Skip to main content
wbivp
wbivp
Gold ⭐️
September 1, 2021
Question

Nifi Failed authorization

Hi All,

 

I get the following issue when logging in to nifi UI , user success login but UI not showing NIFI Menu :
2021-09-01 13:24:02,942 INFO [NiFi Web Server-1911] o.a.n.w.a.c.AccessDeniedExceptionMapper identity[cdpadmindev@DOMAIN], groups[] does not have permission to access the requested resource. Unable to view the user interface. Returning Forbidden response.

 

I'm using cloudera private base with kerberos and AD

The NIFI configuration is still the default, is there anything that needs to be changed?

 

Thanks

 

WB

16 replies

Scharan
Gold ⭐️
Scharan
Gold ⭐️
September 1, 2021

@wbivp You need to create /proxy policy for Nifi in ranger, Refer to below document for more info

 

https://community.cloudera.com/t5/Community-Articles/NiFi-Ranger-based-policy-descriptions/ta-p/246586

https://docs.cloudera.com/HDPDocuments/HDP3/HDP-3.1.4/authorization-ranger/content/resource_policy_create_a_nifi_policy.html

Translate
wbivp
wbivpAuthor
Gold ⭐️
September 1, 2021

Hi @Scharan 
thanks for your response, we already have the policy in ranger by default :

wbivp_0-1630479549445.png

 

and i already assign our user and group to this policy , but still failed authorization

 

Translate
MattWho
Titanium ⭐️⭐️⭐️
MattWho
Titanium ⭐️⭐️⭐️
September 1, 2021

@wbivp 

Is the exact user string you see in the nifi-user.log the same (case sensitive)  as what is set in Ranger?
is this user string authorized for the /flow policy?

Thank you,

Matt

Translate
MattWho
Titanium ⭐️⭐️⭐️
MattWho
Titanium ⭐️⭐️⭐️
September 1, 2021

@wbivp 

The nifi-user.log output you shared indicates that the user string "cdpadmindev@DOMAIN" has not been authorized to against the NiFi /flow resource identifier (View the user interface). 

The authorizers.xml configuration file controls how user and/or group based authorizations are setup and managed.  So first things is what is configured in that file?

Is it using a file based authorizer or external Ranger based authorizer?
Is it using any user group providers?
Did you configure and initial admin identity?  if so, does that initial admin identity string exactly match your user string from the nifi-user.log you shared?

If using the file based authorizer, you should have in the authorizers.xml both the "file-user-group-provider" and the "file-access-policy-provider".   These providers are used to create the users.xml and authorizations.xml file on startup if they do NOT already exist.  so even if you do have the initial admin set correctly, if NiFi was started previously before the user string was set, you would have existing users.xml and authorizations.xml files without this user and the required admin policies set.  (remove these files and restart NiFi so they are generated again).

If using Ranger as your authorizer, you need to make sure that the user string exactly as you see in the nifi-user.log exists as a user in Ranger and the the NiFi service plugin in ranger is setup and has the correct NiFi resource identifier policies authorized for that user.  Here is a reference article on those Ranger based NiFi policies:
https://community.cloudera.com/t5/Community-Articles/NiFi-Ranger-based-policy-descriptions/ta-p/246586

If you found this response assisted with your query, please take a moment to login and click on "Accept as Solution" below this post.

Thank you,

Matt

Translate
wbivp
wbivpAuthor
Gold ⭐️
September 2, 2021

Hi @MattWho 

We using ranger authorizer , user string exactly same with nifi-user.log and ranger user 

below authorizers.xml content :

<authorizers>

<userGroupProvider>
<identifier>cm-user-group-provider</identifier>
<class>org.apache.nifi.authorization.CMUserGroupProvider</class>
<property name="Knox Nodes Properties Location">/var/run/cloudera-scm-agent/process/1546339122-nifi-NIFI_NODE/knox-conf/knox-gateway.properties</property>
<property name="NiFi Registry Nodes Properties Location">/var/run/cloudera-scm-agent/process/1546339122-nifi-NIFI_NODE/nifiregistry-conf/peer.properties</property>
<property name="NiFi Group">nifi</property>
<property name="Infer Unqualified Hostnames">false</property>
<property name="NiFi Nodes Properties Location">/var/run/cloudera-scm-agent/process/1546339122-nifi-NIFI_NODE/nifinode-conf/peer.properties</property>
</userGroupProvider><userGroupProvider>
<identifier>composite-configurable-user-group-provider</identifier>
<class>org.apache.nifi.authorization.CompositeConfigurableUserGroupProvider</class>
<property name="User Group Provider 1">cm-user-group-provider</property>
<property name="Configurable User Group Provider">file-user-group-provider</property>
</userGroupProvider><userGroupProvider>
<identifier>file-user-group-provider</identifier>
<class>org.apache.nifi.authorization.FileUserGroupProvider</class>
<property name="Initial User Identity 1">wahyu.budiman</property>
<property name="Users File">/var/lib/nifi/users.xml</property>
</userGroupProvider>

 

<authorizer>
<identifier>ranger-provider</identifier>
<class>org.apache.nifi.ranger.authorization.ManagedRangerAuthorizer</class>
<classpath>/var/run/cloudera-scm-agent/process/1546339122-nifi-NIFI_NODE/hadoop-conf</classpath>
<property name="Ranger Security Config Path">/var/run/cloudera-scm-agent/process/1546339122-nifi-NIFI_NODE/ranger-nifi-security.xml</property>
<property name="User Group Provider">composite-configurable-user-group-provider</property>
<property name="Ranger Admin Identity">rangerhostname</property>
<property name="Ranger Service Type">nifi</property>
<property name="Ranger Audit Config Path">/var/run/cloudera-scm-agent/process/1546339122-nifi-NIFI_NODE/ranger-nifi-audit.xml</property>
<property name="Ranger Application Id">Cluster1_nifi</property>
<property name="Ranger Kerberos Enabled">true</property>
</authorizer>

Translate
Terms & ConditionsAccessibility statement