NiFi privilege - Allow modify but not operate component

[#1]

Hello

I'm trying to create NiFi user to modify the component but can't operate it. This is needed to segregate the duties where someone will create and components and another one will run them. I tried the current privileges but when I set the "Modify component" privilege. The user is able to operate as well even if I removed the "Operate" Privilege

can you help ?

Screenshots for test user

[#2 · Accepted solution]

I do not believe there is a way to configure this with NiFi access controls. The way that NiFi permissions are set up, "operate" is a subset of "modify" -- you can have "operate" without "modify" but not "modify" without "operate". This is because the state of the processor (running/stopped) is considered configuration data and set via an API call.

[#3]

Thanks a lot Andy, is there any way to achieve this ?

[#4]

You could submit a feature request to the NiFi project, but based on the way this is currently implemented, I would not expect this change to be made in a 1.x version. NiFi is designed for immediate feedback and an iterative development cycle, so the use case of allowing a specific user to modify the configuration of a component without being allowed to operate it has not been addressed, as it was considered unrealistic.

[#5]

Thanks a lot. Jira submitted