question Re: NiFi privilege - Allow modify but not operate component in Archives of Support Questions (Read Only)

NiFi privilege - Allow modify but not operate component

yahya_najjar — Mon, 31 Dec 2018 23:13:01 GMT

Hello

I'm trying to create NiFi user to modify the component but can't operate it. This is needed to segregate the duties where someone will create and components and another one will run them. I tried the current privileges but when I set the "Modify component" privilege. The user is able to operate as well even if I removed the "Operate" Privilege

can you help ?

Screenshots for test user

Re: NiFi privilege - Allow modify but not operate component

alim — Sat, 05 Jan 2019 04:39:33 GMT

Hi @Yahya Najjar

The "operate the component" policy was added to support a role where a user could only start/stop components (https://issues.apache.org/jira/browse/NIFI-375). That can be implemented by removing the user from the "modify the component" policy and adding the user to the "operate the component" policy.

What you are trying to accomplish is to have a user that can only modify and not operate, which is not currently supported. The way the "modify the component" policy is implemented, if the user is on that policy, the user can also start/stop components. This supports what is likely the more common scenario: a user who can change a component can also operate it.

If you feel NiFi needs to support your use case and would like to see if others in the NiFi community agree, please file an enhancement Jira in the NiFi project (https://issues.apache.org/jira/projects/NIFI/summary).

Re: NiFi privilege - Allow modify but not operate component

yahya_najjar — Sun, 06 Jan 2019 05:21:54 GMT

Many thanks for your advise, I filed a jira for that.

Re: NiFi privilege - Allow modify but not operate component

alim — Mon, 07 Jan 2019 22:43:44 GMT

No problem, glad the advice was helpful. For others following this thread, the Jira filed is:

https://issues.apache.org/jira/browse/NIFI-5934