Browse Source

[doc] Update LDAP config doc (#13507)

旺阳 2 years ago
parent
commit
0ee82c5492

+ 21 - 2
docs/configs/docsdev.js

@@ -381,8 +381,18 @@ export default {
                     },
                     {
                         title: 'Security',
-                        link: '/en-us/docs/dev/user_doc/guide/security.html',
+                        children: [
+                            {
+                                title: 'Security (Authorization System)',
+                                link: '/en-us/docs/dev/user_doc/guide/security/security.html',
+                            },
+                            {
+                                title: 'Authentication Type',
+                                link: '/en-us/docs/dev/user_doc/guide/security/authentication-type.html',
+                            }
+                        ],
                     },
+
                     {
                         title: 'Metrics',
                         children: [
@@ -1012,7 +1022,16 @@ export default {
                     },
                     {
                         title: '安全中心',
-                        link: '/zh-cn/docs/dev/user_doc/guide/security.html',
+                        children: [
+                            {
+                                title: '安全中心(权限系统)',
+                                link: '/zh-cn/docs/dev/user_doc/guide/security/security.html',
+                            },
+                            {
+                                title: '认证方式',
+                                link: '/zh-cn/docs/dev/user_doc/guide/security/authentication-type.html',
+                            }
+                        ],
                     },
                     {
                         title: '指标相关',

+ 3 - 2
docs/docs/en/architecture/configuration.md

@@ -248,8 +248,9 @@ Location: `api-server/conf/application.yaml`
 |security.authentication.ldap.base.dn|dc=example,dc=com|LDAP base dn|
 |security.authentication.ldap.username|cn=read-only-admin,dc=example,dc=com|LDAP username|
 |security.authentication.ldap.password|password|LDAP password|
-|security.authentication.ldap.user.identity.attribute|uid|LDAP user identity attribute|
-|security.authentication.ldap.user.email.attribute|mail|LDAP user email attribute|
+|security.authentication.ldap.user.identity-attribute|uid|LDAP user identity attribute|
+|security.authentication.ldap.user.email-attribute|mail|LDAP user email attribute|
+|security.authentication.ldap.user.not-exist-action|CREATE|action when ldap user is not exist,default value: CREATE. Optional values include(CREATE,DENY)|
 |traffic.control.global.switch|false|traffic control global switch|
 |traffic.control.max-global-qps-rate|300|global max request number per second|
 |traffic.control.tenant-switch|false|traffic control tenant switch|

+ 1 - 1
docs/docs/en/guide/expansion-reduction.md

@@ -115,7 +115,7 @@ workers="existing worker01:default,existing worker02:default,ds3:default,ds4:def
 
 ```
 
-- If the expansion is for worker nodes, you need to set the worker group, refer to the security of the [Worker grouping](./security.md)
+- If the expansion is for worker nodes, you need to set the worker group, refer to the security of the [Worker grouping](security/security.md)
 
 - On all new nodes, change the directory permissions so that the deployment user has access to the DolphinScheduler directory
 

+ 42 - 0
docs/docs/en/guide/security/authentication-type.md

@@ -0,0 +1,42 @@
+# Authentication Type
+
+* So far we support two authentication types, Apache DolphinScheduler password and LDAP.
+
+## Change Authentication Type
+
+> dolphinscheduler-api/src/main/resources/application.yaml
+
+```yaml
+security:
+  authentication:
+    # Authentication types (supported types: PASSWORD,LDAP)
+    type: PASSWORD
+    # IF you set type `LDAP`, below config will be effective
+    ldap:
+      # ldap server config
+      urls: ldap://ldap.forumsys.com:389/
+      base-dn: dc=example,dc=com
+      username: cn=read-only-admin,dc=example,dc=com
+      password: password
+      user:
+        # admin userId when you use LDAP login
+        admin: read-only-admin
+        identity-attribute: uid
+        email-attribute: mail
+        # action when ldap user is not exist (supported types: CREATE,DENY)
+        not-exist-action: CREATE
+```
+
+For detailed explanation of specific fields, please see: [Api-server related configuration](../../architecture/configuration.md)
+
+## LDAP Test
+
+We offer you a unit-test class while you can test the integration of DolphinScheduler with LDAP without running the service.
+
+> dolphinscheduler-api/src/test/java/org/apache/dolphinscheduler/api/security/impl/ldap/LdapServiceTest.java
+
+You can follow guide below:
+- Change`TestPropertySource`configuration to your LDAP information.
+- Change userId && userPwd to your information in the `ldapLogin` method.
+- Change the expected email to the return value you expect in the `ldapLogin` method.
+- Run`ldapLogin`method and determine whether the LDAP login result is expected.

+ 12 - 12
docs/docs/en/guide/security.md

@@ -9,7 +9,7 @@ Administrator login, default username/password: admin/dolphinscheduler123
 - The queue is used when executing programs such as spark and mapreduce, and the "queue" parameter needs to be used.
 - The administrator enters the `Security Center->Queue Management` page and clicks the "Create Queue" button to create a new queue.
 
-![create-queue](../../../img/new_ui/dev/security/create-queue.png)
+![create-queue](../../../../img/new_ui/dev/security/create-queue.png)
 
 ## Add Tenant
 
@@ -17,7 +17,7 @@ Administrator login, default username/password: admin/dolphinscheduler123
 - Tenant Code: **The tenant code is the user on Linux, unique and cannot be repeated**
 - The administrator enters the `Security Center->Tenant Management` page, and clicks the `Create Tenant` button to create a tenant.
 
-![create-tenant](../../../img/new_ui/dev/security/create-tenant.png)
+![create-tenant](../../../../img/new_ui/dev/security/create-tenant.png)
 
 ## Create Normal User
 
@@ -29,7 +29,7 @@ Users are divided into **administrator users** and **ordinary users**
 
 Go to the `Security Center -> User Management` page and click the `Create User` button to create a user, administrator only.
 
-![create-user](../../../img/new_ui/dev/security/create-user.png)
+![create-user](../../../../img/new_ui/dev/security/create-user.png)
 
 ### Edit user information
 
@@ -49,7 +49,7 @@ The alarm group is a parameter set at startup. After the process ends, the statu
 
 The administrator enters the `Security Center -> Alarm Group Management` page and clicks the `Create Alarm Group` button to create an alarm group.
 
-![create-alarmInstance](../../../img/new_ui/dev/security/create-alarmInstance.png)
+![create-alarmInstance](../../../../img/new_ui/dev/security/create-alarmInstance.png)
 
 ## Token Management
 
@@ -57,7 +57,7 @@ Since the back-end interface has a login check, token management provides a way
 
 The administrator enters the `Security Center -> Token Management page`, clicks the `Create Token` button, selects the expiration time and user, clicks the `Generate Token` button, and clicks the `Submit` button, then create the selected user's token successfully.
 
-![create-token](../../../img/new_ui/dev/security/create-token.png)
+![create-token](../../../../img/new_ui/dev/security/create-token.png)
 
 After a normal user logs in, click the user information in the username drop-down box, enter the token management page, select the expiration time, click the `Generate Token` button, and click the `Submit` button, then the user creates a token successfully.
 
@@ -104,15 +104,15 @@ public  void doPOSTParam()throws Exception{
 * Note: For projects created by the user, the user has all permissions. Therefore, permission changes to projects created by users themselves are not valid.
 - The administrator enters the `Security Center -> User Management` page, and clicks the "Authorize" button of the user to be authorized, as shown in the following figure:
 
-![project-authroize-step-1](../../../img/new_ui/dev/security/project-authroize-step-1.png)
+![project-authroize-step-1](../../../../img/new_ui/dev/security/project-authroize-step-1.png)
 
 - Select one or more projects and click the button above to authorize the project. The upper buttons from left to right correspond to `revoke all permissions`, `grant read permissions`, and `grant all permissions` (which including both read and write permissions).
 
-![project-authroize-step-2](../../../img/new_ui/dev/security/project-authroize-step-2.png)
+![project-authroize-step-2](../../../../img/new_ui/dev/security/project-authroize-step-2.png)
 
 - If a user has only the read permission but not the write permission for a project, and the user is trying to do something like delete or update the project, an error message is displayed indicating that the user has no write permission and cannot complete the operation.
 
-![no-permission-error](../../../img/new_ui/dev/security/no-permission-error.png)
+![no-permission-error](../../../../img/new_ui/dev/security/no-permission-error.png)
 
 - Resources, data sources, and UDF function authorization are the same as project authorization.
 
@@ -151,13 +151,13 @@ worker:
 
 The environment configuration is equivalent to the configuration in the `dolphinscheduler_env.sh` file.
 
-![create-environment](../../../img/new_ui/dev/security/create-environment.png)
+![create-environment](../../../../img/new_ui/dev/security/create-environment.png)
 
 ### Usage environment
 
 Create a task node in the workflow definition, select the worker group and the environment corresponding to the worker group. When executing the task, the Worker will execute the environment first before executing the task.
 
-![use-environment](../../../img/new_ui/dev/security/use-environment.png)
+![use-environment](../../../../img/new_ui/dev/security/use-environment.png)
 
 > NOTE: Please make sure you have associated the `Environments` with your `worker groups` if you can not select the `Environment Name` in workflow definition page or when triggering workflows.
 
@@ -169,7 +169,7 @@ Create a task node in the workflow definition, select the worker group and the e
 > Usage cluster
 > - After creation and authorization, k8s namespaces and processes will associate clusters. Each cluster will have separate workflows and task instances running independently.
 
-![create-cluster](../../../img/new_ui/dev/security/create-cluster.png)
+![create-cluster](../../../../img/new_ui/dev/security/create-cluster.png)
 
 ## Namespace Management
 
@@ -181,5 +181,5 @@ Create a task node in the workflow definition, select the worker group and the e
 
 - After creation and authorization, you can select it from the namespace drop down list when edit k8s task, If the k8s cluster name is `ds_null_k8s` means test mode which will not operate the cluster actually.
 
-![create-environment](../../../img/new_ui/dev/security/create-namespace.png)
+![create-environment](../../../../img/new_ui/dev/security/create-namespace.png)
 

+ 1 - 1
docs/docs/en/guide/task/kubeflow.md

@@ -56,7 +56,7 @@ spec:
 
 **Configure Kubernetes environment**
 
-Reference [Cluster Management and Namespace Management](../security.md).
+Reference [Cluster Management and Namespace Management](../security/security.md).
 
 Only the required fields need to be filled in, and the others do not need to be filled in. The resource management depends on the YAML file definition in the specific Job.
 

+ 3 - 2
docs/docs/zh/architecture/configuration.md

@@ -244,8 +244,9 @@ common.properties配置文件目前主要是配置hadoop/s3/yarn/applicationId
 |security.authentication.ldap.base.dn|dc=example,dc=com|LDAP base dn|
 |security.authentication.ldap.username|cn=read-only-admin,dc=example,dc=com|LDAP账号|
 |security.authentication.ldap.password|password|LDAP密码|
-|security.authentication.ldap.user.identity.attribute|uid|LDAP用户身份标识字段名|
-|security.authentication.ldap.user.email.attribute|mail|LDAP邮箱字段名|
+|security.authentication.ldap.user.identity-attribute|uid|LDAP用户身份标识字段名|
+|security.authentication.ldap.user.email-attribute|mail|LDAP邮箱字段名|
+|security.authentication.ldap.user.not-exist-action|CREATE|当通过LDAP登陆时用户不存在的操作,默认值是: CREATE,可选值:CREATE、DENY|
 |traffic.control.global.switch|false|流量控制全局开关|
 |traffic.control.max-global-qps-rate|300|全局最大请求数/秒|
 |traffic.control.tenant-switch|false|流量控制租户开关|

+ 1 - 1
docs/docs/zh/guide/expansion-reduction.md

@@ -117,7 +117,7 @@ workers="现有worker01:default,现有worker02:default,ds3:default,ds4:default"
 
 ```
 
-- 如果扩容的是worker节点,需要设置worker分组.请参考安全中心[创建worker分组](./security.md)
+- 如果扩容的是worker节点,需要设置worker分组.请参考安全中心[创建worker分组](security/security.md)
 
 - 在所有的新增节点上,修改目录权限,使得部署用户对dolphinscheduler目录有操作权限
 

+ 42 - 0
docs/docs/zh/guide/security/authentication-type.md

@@ -0,0 +1,42 @@
+# 认证方式
+
+* 目前我们支持两种认证方式,Apache DolphinScheduler自身账号密码登录和LDAP。
+
+## 修改认证方式
+
+> dolphinscheduler-api/src/main/resources/application.yaml
+
+```yaml
+security:
+  authentication:
+    # Authentication types (supported types: PASSWORD,LDAP)
+    type: PASSWORD
+    # IF you set type `LDAP`, below config will be effective
+    ldap:
+      # ldap server config
+      urls: ldap://ldap.forumsys.com:389/
+      base-dn: dc=example,dc=com
+      username: cn=read-only-admin,dc=example,dc=com
+      password: password
+      user:
+        # admin userId when you use LDAP login
+        admin: read-only-admin
+        identity-attribute: uid
+        email-attribute: mail
+        # action when ldap user is not exist (supported types: CREATE,DENY)
+        not-exist-action: CREATE
+```
+
+具体字段解释详见:[Api-server相关配置](../../architecture/configuration.md)
+
+## LDAP测试
+
+我们提供了一个单元测试类,可以在不启动项目的情况下测试DolphinScheduler与LDAP的集成。
+
+> dolphinscheduler-api/src/test/java/org/apache/dolphinscheduler/api/security/impl/ldap/LdapServiceTest.java
+
+使用步骤如下:
+- 修改`TestPropertySource`配置参数为你的LDAP信息;
+- 修改`ldapLogin`方法中的userId和userPwd为你的账号密码;
+- 修改`ldapLogin`方法中的expected email为正常登陆的返回值;
+- 执行`ldapLogin`方法,判断LDAP登陆结果是否为预期;

+ 12 - 12
docs/docs/zh/guide/security.md

@@ -8,7 +8,7 @@
 - 队列是在执行 spark、mapreduce 等程序,需要用到“队列”参数时使用的。
 - 管理员进入安全中心 -> 队列管理页面,点击“创建队列”按钮,创建队列。
 
-![create-queue](../../../img/new_ui/dev/security/create-queue.png)
+![create-queue](../../../../img/new_ui/dev/security/create-queue.png)
 
 ## 添加租户
 
@@ -16,7 +16,7 @@
 - 租户编码:**租户编码是 Linux上 的用户,唯一,不能重复**
 - 管理员进入安全中心->租户管理页面,点击“创建租户”按钮,创建租户。
 
-![create-tenant](../../../img/new_ui/dev/security/create-tenant.png)
+![create-tenant](../../../../img/new_ui/dev/security/create-tenant.png)
 
 ## 创建普通用户
 
@@ -26,7 +26,7 @@
   * 注意:如果该用户切换了租户,则该用户所在租户下所有资源将复制到切换的新租户下。
 - 进入安全中心->用户管理页面,点击“创建用户”按钮,创建用户。
 
-![create-user](../../../img/new_ui/dev/security/create-user.png)
+![create-user](../../../../img/new_ui/dev/security/create-user.png)
 
 ### 编辑用户信息
 
@@ -43,14 +43,14 @@
 * 告警组是在启动时设置的参数,在流程结束以后会将流程的状态和其他信息以邮件形式发送给告警组。
 * 管理员进入安全中心->告警组管理页面,点击“创建告警组”按钮,创建告警组。
 
-![create-alarmInstance](../../../img/new_ui/dev/security/create-alarmInstance.png)
+![create-alarmInstance](../../../../img/new_ui/dev/security/create-alarmInstance.png)
 
 ## 令牌管理
 
 > 由于后端接口有登录检查,令牌管理提供了一种可以通过调用接口的方式对系统进行各种操作。
 > - 管理员进入安全中心->令牌管理页面,点击“创建令牌”按钮,选择失效时间与用户,点击"生成令牌"按钮,点击"提交"按钮,则选择用户的token创建成功。
 
-![create-token](../../../img/new_ui/dev/security/create-token.png)
+![create-token](../../../../img/new_ui/dev/security/create-token.png)
 
 - 普通用户登录后,点击用户名下拉框中的用户信息,进入令牌管理页面,选择失效时间,点击"生成令牌"按钮,点击"提交"按钮,则该用户创建 token 成功。
 
@@ -98,15 +98,15 @@
 * 注意:对于用户自己创建的项目,该用户默认拥有所有的权限,因此对用户自己创建的项目进行权限变更是无效的。
 - 管理员进入`安全中心->用户管理页面`,点击需授权用户的“授权”按钮,如下图所示:
 
-![project-authroize-step-1](../../../img/new_ui/dev/security/project-authroize-step-1.png)
+![project-authroize-step-1](../../../../img/new_ui/dev/security/project-authroize-step-1.png)
 
 - 勾选单个或多个项目,再点击上方授权按钮进行项目授权。上方按钮从左至右分别对应着`撤销所有权限`,`授予读权限`和`授予所有权限`(包括读权限和写权限)。
 
-![project-authroize-step-2](../../../img/new_ui/dev/security/project-authroize-step-2.png)
+![project-authroize-step-2](../../../../img/new_ui/dev/security/project-authroize-step-2.png)
 
 - 如果用户对某个项目只拥有读权限而没有写权限,则在执行删除项目或更新项目等操作时,会返回错误提示,提示用户没有写权限,无法完成该操作。
 
-![no-permission-error](../../../img/new_ui/dev/security/no-permission-error.png)
+![no-permission-error](../../../../img/new_ui/dev/security/no-permission-error.png)
 
 - 资源、数据源、UDF 函数授权同项目授权。
 
@@ -146,13 +146,13 @@ worker:
 
 - 环境配置等价于dolphinscheduler_env.sh文件内配置
 
-![create-environment](../../../img/new_ui/dev/security/create-environment.png)
+![create-environment](../../../../img/new_ui/dev/security/create-environment.png)
 
 > 使用环境
 
 - 在工作流定义中创建任务节点选择 worker 分组和 worker 分组对应的环境,任务执行时 worker 会先执行环境在执行任务.
 
-![use-environment](../../../img/new_ui/dev/security/use-environment.png)
+![use-environment](../../../../img/new_ui/dev/security/use-environment.png)
 
 > 注意: 当无法在任务定义或工作流运行对话框中使用你想要使用的环境时,请检查您已经选择worker,并且您要使用的环境已经关联到您选择的worker中
 
@@ -166,7 +166,7 @@ worker:
 
 - 创建和授权后,k8s命名空间和工作流会增加关联集群的功能。每一个集群会有独立的工作流和任务实例独立运行。
 
-![create-cluster](../../../img/new_ui/dev/security/create-cluster.png)
+![create-cluster](../../../../img/new_ui/dev/security/create-cluster.png)
 
 ## 命名空间管理
 
@@ -178,4 +178,4 @@ worker:
 
 - 创建和授权后,在相关k8s任务选择命名空间时下拉可选,如果k8s集群名字是`ds_null_k8s`是测试模式,不会真正操作集群.
 
-![create-environment](../../../img/new_ui/dev/security/create-namespace.png)
+![create-environment](../../../../img/new_ui/dev/security/create-namespace.png)

+ 1 - 1
docs/docs/zh/guide/task/kubeflow.md

@@ -54,7 +54,7 @@ spec:
 
 **配置Kubernetes环境**
 
-参考[集群管理和命名空间管理](../security.md)。
+参考[集群管理和命名空间管理](../security/security.md)。
 
 只需填写必填项即可,其他无需填写,资源管理依赖于具体Job中的YAML文件定义。
 

+ 0 - 6
dolphinscheduler-api/src/test/java/org/apache/dolphinscheduler/api/security/impl/ldap/LdapServiceTest.java

@@ -68,16 +68,10 @@ public class LdapServiceTest {
     public void ldapLogin() {
         String email = ldapService.ldapLogin("tesla", "password");
         Assertions.assertEquals("tesla@ldap.forumsys.com", email);
-
-        String email2 = ldapService.ldapLogin("tesla", "error password");
-        Assertions.assertNull(email2);
     }
 
     @Test
     public void ldapLoginError() {
-        String email = ldapService.ldapLogin("tesla", "password");
-        Assertions.assertEquals("tesla@ldap.forumsys.com", email);
-
         String email2 = ldapService.ldapLogin("tesla", "error password");
         Assertions.assertNull(email2);
     }