No available buckets after secure Nifi connected to secure Nifi registry

@Armel316, Welcome to our community! To help you get the best possible answer, I have tagged in our NiFi experts @MattWho @SAMSAL who may be able to assist you further.

Please feel free to provide any additional information or details about your query, and we hope that you will find a satisfactory solution to your question.

@Armel316 Does the Nifi Registry setup with Authorisation, probably we may need to refer this doc: https://docs.cloudera.com/cfm/2.1.7/cfm-security/topics/cdf-datahub-nifi-security-predefined-nifiregistry-policies.html

@Armel316 

Lets discuss first what needs to happen successfully when a secured NiFi is connecting with a secured NiFi-Registry.

When NiFi connects to NiFi-Registry client URL, it does so using the either the keystore and truststore configured in the NiFi-Registry Client's StandardRestrictedSSLContextService setup within NiFi  or using the keystore and truststore setup in the nifi.properties when no StandardRestrictedSSLContextService was setup in the NiFi-Registry Client.  A mutualTLS handshake will be attempted between NiFi and NiFi-Registry.  NiFi-Registry will "WANT" the client (NiFi) to provide clientAuth certificate.  If one is not provided, NiFi-Registry will proceed using the anonymous user (Anonymous user only has read on public buckets which align with what you shared from developer tools).  So an unsuccessful  mutualTLS handshake is most likely your issue currently.

To answer the possible next question.... If It shows "read" on the bucket in developer tools, why does NiFi UI does not show the bucket?

• This is because the UI opened was for starting version control on an process group on the NiFi canvas.  This UI will only show buckets for which the user identity currently authenticated into NiFi is authorized read and write on.
  
  

Next question: My NiFi user is authorized read and write on the bucket in NiFi-Registry, so why is bucket not showing?

• NiFi authenticates with NiFi-Registry via a mutualTLS handshake.  The client/user identity derived form the clientAuth certificate DN for the NIFi node is used as the identity passed to NiFi-Registry.  Assuming the MutualTLS handshake is successful, the node user identity must be authorized "read" on all buckets and "read, write, and delete" on proxy user requests.  This allows the node to proxy request on behalf of the user authenticated in NiFi.  So only the buckets for which the authenticated user identity in NiFi has been authorized read, write, and delete on within NiFi-Registry will be shown in the list.

Please help our community thrive. If you found any of the suggestions/solutions provided helped you with solving your issue or answering your question, please take a moment to login and click "Accept as Solution" on one or more of them that helped.

Thank you,
Matt

I have already adjusted the NiFi Registry authorizers.xml configuration as follows: : 

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>

<authorizers>

<userGroupProvider>

<identifier>file-user-group-provider</identifier>

<class>org.apache.nifi.registry.security.authorization.file.FileUserGroupProvider</class>

<property name="Users File">./conf/users.xml</property>

<property name="Legacy Authorized Users File"></property>

<property name="Initial User Identity 1">CN=nifi0, OU=NIFI</property>

<property name="Initial User Identity 2">CN=nifi1, OU=NIFI</property>

<property name="Initial User Identity 3">CN=nifi2, OU=NIFI</property>

<property name="Initial User Identity 4">CN=localhost, OU=NIFI</property>

</userGroupProvider>

<userGroupProvider>

<identifier>ldap-user-group-provider</identifier>

<class>org.apache.nifi.registry.security.ldap.tenants.LdapUserGroupProvider</class>

<property name="Authentication Strategy">SIMPLE</property>

<property name="Manager DN">ldap_manager_dn</property>

<property name="Manager Password">ldap_manager_password</property>

<property name="TLS - Keystore">/opt/certs/registry/keystore.jks</property>

<property name="TLS - Keystore Password">supersecretkeystore</property>

<property name="TLS - Keystore Type">JKS</property>

<property name="TLS - Truststore">/opt/certs/registry/truststore.jks</property>

<property name="TLS - Truststore Password">supersecrettruststore</property>

<property name="TLS - Truststore Type">JKS</property>

<property name="TLS - Client Auth">NONE</property>

<property name="TLS - Protocol"></property>

<property name="TLS - Shutdown Gracefully"></property>

<property name="Referral Strategy">FOLLOW</property>

<property name="Connect Timeout">10 secs</property>

<property name="Read Timeout">10 secs</property>

<property name="Url">ldap_url</property>

<property name="Page Size"></property>

<property name="Sync Interval">30 mins</property>

<property name="Group Membership - Enforce Case Sensitivity">false</property>

<property name="User Search Base">ldap_user_search_base</property>

<property name="User Object Class">person</property>

<property name="User Search Scope">SUBTREE</property>

<property name="User Search Filter">ldap_user_search_filter_authorizers</property>

<property name="User Identity Attribute">sAMAccountName</property>

<property name="User Group Name Attribute">memberof</property>

<property name="User Group Name Attribute - Referenced Group Attribute"></property>

<property name="Identity Strategy">USE_USERNAME</property>

<property name="Group Search Base">ldap_group_search_base</property>

<property name="Group Object Class">group</property>

<property name="Group Search Scope">ONE_LEVEL</property>

<property name="Group Search Filter">(objectClass=group)</property>

<property name="Group Name Attribute">cn</property>

<property name="Group Member Attribute">member</property>

<property name="Group Member Attribute - Referenced User Attribute">sAMAccountName</property>

</userGroupProvider>

<userGroupProvider>

<identifier>composite-user-group-provider</identifier>

<class>org.apache.nifi.registry.security.authorization.CompositeUserGroupProvider</class>

<property name="User Group Provider 1">file-user-group-provider</property>

<property name="User Group Provider 2">ldap-user-group-provider</property>

</userGroupProvider>

<accessPolicyProvider>

<identifier>file-access-policy-provider</identifier>

<class>org.apache.nifi.registry.security.authorization.file.FileAccessPolicyProvider</class>

<property name="User Group Provider">composite-user-group-provider</property>

<property name="Authorizations File">./conf/authorizations.xml</property>

<property name="Initial Admin Identity">initial_admin_identity</property>

<property name="Legacy Authorized Users File"></property>

<property name="Node Identity 1">CN=nifi0, OU=NIFI</property>

<property name="Node Identity 2">CN=nifi1, OU=NIFI</property>

<property name="Node Identity 3">CN=nifi2, OU=NIFI</property>

<property name="Node Group"></property>

</accessPolicyProvider>

<authorizer>

<identifier>managed-authorizer</identifier>

<class>org.apache.nifi.registry.security.authorization.StandardManagedAuthorizer</class>

<property name="Access Policy Provider">file-access-policy-provider</property>

</authorizer>

</authorizers>

 

And i've setup the required policies for NiFi nodes 

but still no available bucket in nifi

is there anyone who can help me please ? 

@Armel316 

You used the wrong composite provider "composite-user-group-provider".
Since one of your providers is the "file-user-group-provider" (a configurable provider- meaning one you can add users and groups to via the UI), you need to use the "composite-configurable-user-group-provider".

I see in the Apache NiFi-Registry documentation that the example is wrong.  
https://nifi.apache.org/docs/nifi-registry-docs/html/administration-guide.html#composite-implementations

    <userGroupProvider>
        <identifier>composite-configurable-user-group-provider</identifier>
        <class>org.apache.nifi.registry.security.authorization.CompositeConfigurableUserGroupProvider</class>
        <property name="Configurable User Group Provider">file-user-group-provider</property>
        <property name="User Group Provider 1">ldap-user-group-provider</property>
    </userGroupProvider>

What do you see in the nifi-registry-app.log when you try to start version control?

What is the output from:
openssl s_client -connect <nifi-registry hostname>:<port> -v
openssl s_client -connect <nifi node hostname>:<port> -v

Above can be checked to verify proper trust exists between NiFi and NiFi-Registry.

What is the exact case sensitive user identity displayed in the upper right corner of your NiFi UI for the user authenticated to NiFi that is attempting to start version control?

Does the same user Identity (case sensitive) exist in your NiFi-Registry and been assigned read, write, and delete on the bucket?

Please help our community thrive. If you found any of the suggestions/solutions provided helped you with solving your issue or answering your question, please take a moment to login and click "Accept as Solution" on one or more of them that helped.

Thank you,
Matt

Hello,

I've use composite configurable and i don't remember what change i've done in the nifi registry but now i'm getting this error :  "2024-11-22 10:59:12,704 ERROR [NiFi Registry Web Server-20] o.s.b.w.servlet.support.ErrorPageFilter Forwarding to error page from request [/access] due to exception [Multiple UserGroupProviders claim to provide user xxx]
java.lang.IllegalStateException: Multiple UserGroupProviders claim to provide user xxx"

@Armel316 

Since you only have two user group providers (ldap and file), that means that both are returning user "xxx".  If the ldap-user-group-provider is returning user "xxx" you don't want to define that same user through the file-user-group-provider.    What this means is that the users.xml file that the file-user-group-provider is loading users from on startup contains user "xxx".   

The file-user-group-provider will ONLY generate a users.xml file if one does not already exist.  If one already exist the file-user-group-provider will NOT make any modifications to an existing users.xml if you modify the provider configuration.  Once a users.xml file exists, the expectation is that all future user/group modification happen via the UI.

NOTE: The users.xml does not contain any users or group being loaded by other providers in to NiFi memory.

So you have two options here:

1. Rename the current users.xml file so a new one is created on startup with only the 3 defined node-identities.  (this is preferred method)
2. Manually modify the users.xml to remove all users that are being synced by the ldap-user-group-provider.

Please help our community thrive. If you found any of the suggestions/solutions provided helped you with solving your issue or answering your question, please take a moment to login and click "Accept as Solution" on one or more of them that helped.

Thank you,
Matt