins give access only to AWS console but not the application like Zeppelin which is hosted on the master node.

Answer 1

Zeppelin uses

• Apache Shiro

and there are some libraries and examples to use oauth in shiro.

• shiro-oauth
• Oauth2Relam.java
• pac4j security library for Shiro: OAuth, CAS, SAML, OpenID Connect, LDAP, JWT...

But Zeppelin doens't support oauth extensions currently (0.8.0-SNAPSHOT) as far as i know. You might extend Zeppelin by yourself.

• Docs: Zeppelin Shiro Configuration for Relam

Answer 2

Single sign-on can be implemented using Apache Knox. KnoxSSO support is recently added to Zeppelin.

For configuration options check out this link