[ZEPPELIN-2796] Fetching LDAP roles

[herval]

What is this PR for?

This actually fetches the user's LDAP roles, when using the LdapRealm, so they're accessible on Zeppelin (via the SecurityUtils).

As I debugged through it, I found some weird replacement code, so I wrote some tests around the LdapRealm and fixed what I believe was wrong there. Eg.: expandTemplate would expand, for instance, uid={0} into uid={0}yourusername.

In order to make the actual LDAP calls for roles, I exposed the queryForAuthorizationInfo method and used it on SecurityUtils.

What type of PR is it?

Bug Fix / Improvement

What is the Jira issue?

https://issues.apache.org/jira/browse/ZEPPELIN-2796

How should this be tested?

I tested this in our LDAP environment. My shiro.ini looked more or less like this:

[main]
ldapRealm = org.apache.zeppelin.realm.LdapRealm
ldapRealm.contextFactory.url = ldap://ldap.foo
ldapRealm.contextFactory.authenticationMechanism = simple
ldapRealm.userDnTemplate = uid={0},cn=users,dc=ods,dc=foo
ldapRealm.searchBase = dc=ods,dc=foo,dc=corp
ldapRealm.userSearchBase = cn=users,dc=ods,dc=foo
ldapRealm.groupSearchBase = cn=groups,dc=ods,dc=foo
ldapRealm.authorizationEnabled = true
ldapRealm.groupObjectClass = posixGroup
ldapRealm.memberAttribute = memberUid
ldapRealm.userObjectClass = posixAccount
ldapRealm.memberOfAttribute = memberOf
ldapReal.groupSearchFilter = '(memberUid={0})'
securityManager.realms = $ldapRealm
sessionManager = org.apache.shiro.web.session.mgt.DefaultWebSessionManager
securityManager.sessionManager = $sessionManager
securityManager.sessionManager.globalSessionTimeout = 86400000
shiro.loginUrl = /api/login

[urls]
/api/version = anon
/api/metrics = anon
/api/interpreter/repository/** = authc
/api/configurations/** = authc
/api/credential/** = authc
/api/notebook-repositories = authc
# /** = anon
/** = authc

you can tell the role fetching worked inspecting the web call to /ticker, which will now return the full roles list

Screenshots (if appropriate)

Questions:

• Does the licenses files need update?
• Is there breaking changes for older versions?
• Does this needs documentation?

[herval]

Hi folks,

Any thoughts on this?

[herval]

Hi folks,

Please let me know if I should close this. Tks!

[Leemoonsoo]

Thanks @herval for the great contribution.

I'm not an expert on LDAP but it looks good to me while it includes test and passes CI.
If no further reviews from any other LDAP experienced people, i'll merge this to master.