Extract Username In NIFI

@ushasri 

NiFi does not provide a local provider for user authentication via username and password.  NiFI supports numerous authentication methods you can configure.
- Authentication via a mutual TLS exchange:  Always enabled once NiFi is secured and the first method always attempted.  Mutual TLS is how NiFi nodes authenticate with one another, how Secured NiFi authenticates to other secured NiFis, how secured NiFi authenticates with secured NiFi-Registry, etc....
- Spnego: Kerberos authentication method that does not require users to provide a kerberos principal and password for authentication.  

- Kerberos-provider: Requires user to provide username and password for authentication.  Successful authentication results in a bearer token issued to user and a corresponding NiFi side server token for the user.

- Ldap-provider: Requires user to provide username and password for authentication.  Successful authentication results in a bearer token issued to user and a corresponding NiFi side server token for the user.

- OpenID connect

- SAML

In a multi-node NiFi cluster, the authentication process and resulting bearer token is only valid for the node on which the authentication was verified.  Can't be used to authenticate with another node.  Issued bearer tokens have an expiration.  Default is 12 hours at which time the NiFi server removes the server side token.  This forces user to re-authenticate and obtain a new client bearer token.

Every action that a user performs via NiFi's UI must be both authenticated and authorized.  This mean that the user must authenticate via a certificate, bearer token, etc. with every request. The authenticated client user identity is then used to verify that the user/client is authorized to perform the requested operation or access the requested endpoint (such as loading the NiFi UI).

Whenever a user authenticates within a NiFi instance, that NiFi instance will produce a log entry in the nifi-user.log with the authenticated user's user identity.  Subsequent to that is the requested endpoint that user is trying to access and result of that authorization.

NOTE: Components added to the NiFi canvas by a user are not executed as that user. all components are executed by the NiFi service user.

Adding the username to a FlowFile attribute becomes challenging since the nothing in the NiFi canvas executes as that user.  Also running any kind of automation within the UI to make a rest-api call to NiFi would itself require user authentication and authorization.

The question here is what are you trying to accomplish by extracting a username and adding it to a database? Guess you could create a dataflow that reads the nifi-user.log and extracts authentication related log lines, although, this would be very noisy since a single user who has obtained a bearer token for 12 hours may perform an unknown number of operations within the UI  or via rest-api calls each resulting in logging about authentication.

If you found that the provided solution(s) assisted you with your query, please take a moment to login and click Accept as Solution below each response that helped.

Thank you,

Matt

Dears,

We are login into nifi using URL by giving Username and password in the web browser itself.

So,our question is we need to extract that username and loaded that username (ex:Admin) in database column using nifi flow.

Could you please suggest any approach if available through nifi.

Thank you.

Hi Dears,

Will you please let me know where  we can  find  nifi-user.log file for tail?

Thank you.