how to use StandardOauth2AccessTokenProvider 2.0.0-M4 & InvokeHTTP 2.0.0-M4 for Nifi Rest API

@Shrink 

Not sure why you would want to "control processors" within dataflows in NiFi.  This is not typically a good design choice.

From the image shared, I see the NiFi URL is "http" and not "https".  If your have you NiFi setup unsecured (HTTP), no NiFi authentication is going to be used even if setup in the NiFi core configuration files.    If your NiFi was secured (HTTPS), you would still need a StandardRestrictedSSLContextService to at least provide a truststore that contained the complete trust chain for the ServerAuth certificate used in the NiFi nifi.properties keystore to establish the 1-way TLS connection before you would be able to redirect to the oauth2 endpoint to get a token.  The other issue is you are not fetching a token from your oauth2 provider, but rather trying to fetch a token from whichever NiFi login provider you have configured.  That is because the "rest-api/access/token" endpoint is used for the NiFi login providers (ldap-provider or kerberos-provider).

When I use InvokeHTTP processor to access NiFI's rest-api, i always use MutualTLS authentication.  I find it the easiest because you don't need to worry about managing tokens or fetching new tokens each time the expire. 

To support mutualTLS authentication, a StandardRestrictedSSLContextService would need to be used in the InvokeHTTP processor and Your NiFi would need to be secured (HTTPS).  Your secured NiFi will have a keystore and truststore setup in nifi.properties file.   NiFi out-of-the-box will generate generic self-signed keystore and truststore files for you. I strongly encourage you to use properly signed certificates in production.  

Simplest approach to set this up is to simply use the same keystore and truststore from the nifi.properties in the StandardRestrictedSSLContextService you'll use with the invokeHTTP processor.  You'll need to make sure that the NiFi ClientAuth certificate DN from the keytsore is properly authorized for the NiFi rest-api endpoints you want to use (this of course also means you are NOT using the out-of-the-box single-user-authorizer and instead using an authorizer that allows you manage user authorizations manually like the StandardManagedAuthorizer.)

NOTE: the Apache NiFi 2.0.0 releases where tech preview.  NiFi 2.1+ are the official releases of the new 2.x line.  2.0.0-M4was last TP release, so it is going to be pretty close to the first GA release.

Please help our community grow. If you found any of the suggestions/solutions provided helped you with solving your issue or answering your question, please take a moment to login and click "Accept as Solution" on one or more of them that helped.

Thank you,
Matt

Thanks @MattWho for detailed replay. 

There are few set of processes which required to active only if those are required by another processes which is a rare event, but important run those on time. 
If i removed all credentials and methods to access it with "http". If goes to No retry. Below is the InvokeHTTP configuration
 

Next i try with StandardRestrictedSSLContextService. 
I use details from nifi.properties to configure service.

use same details to configure service 

but it is till goes to No retry. 
Here URL is ="https://localhost:8443/nifi-api/flow/process-groups/11d11155-1f75-15c9-4802-91f2b21aec2e"
and passing payload ={"id":"11d11156-1f75-15c9-6843-a34f61aff12d","state":"RUNNING"}

Please do share if you have any working example link

Thank you.