apache / apache/hop

User-based Project Authorization in Hop Web

Open
#6,701 1 comment 0 reactions 0 assignees View on GitHub
awaiting triage Other P3
Dominant language
Java
Stars
1.5k
Forks
476
Avg merge
18h 32m
Merged PRs (30d)
216

Description

### What would you like to happen?

## [Feature Request]: User-based Project Authorization in Hop Web

### Problem / Motivation

Currently, Hop Web supports basic authentication via Tomcat's tomcat-users.xml (username + password), but all authenticated users share the same Hop environment and can see all available projects. There is no built-in mechanism to restrict which projects a specific user is allowed to access.

This is a significant limitation for teams and organizations that:
- Host a single shared Hop Web instance for multiple users or departments
- Need to isolate projects per team, client, or security boundary
- Want to avoid spinning up a separate Docker container per user/project just to enforce access control

### Proposed Solution

Add user-to-project authorization support in Hop Web, so that after a user authenticates (via Tomcat basic auth or any future auth provider), they only see and can access the projects they are explicitly authorized for.

This could be implemented as:

1. *A configuration file* (e.g. hop-web-users.xml or extending tomcat-users.xml) that maps users/roles to allowed project names.
2. *Role-based access*: define roles per project and assign users to those roles.
3. *UI enforcement*: after login, the Hop Web GUI only shows projects the authenticated user is permitted to open.

### Example configuration (conceptual)

xml


ahmet
admin


elif
admin

### Current Workaround

The only current workaround is running one Hop Web Docker container per project/user group on different ports, which is operationally expensive and hard to maintain.

### Additional Context

- Hop Web version: latest (2.16.0)
- Deployment: Docker (apache/hop-web)
- Related docs: https://hop.apache.org/manual/latest/hop-gui/hop-web.html

### Impact

This feature would make Hop Web significantly more viable as a shared, multi-tenant platform for enterprise and team use cases.

### Issue Priority

Priority: 1

### Issue Component

Component: Other

Contributor guide

Open the contributing guide

Research direction

Start with the Hop Web documentation at hop-gui/hop-web.html and the current Tomcat basic-auth setup using tomcat-users.xml. Define how user or role project mappings would be configured and enforced in the Hop Web UI. Done means authenticated users can only see and open projects they are authorized to access.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, java
Domain
authentication, authorization, web-dev
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.