https://community.cloudera.com/t5/Support-Questions/Nifi-not-able-to-load-available-buckets-in-nifi-registry/m-p/330753#M230743 <P><a href="https://community.cloudera.com/t5/user/viewprofilepage/user-id/93216">@Yemre</a>&nbsp;<BR /><BR />If you have a support contract with Cloudera, I'd recommend opening a support case to assist with your issue here.<BR /><BR />Possible causes:<BR />1. Unsuccessful Mutual TLS handshake with NiFi-Registry from the NiFi hosts resulting in NiFi node connection only being 1-way TLS connection and node treated as an "anonymous" user.&nbsp; Anonymous users would could not proxy user requests and can not see anything except public buckets.</P><P>--- Caused by missing complete trust chain on one or both sides of connection.&nbsp; Truststore in NiFi-Registry contains complete trust chain for NiFi hosts keystore PrivateKeyEntry.<BR />--- Caused by PrivateKeyEntry not meeting minimum requirements (missing SAN with NiFi hostname,&nbsp; missing EKU of clientAuth, and/or using wildcards are the most common)<BR />2. NiFi-registry is configured with an <A href="https://nifi.apache.org/docs/nifi-registry-docs/html/administration-guide.html#identity-mapping-properties" target="_self">identity mapping</A> pattern in the nifi-registry.properties file that is matching on the DN from the the NiFi's client certificate presented in the mutual TLS handshake. The Identity mapping value&nbsp; and transform is then being applied which alters the actual client string which must be then authorized for Proxy and buckets policies.</P><P>&nbsp;</P><P>Hope this helps you,<BR />Matt</P> Mon, 22 Nov 2021 16:54:55 GMT MattWho 2021-11-22T16:54:55Z