Skip to main content
theKiteRunner
theKiteRunner
Bronze ⭐️⭐️⭐️
July 24, 2023
Question

Azure AD based authentication for Nifi rest API

Hi,

 

I was trying to enable Azure AD based OIDC Authentication for Apache Nifi rest API when accessing from a daemon service. I registered the App in Azure AD and  generated a bearer token   and tried passing it to the nifi rest API, but got the following error

 

"Unauthorized error="invalid_token", error_description="An error occurred while attempting to decode the Jwt: Signed JWT rejected: Another algorithm expected, or no matching key(s) found", error_uri="https://tools.ietf.org/html/rfc6750#section-3.1"

 

The token was generated with the grant type as "client_credentials". Does NIFI OIDC implementation support this flow ? If yes why am I getting the error and how can I solve it? Thanks

3 replies

VidyaSargur
Community Manager
VidyaSargur
Community Manager
July 25, 2023

@theKiteRunner, Welcome to our community! To help you get the best possible answer, I have tagged in our NiFi experts @cotopaul @SAMSAL @steven-matison who may be able to assist you further.

Please feel free to provide any additional information or details about your query, and we hope that you will find a satisfactory solution to your question.

 

Translate
Regards, Vidya Sargur, Community Manager Was your question answered? Make sure to mark the answer as the accepted solution. If you find a reply useful, say thanks by clicking on the thumbs up button.
MattWho
Titanium ⭐️⭐️⭐️
MattWho
Titanium ⭐️⭐️⭐️
July 25, 2023

@theKiteRunner 
NiFi token based OIDC authentication generates a token that is only valid for the NiFi instance on which the token was obtained. There are really tow tokens in play here, the client token issued for the authenticating user stored with the browser and a corresponding server side token stored in NiFi. 
If you have a NiFi cluster setup with a load balancer in front of your cluster'sNiFi nodes, you'll need to make sure you have sticky sessions (also known as session persistence) setup in your load balancer.  So when you authenticate with NiFi node A and get a Client Token, the sticky sessions will make sure all follow-on request continue to route to node A instead of other nodes in the NiFi cluster.

It sounds like you obtained a user token directly from Azure AD without going through NiFi's URL or you don't have sticky sessions setup resulting in the subsequent request post Azure AD auth routing to a different NiFi node. This would result in the "no matching key(s) found" exception when client JWT token is sent to a NiFi node that does not have the corresponding server token. 
If the OIDC properties are configured correctly in NiFi, when you try to access the NiFi URL without a client token, it should redirect you to the the configured OIDC discovery URL. Once you authenticate, your browser obtains a client token and the NiFi node that redirected to your Azure AD OIDC URL will store the corresponding server side token.

If you found that the provided solution(s) assisted you with your query, please take a moment to login and click Accept as Solution below each response that helped.

Thank you,

Matt

Translate
    VVPeter
    VVPeter
    Silver ⭐️⭐️
    August 7, 2025

    Hi Matt,

    Just to clarify one point—specifically in the context of NiFi REST API 2.0+—is there an endpoint where we can exchange an Azure AD access token for a NiFi access token, similar to a token exchange flow?

    Or, if such a direct token exchange is not supported (i.e., the token must always be obtained via browser redirection to the NiFi URL), could you please confirm that this is indeed the case?

    Thanks in advance!

     

    Translate
    Terms & ConditionsAccessibility statement