Masking Of Token in Nifi

Is the problem with anonymous user, or with other logged-in users? 

If it's only with anonymous I would suggest you: Enable User-authorization and policies and restrict the policies, that only allowed users can access you ProcessGroup. 

@midee 

You are using an InvokeHTTP processor to hit the rest-api endpoint of some authentication service to obtain a JWT Token, correct?

The invokeHTTP processor gives you only two options for handling the response from the endpoint.  Placed it in the content of the FlowFile or in to an attribute of the FlowFile.  This means that any user who has been granted authorization to view the data of any component that this FlowFile will traverse can see the attributes and content of this FlowFile.

There is no capability for the invokeHTTP to encrypt/mask the endpoint response in either options.  Even if there was, this now masked/encrypted data would no longer be usable by downstream components.  I suspect your plan is to then use this token to make additional requests to other endpoints later in your flow?  Also keep in mind that a token generally has a limited lifespan.  You should also have the ability to invalidate the token via another endpoint when you are done with it. 

So your options here are:
1. Limit user's access so they can not view the data in the dataflows that utilize this token so that they can't see the token in the content or attributes.  If you are building the flow, then you know how to get the token so does not matter that you can see the token via the attributes or content.
2. Invalidate the token once done with it. Token can't be used anymore even if a user gained access to it later via looking at the content or attributes of a FlowFile.  So you may consider building yoru flow to get a token --> use that token for other actions --> invalidate token (Using NiFi login authentication as a JWT token example, you hit the logout endpoint to invalidate the token on the server side. This means the client token will no longer work even if you have it still).  Of course this means you flow needs to obtain a new token every time it runs.  Issue here is if your flow utilizes same token for multiple FlowFiles.  First FlowFile that hist logout will invalidate token other FlowFiles may try to still use.  

Note that the default life of a token issued by NiFi is 12 hours.  After that the client token can't be used anymore and a new token would need to be obtained anyway (of course this age can be adjusted via the NiFi login provider configuration)

If you found this answered your query, please take a moment to login and click "Accept" on the solutions that assisted you.

Thank you,

Matt