question Re: Encryption mechanism in NiFi 2.0 in Support Questions

Encryption mechanism in NiFi 2.0

fs_nifioneks — Tue, 18 Feb 2025 22:18:06 GMT

Hi,

I read from the release note that the encrypt-config.sh tool from nifi-toolkit has been removed in NiFi 2.0 due to various considerations(https://issues.apache.org/jira/browse/NIFI-13414). I am wondering is there any alternatives to this tool? We heavily relied on this encrypt-config.sh tool to encrypt plain-text passwords in nifi.properties, like nifi.sensitive.props.key, nifi.security.keyPasswd. Now with this tool gone, do we just have to accept the fact that plain-text passwords will remain plain-text?

Thanks in advance!!

Re: Encryption mechanism in NiFi 2.0

DianaTorres — Tue, 18 Feb 2025 22:19:03 GMT

@fs_nifioneks Welcome to the Cloudera Community!

To help you get the best possible solution, I have tagged our NiFi experts @mburgess @MattWho who may be able to assist you further.

Please keep us updated on your post, and we hope you find a satisfactory solution to your query.

Re: Encryption mechanism in NiFi 2.0

fs_nifioneks — Tue, 25 Feb 2025 16:32:22 GMT

@DianaTorres thanks for tagging the experts, @mburgess @MattWho any insights would be much appreciated!

Re: Encryption mechanism in NiFi 2.0

Kartik_Agarwal — Wed, 26 Feb 2025 06:55:29 GMT

NiFi will automatically encrypt sensitive properties (e.g., passwords) when you start the application. You can provide the plain-text values in the nifi.properties file, and NiFi will replace them with encrypted values upon startup.

You can verify the same as below.

cd /var/run/cloudera-scm-agent/process/

grep -Er nifi.security.keyPasswd

If you have a property like nifi.security.keyPasswd=myPassword, NiFi will encrypt it and store it in the format:

nifi.security.keyPasswd={aes-256-gcm}encryptedValue

If you found that the provided solution(s) assisted you with your query, please take a moment to login and click Accept as Solution below each response that helped.

Re: Encryption mechanism in NiFi 2.0

MattWho — Wed, 26 Feb 2025 13:25:16 GMT

@fs_nifioneks

Welcome to the community.

The logic behind why the encrypt-config tools were removed in Apache NiFi 2.0 is well explained in the jira NIFI-13414 you mentioned. I am sure that the Apache community will eventually implement other more robust options for password security.

That being said, Cloudera's Cloudera Flow Management 4.x product line is based off Apache NiFi 2.0, but will still include the encrypt-config utility in its code base to persist the existing password encryption option until more robust options replace it. In addition, Cloudera Flow Management also keeps many (not all) Apache NiFi components processors and controller services deprecated in the Apache NiFi 2.0 releases, as well as, includes additional components only available through Cloudera only for even more dataflow design capability and connection options. Cloudera Flow management 4.0 is available to our licensed users as a technical preview, but a full production ready release will be coming in the near future.

You can view the Cloudera Flow Management documentation here for the Tech Preview release:
https://docs.cloudera.com/cfm/4.0.0/index.html

These Tech preview docs do not provide a component list, but the production ready release docs will.

Please help our community grow and thrive. If you found any of the suggestions/solutions provided helped you with solving your issue or answering your question, please take a moment to login and click "Accept as Solution" on one or more of them that helped.

Thank you,
Matt

Re: Encryption mechanism in NiFi 2.0

fs_nifioneks — Wed, 26 Feb 2025 17:29:51 GMT

@Kartik_Agarwal Thanks a lot for the detailed reply. Unfortunately we are not using cloudera's product line to run NiFi. But like Matt mentioned below, so far this seems like the only viable option to achieve encryption in config files, until other solution surfaces.

Re: Encryption mechanism in NiFi 2.0

ragshetty — Fri, 26 Sep 2025 04:19:31 GMT

Hi Team, iam using nifi2.3.0 i cannot see encrypt-confg.sh file in toolkit iam unable to encrypt the password in login.provider.xml and authorisers.xml and nifi.properties. please provide me the solution to this . @Kartik_Agarwal @MattWho @DianaTorres

Re: Encryption mechanism in NiFi 2.0

MattWho — Fri, 26 Sep 2025 13:24:14 GMT

@ragshetty

I shared the Apache Jira which documented the removal of the encrypt-config toolkit in Apache NiFi 2.x releases. There is no alternative solution offered directly in the Apache NiFi product.

NIFI-13414

Thank you,

Matt