Community Articles
Find and share helpful community-sourced technical articles
Announcements
Alert: Welcome to the Unified Cloudera Community. Former HCC members be sure to read and learn how to activate your account here.
Cloudera Employee

When NiFi is secured for TLS server authentication, at UI login time first it tries to use TLS certificates if loaded on the browser and then, it tries to use SPNEGO authentication, and finally, it falls back to your configured login provider.

If you KERBERISE the cluster via AMBARI and want to use login-providers like LDAP or KERBEROS, it automatically sets the following properties which enable SPNEGO authentication.

nifi.kerberos.spnego.keytab.location 
nifi.kerberos.spnego.principal 

 

 Furthermore, SPNEGO properties through AMBARI are greyed out for:

Screen Shot 2020-07-15 at 2.39.53 PM.png

COMMAND:

  1. From your Amabari manager host, change the setting for NiFi, where the text in red is tailored to your unique environment:
  • nifi.kerberos.spnego.keytab.location to be blank:
  1. ./configs.py -a set -s http -l c2288-node1.squadron.support.hortonworks.com -t 8080 -n c2288  -u admin -p AdminPassword -c nifi-properties -k 'nifi.kerberos.spnego.keytab.location' -v ''
  • nifi.kerberos.spnego.principal to be blank
  1. ./configs.py -a set -s http -l c2288-node1.squadron.support.hortonworks.com -t 8080 -n c2288 -u admin -p AdminPassword -c nifi-properties -k 'nifi.kerberos.spnego.principal' -v ''
    -a set
    -s http or https
    -l fqdn of ambari host
    -t port number ambari is listening on
    -n ambari cluster name ( you can get that from top right UI )
    -u user that has edit privileges on ambari
    -p the password for that user
    -c the config type in this case nifi.properties
    -k the key to change
    -v the value to change
  2. You can also do this for NiFi Registry with the following sample commands:
    ./configs.py -a set -s http -l c2288-node1.squadron.support.hortonworks.com -t 8080 -n c2288 -u admin -p AdminPassword -c nifi-registry-properties -k 'nifi.registry.kerberos.spnego.principal' -v ''
    ./configs.py -a set -s http -l c2288-node1.squadron.support.hortonworks.com -t 8080 -n c2288 -u admin -p AdminPassword -c nifi-registry-properties -k 'nifi.registry.kerberos.spnego.principal' -v ''
  3. Restart NiFi and/or NiFi Registry and ensure that you clear your browser cache.
  4. You should see the following on Ambari config sections of NiFi and/or NiFi registry:Screen Shot 2020-07-15 at 3.15.29 PM.png

 

98 Views
0 Kudos
Don't have an account?
Coming from Hortonworks? Activate your account here
Version history
Revision #:
9 of 9
Last update:
‎07-17-2020 03:06 AM
Updated by:
 
Top Kudoed Authors