question Re: Nifi Integration with Ranger Not Working in Support Questions

Nifi Integration with Ranger Not Working

bkandalkar — Thu, 07 Jun 2018 15:11:21 GMT

HI All,

In our cluster NIFI is SSL enabled. Ranger is not SSL enabled. Both NIFI and Ranger are integrated with AD/LDAP.

Before enabling NIFI plugin in Ranger, our AD/LDAP users are able to see NIFI UI.

But after enabling NIFI plugin in Ranger, our AD/LDAP users are not able to see NIFI UI.

We are getting following message on NIFI screen:

Insufficient Permissions
   
Untrusted proxy CN=*.test.com, OU=NIFI

nifi-user.log shows Authentication success but Untrusted proxy error as follows:

2018-06-07 07:00:13,447 INFO [NiFi Web Server-19] o.a.n.w.s.NiFiAuthenticationFilter Attempting request for (<JWT token>) GET https://usdf24v0075.test.com:9091/nifi-api/flow/current-user (source ip: 10.23.118.51)
2018-06-07 07:00:13,449 INFO [NiFi Web Server-19] o.a.n.w.s.NiFiAuthenticationFilter Authentication success for test-user
2018-06-07 07:00:13,612 INFO [NiFi Web Server-18] o.a.n.w.s.NiFiAuthenticationFilter Attempting request for (<test-user><CN=*.test.com, OU=NIFI>) GET https://usdf24v0075.test.com:9091/nifi-api/flow/current-user (source ip: 10.23.132.140)
2018-06-07 07:00:13,615 WARN [NiFi Web Server-18] o.a.n.w.s.NiFiAuthenticationFilter Rejecting access to web api: Untrusted proxy CN=*.test.com, OU=NIFI

I have also deleted authorizers.xml and users.xml file from NIFI node and restarted NIFI as well.

How to resolve it.?

Please suggest.

Thanks

Re: Nifi Integration with Ranger Not Working

ahadjidj — Thu, 07 Jun 2018 15:15:44 GMT

Hi @Bhushan Kandalkar

Have you added Ranger policies to let users see the UI : https://docs.hortonworks.com/HDPDocuments/HDF3/HDF-3.1.2/bk_security/content/policies-to-view-nifi.html ?

Thanks

Re: Nifi Integration with Ranger Not Working

bkandalkar — Thu, 07 Jun 2018 15:28:44 GMT

@Abdelkrim Hadjidj

Yes, I have added Ranger policies for user to see UI. Still getting same exception.

Re: Nifi Integration with Ranger Not Working

MattWho — Thu, 07 Jun 2018 20:43:00 GMT

@Bhushan Kandalka

Once the Ranger plugin is enabled, the authorizations.xml file is no longer used to determine what authorizations both users and Nifi nodes have.

In a NiFi cluster each node must be authorized to act as a proxy so that requests made by users logged in to any one of the nodes's UIs can be replicated to the other nodes.

This means that you will need to set an authorization policy in Ranger that authorizes "CN=*.test.com, OU=NIFI" against the "/proxy" policy.

Thank you,

Matt

Re: Nifi Integration with Ranger Not Working

ahadjidj — Thu, 07 Jun 2018 21:02:02 GMT

What about proxy ? as you can see in the provided link

To allow users to view the NiFi UI, create the following policies for each host:

/flow – read
/proxy – read/write

Re: Nifi Integration with Ranger Not Working

bkandalkar — Thu, 07 Jun 2018 21:05:41 GMT

@Matt Clarke

Do I need to create "CN=*.test.com, OU=NIFI" user with password in Ranger and need to add "/proxy" policy for it?

Re: Nifi Integration with Ranger Not Working

MattWho — Thu, 07 Jun 2018 21:10:24 GMT

@Bhushan Kandalkar

That is correct.

Re: Nifi Integration with Ranger Not Working

bkandalkar — Thu, 07 Jun 2018 21:30:15 GMT

@Matt Clarke

While adding "CN=*.test.com, OU=NIFI" user in Ranger its giving invalid username error. How to resolve it?

Re: Nifi Integration with Ranger Not Working

MattWho — Thu, 07 Jun 2018 22:18:31 GMT

@Bhushan Kandalkar

I was afraid of that. Ranger does not allow wildcards in the user names.

From a security standpoint it is generally a bad idea to create a server certificate that uses wildcards.

In order to use Ranger as your authorizer, you are going to need to create new NiFi node certificates/keystores that do not use wildcards in the "Owner" DN.

This means you will have a unique keystore for each of your NiFi nodes (which is a security best practice). You will then need to authorize each of those nodes with /proxy.

Thanks,

Matt

Re: Nifi Integration with Ranger Not Working

bkandalkar — Thu, 07 Jun 2018 23:03:26 GMT

@Matt Clarke

Could you please provide link about how to configure SSL for NIFI which have a unique keystore for each of your NiFi nodes and which authorizes using Ranger.It will be great if you provide that link.

Re: Nifi Integration with Ranger Not Working

ahadjidj — Fri, 08 Jun 2018 02:08:31 GMT

@Bhushan Kandalkar

Here a step by step doc : https://community.hortonworks.com/articles/886/securing-nifi-step-by-step.html

And this the official doc : https://docs.hortonworks.com/HDPDocuments/HDF3/HDF-3.1.1/bk_security/content/enabling-ssl-without-ca.html

Re: Nifi Integration with Ranger Not Working

MattWho — Fri, 08 Jun 2018 23:25:21 GMT

https://nifi.apache.org/docs/nifi-docs/html/administration-guide.html

NiFi even provides a toolkit you can use to create your own certificates/keystores for each of your NiFi nodes.

Matt