question Re: NiFi privilege - Allow modify but not operate component in Archives of Support Questions (Read Only)

NiFi privilege - Allow modify but not operate component

yahya_najjar — Sat, 17 Aug 2019 22:38:32 GMT

Hello

I'm trying to create NiFi user to modify the component but can't operate it. This is needed to segregate the duties where someone will create and components and another one will run them. I tried the current privileges but when I set the "Modify component" privilege. The user is able to operate as well even if I removed the "Operate" Privilege

can you help ?

Screenshots for test user

Re: NiFi privilege - Allow modify but not operate component

alopresto — Tue, 01 Jan 2019 03:36:09 GMT

I do not believe there is a way to configure this with NiFi access controls. The way that NiFi permissions are set up, "operate" is a subset of "modify" -- you can have "operate" without "modify" but not "modify" without "operate". This is because the state of the processor (running/stopped) is considered configuration data and set via an API call.

Re: NiFi privilege - Allow modify but not operate component

yahya_najjar — Wed, 02 Jan 2019 03:53:17 GMT

Thanks a lot Andy, is there any way to achieve this ?

Re: NiFi privilege - Allow modify but not operate component

alopresto — Thu, 03 Jan 2019 02:30:48 GMT

You could submit a feature request to the NiFi project, but based on the way this is currently implemented, I would not expect this change to be made in a 1.x version. NiFi is designed for immediate feedback and an iterative development cycle, so the use case of allowing a specific user to modify the configuration of a component without being allowed to operate it has not been addressed, as it was considered unrealistic.

Re: NiFi privilege - Allow modify but not operate component

yahya_najjar — Sun, 06 Jan 2019 05:24:05 GMT

Thanks a lot. Jira submitted