@yagoaparecidoti
If you are using ldap-provider for authentication, you should preferably be using your ldap users and groups for authorization using the ldap-user-group-provider rather then needing to manage those user identities and group identities manually in NiFi via the file-user-user-group-provider.
When new users are added or removed in ldap, new groups created or removed in ldap, or new group membership are added in LDAP, this all automatically resync in NiFi. And if you do all your Authorization through ldap groups, this management becomes automatic with little effort on your side except when needing to setup an all new group authorization.
Fetching a token for your ldap user who is authorized to view and modify user and groups:
curl 'https://<nifi-hostname>:<nifi-port>/nifi-api/access/token' \
-H 'Content-Type: application/x-www-form-urlencoded; charset=UTF-8' \
--data-raw 'username=<username>&password=<password>' \
--insecure
This will return a Bearer Token that is only valid for the expiration period configured in your ldap-provider (default: 12 hours). Replace $TOKEN with this response token string you got from above command in the rest of the examples.
Example command to add a new group:
curl 'https://<nifi-hostname>:<nifi-port>/nifi-api/tenants/user-groups' \
-H 'Authorization: Bearer $TOKEN' \
-H 'Content-Type: application/json' \
--data-raw '{"revision":{"clientId":"f06dc8a3-0190-1000-f61c-a511bdac0cf1","version":0},"disconnectedNodeAcknowledged":false,"component":{"identity":"newgroup2","users":[]}}' \
--insecure
In the response you will get the UUID assigned to this new group.
Example: f07dcb3f-0190-1000-0000-00003f3139fe
Example command to add new user:
curl 'https://<nifi-hostname>:<nifi-port>/nifi-api/tenants/users' \
-H 'Content-Type: application/json' \
-H 'Authorization: Bearer $TOKEN \
--data-raw '{"revision":{"clientId":"f06dc8a3-0190-1000-f61c-a511bdac0cf1","version":0},"disconnectedNodeAcknowledged":false,"component":{"identity":"newuser3"}}' \
--insecure
In the response you will get the UUID of the new user.
Example: f089d520-0190-1000-ffff-ffffd5c79edc
Before you can add a user to the group, you need to get a list all user currently part of group.
curl 'https://<nifi-hostname>:<nifi-port>/nifi-api/tenants/user-groups' \
-H 'Authorization: Bearer $TOKEN' \
--insecure
You can parse the response json by group name or the group uuid.
With the json for the group you will find the current users and their assigned uuids
You'll need all those current user uuids and the uuid of the user(s) you want to add to the group.
curl 'https://<nifi-hostname>:<nifi-port>/nifi-api/tenants/user-groups/f07dcb3f-0190-1000-0000-00003f3139fe' \
-X 'PUT' \
-H 'Authorization: Bearer $TOKEN' \
-H 'Content-Type: application/json' \
--data-raw '{"revision":{"clientId":"f06dc8a3-0190-1000-f61c-a511bdac0cf1","version":4},"disconnectedNodeAcknowledged":false,"component":{"id":"f07dcb3f-0190-1000-0000-00003f3139fe","identity":"newgroup2","configurable":true,"users":[{"id":"f083ef9d-0190-1000-ffff-ffffa9456011"},{"id":"f089d520-0190-1000-ffff-ffffd5c79edc"},{"id":"350a48fc-018f-1000-0000-000018f120ca"}],"accessPolicies":[]}}' \
--insecure
You should be able to add users at same time as you create a new group. But that is not very common. It is more common to add new users and associate them with already existing groups, hence the example provided above. You can see in the new group example i have that the payload will accept user ids.
Please help our community thrive. If you found any of the suggestions/solutions provided helped you with solving your issue or answering your question, please take a moment to login and click "Accept as Solution" on one or more of them that helped.
Thank you,
Matt
