Acceldata
 ODP
Search documentation… ⌘K

Obfuscating LDAP Bind Password for Zeppelin

Migrate the Zeppelin LDAP bind password from plain-text configuration to the Hadoop Credential Store (JCEKS) to comply with security best practices.

Scope

  • Zeppelin integrated with LDAP authentication
  • Ambari-managed Zeppelin
  • Hadoop Credential Provider (JCEKS)
  • Applies to clusters with LDAP-enabled Zeppelin UI

Prerequisites

  • Ambari LDAP must already be configured and obfuscated
  • Refer: ODP-5149 | Obfuscating LDAP password in Ambari
  • LDAP authentication validated for Ambari
  • Hadoop CLI available on Zeppelin host
  • Zeppelin service stopped/restarted as required

Step 1: Configure LDAP for Zeppelin (Baseline Setup)

Update the following configuration in Ambari UI:

Zeppelin → Configs → Advanced zeppelin-shiro-ini 

[main]
ldapRealm = org.apache.zeppelin.realm.LdapRealm
ldapRealm.contextFactory.url = ldaps://10.100.11.29:1636
ldapRealm.contextFactory.systemUsername = cn=admin,dc=acceldata,dc=ce
ldapRealm.contextFactory.systemPassword = passw0rd
ldapRealm.userDnTemplate = uid={0},ou=users,dc=acceldata,dc=ce
ldapRealm.contextFactory.environment[ldap.searchBase] = dc=acceldata,dc=ce
ldapRealm.contextFactory.authenticationMechanism = SIMPLE
ldapRealm.contextFactory.environment[java.naming.security.protocol] = ssl
ldapRealm.contextFactory.environment[java.naming.referral] = follow
securityManager.realms = $ldapRealm
sessionManager = org.apache.shiro.web.session.mgt.DefaultWebSessionManager
cacheManager = org.apache.shiro.cache.MemoryConstrainedCacheManager
securityManager.cacheManager = $cacheManager
cookie = org.apache.shiro.web.servlet.SimpleCookie
cookie.name = JSESSIONID
cookie.httpOnly = true
sessionManager.sessionIdCookie = $cookie
securityManager.sessionManager = $sessionManager
securityManager.sessionManager.globalSessionTimeout = 86400000
shiro.loginUrl = /api/login
[urls]
/api/version = anon
/** = authc
Restart Zeppelin and validate LDAP login using an LDAP user.

All LDAP users can log in to Zeppelin UI.
Since you added the password in plain text, you need to obfuscate this using Hadoop credentials.

Step 2: Obfuscate Zeppelin LDAP Bind Password

Step 2.1: Move Plain-text Password to JCEKS

Run the following commands on the Zeppelin host:

# Extract LDAP bind password from shiro.ini
LDAP_PASSWORD=$(grep "ldapRealm.contextFactory.systemPassword" /etc/zeppelin/conf/shiro.ini | grep -v "^#" | sed 's/.*= *//')
# Create credential in JCEKS
hadoop credential create zeppelin_ldap_pass \
-provider jceks://file/var/lib/zeppelin/zeppelin.jceks \
-value "$LDAP_PASSWORD"
# Secure the keystore
chown zeppelin:zeppelin /var/lib/zeppelin/zeppelin.jceks
chmod 600 /var/lib/zeppelin/zeppelin.jceks
# Verify alias creation
hadoop credential list -provider jceks://file/var/lib/zeppelin/zeppelin.jceks

Step 2.2: Reference JCEKS in Zeppelin Configuration

2.2.1 Set Credential Provider Path

Ambari → Zeppelin → Configs → Advanced zeppelin-env

Add at the end:

export HADOOP_CREDENTIAL_PROVIDER_PATH="jceks://file/var/lib/zeppelin/zeppelin.jceks"
2.2.2 Update zeppelin-shiro-ini
Replace the plain-text password with the credential alias:

ldapRealm.contextFactory.systemPassword = #{zeppelin_ldap_pass}

Step 3: Restart & Validation

ambari-server restart
(or restart Zeppelin service via Ambari UI)

Validation Steps

  • Log in to Zeppelin UI using LDAP users
  • Ensure no authentication errors in:
/var/log/zeppelin/zeppelin-server.log
  • Confirm no plain-text password exists in shiro.ini

The screenshot below is a reference to the users available to Zeppelin.

Preserved image

Outcome

  • LDAP bind password removed from plain-text configuration
  • Password securely stored in Hadoop Credential Store (JCEKS)
  • Zeppelin authentication continues to function as expected
  • Compliant with MSTP security hardening standards