question Re: Masking of Authentication token in Support Questions

Masking of Authentication token

midee — Mon, 26 Jul 2021 15:42:36 GMT

Is it possible to mask or greyed out the Token passed in Custom Property (Authentication )?

I have one Token received from one API and have to pass it to another request.

Issue: If I pass the token in custom property, it will be visible to all users who can access the flowfile. I need to mask these token as these value are displayed in Attribute and Content.

Thanks for early response.

Re: Masking of Authentication token

janis-ax — Tue, 27 Jul 2021 08:04:39 GMT

Hi,

Should not be possible.

If put the token into a variable, then everyone else can see the variable.
If you put it into a parameter, you also cannot use the secure parameter because you can put these only in sensitive fields.
When you use normal parameter, you have the same behavior as with the variables.

But I'm excited to see if anyone else comes up with a solution!

Re: Masking of Authentication token

MattWho — Wed, 28 Jul 2021 17:53:27 GMT

@midee

@janis-ax is correct that this is not possible.

"ONLY" sensitive attributes can be encrypted/masked. Only component properties coded to as a sensitive property field would be able to decrypt an encrypted/masked value.

If setting policies to block specific users from being able to view the data on these components, you may want to look at other options for performing these endpoint authentication/authorization actions. For example, with the NiFi endpoints you could use mutual TLS via certificates instead of token based authentication for accessing the endpoints. This does not mean you need to stop using or un-configure the token based authentication methods for access to your secured NiFi.

If the endpoint you are trying to reach is not NiFi, you may want to see what other options it may offer for authentication that are not token based.

Hope this helped,
Matt