NiFi privilege - Allow modify but not operate component

[#1]

Hello

I'm trying to create NiFi user to modify the component but can't operate it. This is needed to segregate the duties where someone will create and components and another one will run them. I tried the current privileges but when I set the "Modify component" privilege. The user is able to operate as well even if I removed the "Operate" Privilege

can you help ?

Screenshots for test user

[#2 · Accepted solution]

Hi @Yahya Najjar

The "operate the component" policy was added to support a role where a user could only start/stop components (https://issues.apache.org/jira/browse/NIFI-375). That can be implemented by removing the user from the "modify the component" policy and adding the user to the "operate the component" policy.

What you are trying to accomplish is to have a user that can only modify and not operate, which is not currently supported. The way the "modify the component" policy is implemented, if the user is on that policy, the user can also start/stop components. This supports what is likely the more common scenario: a user who can change a component can also operate it.

If you feel NiFi needs to support your use case and would like to see if others in the NiFi community agree, please file an enhancement Jira in the NiFi project (https://issues.apache.org/jira/projects/NIFI/summary).

[#3]

Many thanks for your advise, I filed a jira for that.

[#4]

No problem, glad the advice was helpful. For others following this thread, the Jira filed is:

https://issues.apache.org/jira/browse/NIFI-5934