question Re: Whether SSO can be used without enabling HTTPS on NIFI in Support Questions

Whether SSO can be used without enabling HTTPS on NIFI

Meepoljd — Wed, 06 Jul 2022 10:12:58 GMT

Is there a way to use SSO without enabling HTTPS on NIFI?

Re: Whether SSO can be used without enabling HTTPS on NIFI

Meepoljd — Thu, 07 Jul 2022 05:58:05 GMT

When I tried to turn on KnoxSSO for NIFI without https,I can access NIFI's Web UI through Knox,but I can also access the NIFI directly through port 10111 which no jump to Knox.

So I tried to enable HTTPS while using Knox, and I got this error "Apache Knox SSO support cannot be enabled if the Login Identity Provider or OpenId Connect or SAML is configured."

Re: Whether SSO can be used without enabling HTTPS on NIFI

MattWho — Thu, 07 Jul 2022 15:17:13 GMT

@Meepoljd
You'll want to have https enabled to prevent access to NiFi's endpoints directly. When NiFi is not secured (HTTPS), it does not require user authentication or authorization. Thus access is treated as anonymous.

When using Apache Knox, NIFi can not be configured with other login based authentication like a login-provider in the login-identity-providers.xml or OpenID or SAML via associated properties in the nifi.properties file.

So make sure these properties are not configured in the nifi.properties file when you have also configured the knox properties:
https://nifi.apache.org/docs/nifi-docs/html/administration-guide.html#saml
https://nifi.apache.org/docs/nifi-docs/html/administration-guide.html#openid_connect
and following login provider property:

nifi.security.user.login.identity.provider=

If you found this response assisted with your query, please take a moment to login and click on "Accept as Solution" below this post.

Thank you,

Matt

Re: Whether SSO can be used without enabling HTTPS on NIFI

Meepoljd — Sat, 09 Jul 2022 04:37:34 GMT

Thanks.I open the https for nifi.And it works when Knox and Nifi on same server.But when I deploy NIFI and KNOX separately, I am redirected infinitely when SSO logs in to NIFI and I find Cookies have problems. Is this because of cross-domain? Knox gateway.log has "JWT cookie successfully added." but nifi-user.log have " [<anonymous>] GET https://XXX:9443/nifi-api/flow/current-user"

Re: Whether SSO can be used without enabling HTTPS on NIFI

Meepoljd — Sat, 09 Jul 2022 06:22:01 GMT

I know.Need FQDN likes testhost.magg.com,Thanks