NIfi and Nifi Registry Integration

Question

I have 3 nodes NiFi and 1 node Registry instances running.

Registry - SSL enabled and AD-integrated

NIfi - SSL enabled and AD-integrated

how can I integrate NiFI with Registry, so I can start using Registry.

@MattWho please advice for any recommendations

MattWho · Accepted Answer

@RB764

@ckumar is correct that what is failing here is a mutual TLS handshake.
"PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target"
Above is telling you that one side or the other of this TLS connection is unable to establish trust for the certificate presented during the handshake. The "PrivateKeyEntry" from the keystore file is being presented and the "trustedCertEntry"s from the truststore file are being used to verify trust for that certificate.

In order to establish trust, the complete trust chain needs to be in your truststore files.
Your PrivateKeyEntry will have an owner and an issuer. The issuer is the signer of the certificate.
That issuer will have its own public key (TrustedCertEntry) in the truststore files. That issuer public key will also have an owner and an issuer. If the issuer DN is not the same as the owner DN, then it is an intermediate CA. So again you would need the public key for the issuer of that intermediate Public key. Once you reach the point in the trust chain where the public key owner and issuer are the same DN, then you have the complete trust chain.

You can use openssl command to get the complete trustchain in most scenarios.

openssl s_client -connect <nifi-hostname>:<nifi port> -showcerts

openssl s_client -connect <nifi-regsitry-hostname>:<nifi-registry port> -showcerts

The certs will be returned in the format of:

-----BEGIN CERTIFICATE-----
MIIFljCCA36gAwIBAgINAgO...
-----END CERTIFICATE-----

You can copy each and save it is a .pem file and import those that are missing in to your truststore files.

If NiFi-registry is secured, then NiFi will need to be secured to talk to use it.
If NiFi is secured, it is optional to secure NiFi-Registry. (You can add a http nifi-registry client in NiFi)

If you found the information provided by anyone was helpful with your query, please take a moment to login and click "Accept" on every response that helped you to a solution.

Matt

MattWho · Answer

Hello @Former Member

Now that you have both NiFi and NiFi-Registry secured they will use TLS to authenticate with one another. NiFi-Registry does not initiate any connections to NiFi. NiFi will always act as the client talking to NiFi-Registry.

1. All 3 of your NiFi nodes must exist as users in the NiFi-Registry.
2. Any users who will be version controlling NiFi process Groups will need to exist as users in NiFi-Registry.
3. Your NiFi nodes must be authorized in NiFi-Registry for "Can proxy user requests" and read for "can manage buckets". Found by clicking on settings in NiFi-Regsitry UI, then selecting Users tab, and clicking pencil to right of each of your NiFi nodes.
4. You users must create a bucket(s) in NiFi-Registry and authorize your NiFi user(s) for read, write, delete on the bucket. From same setting UI click buckets tab, click "add bucket" then using pencil to left of bucket authorize your user(s).
5. From the NiFi UI, click on the global menu (upper right corner) --> Controller Settings --> Registry Clients tab. Click the "+" icon to add a new NiFi-Registry client. Provide the HTTPS://<nifi-regsitry-hostname:port> as the URL and a name of your choosing.

Provide the keystores and truststores created for your NiFi and NiFi-Registry can support mutual authentication between these two services, you will be good to go. Otherwise check your nifi and nifi-registry app logs for any TLS handshake errors which would need to be resolved.

Hope this helps you get going with NiFi-Registry,

Sign up

Please use your Cloudera account.

Login to the community

Please use your Cloudera account.