CAS authentication with Shiro for Zeppelin - cas

Question

I am unsuccessfully trying to get the shiro.ini in Zeppelin to use cas.
I followed these instructions
http://shiro.apache.org/cas.html
casFilter = org.apache.shiro.cas.CasFilter
casFilter.failureUrl = /error.html
casRealm = org.apache.shiro.cas.CasRealm
casRealm.defaultRoles = USER
casRealm.casServerUrlPrefix = https://ticketserver.com
casRealm.casService = https://tickettranslater.com/j_spring_cas_security_check
casSubjectFactory = org.apache.shiro.cas.CasSubjectFactory
sessionManager = org.apache.shiro.web.session.mgt.DefaultWebSessionManager
securityManager.subjectFactory = $casSubjectFactory
securityManager.realms = $casRealm
### If caching of user is required then uncomment below lines
#cacheManager = org.apache.shiro.cache.MemoryConstrainedCacheManager
#securityManager.cacheManager = $cacheManager
securityManager.sessionManager = $sessionManager
# 86,400,000 milliseconds = 24 hour
#securityManager.sessionManager.globalSessionTimeout = 86400000
shiro.loginUrl = /api/login
[urls]
# anon means the access is anonymous.
# authcBasic means Basic Auth Security
# authc means Form based Auth Security
# To enfore security, comment the line below and uncomment the next one
/api/interpreter/** = authc, roles[USER]
/api/configurations/** = authc, roles[USER]
/api/credential/** = authc, roles[SOMEOTHER]
/api/login = casFilter
/** = authc
#/** = anon
#/** = authc
the casService is what should translate the ticket to a user.
the casServerUrlPrefix is where once gets the tickes.
If I put for shiro.loginUrl = https://ticketserver.com?service=https://tickettranslater.com/j_spring_cas_security_check
It works except for the fact that the Origin header gets los along the way and the login fails.
both tickeserver.com and tickertranslater are in the network and they work for plenty of other applications.
How do I set up the shiro.ini so the cas login chain is correctly handled?

Answer 1

This configuration works with Apache Zeppelin 0.6.2.
If you are already authenticated against a CAS server you will be authenticated automatically into Apache Zeppelin.
You need to compile zeppelin-web, but first is needed to add the shiro-cas Maven dependency to zeppelin-web/pom.xml:
<dependencies>
<dependency>
<groupId>org.apache.shiro</groupId>
<artifactId>shiro-cas</artifactId>
<version>1.2.3</version>
</dependency>
</dependencies>
Then configure the file conf/shiro.ini with this:
[main]
casFilter = org.apache.shiro.cas.CasFilter
casFilter.failureUrl = /404.html
casRealm = org.apache.shiro.cas.CasRealm
casRealm.defaultRoles = ROLE_USER
casRealm.casServerUrlPrefix = http://<cas-server>:<port>/cas/p3
casRealm.casService = http://localhost:8080/api/shiro-cas
casSubjectFactory = org.apache.shiro.cas.CasSubjectFactory
securityManager.subjectFactory = $casSubjectFactory
securityManager.realms = $casRealm
sessionManager = org.apache.shiro.web.session.mgt.DefaultWebSessionManager
securityManager.sessionManager = $sessionManager
securityManager.sessionManager.globalSessionTimeout = 86400000
[urls]
/api/shiro-cas = casFilter
/api/version = anon
/** = authc