Apache Nifi: OIDC auth and access to the API without username

[#1]

Hello,

I have Nifi set up to use OIDC authentication, everything works fine, but there is one problem.

I use the Gatus service to monitor Nifi via its API, and unfortunately the Gatus service does not have access to the Nifi API via the OIDC protocol, because not Gatus can not pass the username when connecting, in the log I get a message:

127.0.0.1 - - [11/Sep/2022:14:11:18 +0000] "GET /nifi-api/system-diagnostics HTTP/1.0" 401 247 "-" "Gatus/1.0"
2022-09-11 16:14:16,691 DEBUG [NiFi Web Server-19] o.a.n.w.s.l.RequestAuthenticationFilter Username not found Remote Address [127.0.0.1]

 But if I access the main page, everything works fine:

2022-09-11 16:26:56,360 DEBUG [NiFi Web Server-17] o.a.n.w.s.l.RequestAuthenticationFilter Username not found Remote Address [127.0.0.1]
127.0.0.1 - - [11/Sep/2022:14:26:56 +0000] "GET /nifi/ HTTP/1.0" 200 19569 "-" "Gatus/1.0"
127.0.0.1 - - [11/Sep/2022:14:26:58 +0000] "GET /nifi/ HTTP/1.0" 200 19569 "-" "Gatus/1.0"

This is a piece of the Nifi configuration file responsible for OIDC:

# OpenId Connect SSO Properties #
nifi.security.user.oidc.discovery.url=https://***********/auth/realms/******/.well-known/openid-configuration
nifi.security.user.oidc.connect.timeout=5 secs
nifi.security.user.oidc.read.timeout=5 secs
nifi.security.user.oidc.client.id=gatus_client
nifi.security.user.oidc.client.secret=*******-****-*****-****-***********
nifi.security.user.oidc.preferred.jwsalgorithm=
nifi.security.user.oidc.additional.scopes=
nifi.security.user.oidc.claim.identifying.user=
nifi.security.user.oidc.fallback.claims.identifying.user=
nifi.security.user.oidc.truststore.strategy=JDK

This example shows how to use the client.oauth2 configuration in Gatus:

endpoints:
  - name: "nifi-status"
    group: dev
    url: "https://********/nifi-api/system-diagnostics"
    interval: 1m
    client:
      oauth2:
        client-id: gatus_client
        token-url: https://************/auth/realms/*****/protocol/openid-connect/token
        client-secret: ********-****-****-****-*************
        scopes: ["openid"]
    conditions:
      - "[STATUS] == 200"

Is there any secure way to give NiFi access to its API to a Gatus application that does not pass the username when connecting via the OIDC protocol?

Thank you!