Skip to main content
edim2525
edim2525
Gold ⭐️
August 16, 2023
Solved

NIFI - Set up LDAP integration on a running cluster

Hi ,

I require assistance in configuring my secure cluster to function with LDAP.

Which procedure is recommended when doing that on a running cluster?

What steps do I need to take first?

Do I need to shut down all the nodes?

 

Thanks 

Edi

MattWho
MattWhoAnswer
Titanium ⭐️⭐️⭐️
September 21, 2023

@edim2525 

You can't have NiFi nodes in a cluster configured for different methods of authentication and authorization.  User requests made on any node are proxied to the Cluster coordinator and then replicated to all nodes.  It is unlikely that your user identity will remain the same once you change to using ldap for user authentication.  Then you be setting up authorization based on those new user identities.

Assuming you are currently using a managed-authorizer which uses the file-user-group-provider and file-access-policy-provider in your NiFi authorizers.xml?   
The ldap-provider can be configured to use the LDAP/AD DN (USE_DN) or the username entered at the login prompt (USE_USERNAME) as the user identity (case sensitive).  
Before making any changes to authentication, you could add the the new ldap based user identity in to  your NiFi and authorize that user to all policies granted your current certificate based user already has. 
Then make a copy of the the login-identity-providers.xml file and Edit to add the the ldap-provider. Copy modified login-identity-providers.xml to all nodes.  
Then modify nifi.properties file on all nodes by changing following line:

nifi.security.user.login.identity.provider=ldap-provider

***Theoretically (never done this) with authorization setup for your new ldap user identity setup across all nodes, you could probably restart one node at a time understanding that the only node that redirect to the new ldap-provider based login window would be a node that has been restarted.  This way wok since your new ldap user identity will get proxied to the other nodes which will have authorization in place.

On restart of your NiFi cluster these modified configuration files will be read.
Keep in mind that when no other methods of authentication are enabled, NiFi will "REQUIRE" a client certificate for authentication through a mutualTLS exchange.  Once additional methods of user authentication is added, mutualTLS auth is always enabled and attempted first, but instead of "REQUIRE", NiFI will "WANT" a client certificate. Only when no client certificate is presented during the MutualTLS exchange will NiFi move on to next configured method of authentication (ldap in your case).  MutualTLS can NOT be disabled because it is only method of authentication for node to node communications.

Now a caveat to above is that I have no idea about your current configuration, current user(s), how you plan to configure your ldap-provider, if you are using LDAP or AD, etc..., so guidance is very high level here.

If you found any of the suggestions/solutions provided helped you with your issue, please take a moment to login and click "Accept as Solution" on one or more of them that helped.

Thank you,
Matt



View in thread

4 replies

MattWho
Titanium ⭐️⭐️⭐️
MattWho
Titanium ⭐️⭐️⭐️
September 19, 2023

@edim2525 
If your NiFi is already secured that means you have already using authentication and authorization is some form of configuration.   So depending in your current secure setup configuration, the guidance you may need will vary. 

There are multiple NiFi configuration files that establish the configurations for authentication and authorization (While authorization is dependent on successful authentication, the processes are executed separately).  

  1. nifi.properties
  2. login-identity-providers.xml
  3. authorizers.xml

Understanding your current setup is important for giving proper guidance to change configuration.

For authenticating with LDAP/AD users, you'll want to use the ldap-provider in the login-identity-providers.xml

For authorization you can NOT use default "single-user-authorizer" in the authorizers.xml authorizers.xml.  You'll need to switch to a different provider like the Standard Managed Authorizer.

If you found any of the suggestions/solutions provided helped you with your issue, please take a moment to login and click "Accept as Solution" on one or more of them that helped.

Thank you,
Matt

Translate
edim2525
edim2525Author
Gold ⭐️
September 21, 2023

Given that I need to update these three files (nifi.properties,login-identity-providers.xml,authorizers.xml) , does this imply that I must stop all the nodes within the cluster, perform the file updates, and then restart the nodes? Is there a method to accomplish this without stopping all the nodes?

 

Thanks

Edi

Translate
MattWho
Titanium ⭐️⭐️⭐️
MattWhoAnswer
Titanium ⭐️⭐️⭐️
September 21, 2023

@edim2525 

You can't have NiFi nodes in a cluster configured for different methods of authentication and authorization.  User requests made on any node are proxied to the Cluster coordinator and then replicated to all nodes.  It is unlikely that your user identity will remain the same once you change to using ldap for user authentication.  Then you be setting up authorization based on those new user identities.

Assuming you are currently using a managed-authorizer which uses the file-user-group-provider and file-access-policy-provider in your NiFi authorizers.xml?   
The ldap-provider can be configured to use the LDAP/AD DN (USE_DN) or the username entered at the login prompt (USE_USERNAME) as the user identity (case sensitive).  
Before making any changes to authentication, you could add the the new ldap based user identity in to  your NiFi and authorize that user to all policies granted your current certificate based user already has. 
Then make a copy of the the login-identity-providers.xml file and Edit to add the the ldap-provider. Copy modified login-identity-providers.xml to all nodes.  
Then modify nifi.properties file on all nodes by changing following line:

nifi.security.user.login.identity.provider=ldap-provider

***Theoretically (never done this) with authorization setup for your new ldap user identity setup across all nodes, you could probably restart one node at a time understanding that the only node that redirect to the new ldap-provider based login window would be a node that has been restarted.  This way wok since your new ldap user identity will get proxied to the other nodes which will have authorization in place.

On restart of your NiFi cluster these modified configuration files will be read.
Keep in mind that when no other methods of authentication are enabled, NiFi will "REQUIRE" a client certificate for authentication through a mutualTLS exchange.  Once additional methods of user authentication is added, mutualTLS auth is always enabled and attempted first, but instead of "REQUIRE", NiFI will "WANT" a client certificate. Only when no client certificate is presented during the MutualTLS exchange will NiFi move on to next configured method of authentication (ldap in your case).  MutualTLS can NOT be disabled because it is only method of authentication for node to node communications.

Now a caveat to above is that I have no idea about your current configuration, current user(s), how you plan to configure your ldap-provider, if you are using LDAP or AD, etc..., so guidance is very high level here.

If you found any of the suggestions/solutions provided helped you with your issue, please take a moment to login and click "Accept as Solution" on one or more of them that helped.

Thank you,
Matt



Translate
Terms & ConditionsAccessibility statement