Connecting Nifi to LDAP with Docker

[#1]

I have been struggling with this for a week now.

Here are my files:

Authorizers.xml

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<authorizers>
<userGroupProvider>
<identifier>file-user-group-provider</identifier>
<class>org.apache.nifi.authorization.FileUserGroupProvider</class>
<property name="Users File">./conf/users.xml</property>
<property name="Legacy Authorized Users File"></property>
<property name="Initial User Identity 1">cn=localhost,ou=ngc</property>
<property name="Initial User Identity 2">CN=localhost,O=ngc,L=San Diego,ST=California,C=US</property>
</userGroupProvider>
<userGroupProvider>
<identifier>ldap-user-group-provider</identifier>
<class>org.apache.nifi.ldap.tenants.LdapUserGroupProvider</class>
<property name="Authentication Strategy">SIMPLE</property>
<property name="Manager DN">cn=localhost,ou=ngc</property>
<property name="Manager Password">password</property>
<property name="Referral Strategy">FOLLOW</property>
<property name="Connect Timeout">10 secs</property>
<property name="Read Timeout">10 secs</property>
<property name="Url">ldap://ldap:3890</property>
<property name="Page Size"></property>
<property name="Sync Interval">30 mins</property>
<property name="Group Membership - Enforce Case Sensitivity">false</property>
<property name="User Search Base">CN=users</property>
<property name="User Object Class">person</property>
<property name="User Search Scope">ONE_LEVEL</property>
<property name="User Search Filter">(uid=*)</property>
<property name="User Identity Attribute">cn</property>
<property name="User Group Name Attribute"></property>
<property name="User Group Name Attribute - Referenced Group Attribute"></property>
<property name="Group Search Base"></property>
<property name="Group Object Class">group</property>
<property name="Group Search Scope">ONE_LEVEL</property>
<property name="Group Search Filter"></property>
<property name="Group Name Attribute"></property>
<property name="Group Member Attribute"></property>
<property name="Group Member Attribute - Referenced User Attribute"></property>
</userGroupProvider>
<userGroupProvider>
<identifier>composite-configurable-user-group-provider</identifier>
<class>org.apache.nifi.authorization.CompositeConfigurableUserGroupProvider</class>
<property name="Configurable User Group Provider">file-user-group-provider</property>
<property name="User Group Provider 1">ldap-user-group-provider</property>
</userGroupProvider>

<accessPolicyProvider>
<identifier>file-access-policy-provider</identifier>
<class>org.apache.nifi.authorization.FileAccessPolicyProvider</class>
<property name="User Group Provider">composite-configurable-user-group-provider</property>
<property name="Authorizations File">./conf/authorizations.xml</property>
<property name="Initial Admin Identity">cn=localhost,ou=ngc</property>
<property name="Legacy Authorized Users File"></property>
<property name="Node Group"></property>
</accessPolicyProvider>
<authorizer>
<identifier>managed-authorizer</identifier>
<class>org.apache.nifi.authorization.StandardManagedAuthorizer</class>
<property name="Access Policy Provider">file-access-policy-provider</property>
</authorizer>
</authorizers>


login-identity-providers.xml

<loginIdentityProviders>

<provider>
<identifier>ldap-provider</identifier>
<class>org.apache.nifi.ldap.LdapProvider</class>
<property name="Authentication Strategy">SIMPLE</property>

<property name="Manager DN">cn=localhost,ou=ngc</property>
<property name="Manager Password">password</property>

<property name="TLS - Keystore">./conf/keystore.p12</property>
<property name="TLS - Keystore Password">password</property>
<property name="TLS - Keystore Type">PKCS12</property>
<property name="TLS - Truststore">./conf/truststore.p12</property>
<property name="TLS - Truststore Password">password</property>
<property name="TLS - Truststore Type">PKCS12</property>
<property name="TLS - Client Auth">NONE</property>
<property name="TLS - Protocol">TLS</property>
<property name="TLS - Shutdown Gracefully"></property>

<property name="Referral Strategy">FOLLOW</property>
<property name="Connect Timeout">10 secs</property>
<property name="Read Timeout">10 secs</property>

<property name="Url">ldap://ldap:3890</property>
<property name="User Search Base">cn=localhost,ou=ngc</property>

<property name="User Search Filter">sAMAccountName={0}</property>
<!--<property name="User Search Filter">cn={0}</property>-->

<property name="Identity Strategy">USE_DN</property>
<property name="Authentication Expiration">12 hours</property>
</provider>

</loginIdentityProviders>

nifi.properties

nifi.security.autoreload.enabled=false
nifi.security.autoreload.interval=10 secs
nifi.security.keystore=./conf/keystore.p12
nifi.security.keystore.certificate=
nifi.security.keystore.privateKey=
nifi.security.keystoreType=PKCS12
nifi.security.keystorePasswd=password
nifi.security.keyPasswd=password
nifi.security.truststore=./conf/truststore.p12
nifi.security.truststore.certificate=
nifi.security.truststoreType=PKCS12
nifi.security.truststorePasswd=password

nifi.security.user.authorizer=managed-authorizer
nifi.security.allow.anonymous.authentication=false
nifi.security.user.login.identity.provider=ldap-provider
nifi.security.user.jws.key.rotation.period=PT1H
nifi.security.ocsp.responder.url=
nifi.security.ocsp.responder.certificate=

Docker setup

services:
nifi2:
image: testnifi:latest
attach: false
ports:
- 8443:8443
networks:
- ftcs_net

nifi-registry:
image: ssb-docker.nexus.usdin.gc1.myngc.com/apache/nifi-registry:ftcs-0.0.1
user: nifi
attach: false
restart: always
ports:
- 18080:18080
volumes:
- nifi_registry_database:/opt/nifi-registry/nifi-registry-current/database
- nifi_registry_flow_storage:/opt/nifi-registry/nifi-registry-current/flow_storage
networks:
- ftcs_net

ldap:
image: lldap/lldap:stable
ports:
- "3890:3890"
- "6360:6360"
- "17170:17170"
volumes:
- "ldap_data:/data"
- "./nifi/certs:/app/certs"
environment:
#- LLDAP_JWT_SECRET=12345
#- LLDAP_KEY_SEED=12345
#- LLDAP_LDAP_PORT=6360
- LLDAP_HTTP_HOST=0.0.0.0
- LLDAP_LDAP_HOST=ldap
- LLDAP_LDAP_BASE_DN=dc=localhost
- LLDAP_LDAP_USER_PASS=password
- LLDAP_LDAPS_OPTIONS__ENABLED=true
- LLDAP_LDAPS_OPTIONS__CERT_FILE=/app/certs/localhost.crt
- LLDAP_LDAPS_OPTIONS__KEY_FILE=/app/certs/localhost.key

Error: 2025-02-04 08:45:33 Caused by: javax.naming.CommunicationException: ldap:3890
2025-02-04 08:45:33 at java.naming/com.sun.jndi.ldap.Connection.<init>(Connection.java:251)
2025-02-04 08:45:33 at java.naming/com.sun.jndi.ldap.LdapClient.<init>(LdapClient.java:141)
2025-02-04 08:45:33 at java.naming/com.sun.jndi.ldap.LdapClient.getInstance(LdapClient.java:1620)
2025-02-04 08:45:33 at java.naming/com.sun.jndi.ldap.LdapCtx.connect(LdapCtx.java:2848)
2025-02-04 08:45:33 at java.naming/com.sun.jndi.ldap.LdapCtx.<init>(LdapCtx.java:349)
2025-02-04 08:45:33 at java.naming/com.sun.jndi.ldap.LdapCtxFactory.getLdapCtxFromUrl(LdapCtxFactory.java:229)
2025-02-04 08:45:33 at java.naming/com.sun.jndi.ldap.LdapCtxFactory.getUsingURL(LdapCtxFactory.java:189)
2025-02-04 08:45:33 at java.naming/com.sun.jndi.ldap.LdapCtxFactory.getUsingURLs(LdapCtxFactory.java:247)
2025-02-04 08:45:33 at java.naming/com.sun.jndi.ldap.LdapCtxFactory.getLdapCtxInstance(LdapCtxFactory.java:154)
2025-02-04 08:45:33 at java.naming/com.sun.jndi.ldap.LdapCtxFactory.getInitialContext(LdapCtxFactory.java:84)
2025-02-04 08:45:33 at java.naming/javax.naming.spi.NamingManager.getInitialContext(NamingManager.java:520)
2025-02-04 08:45:33 at java.naming/javax.naming.InitialContext.getDefaultInitCtx(InitialContext.java:305)
2025-02-04 08:45:33 at java.naming/javax.naming.InitialContext.init(InitialContext.java:236)
2025-02-04 08:45:33 at java.naming/javax.naming.ldap.InitialLdapContext.<init>(InitialLdapContext.java:154)
2025-02-04 08:45:33 at org.springframework.ldap.core.support.LdapContextSource.getDirContextInstance(LdapContextSource.java:44)
2025-02-04 08:45:33 at org.springframework.ldap.core.support.AbstractContextSource.createContext(AbstractContextSource.java:350)
2025-02-04 08:45:33 ... 138 common frames omitted
2025-02-04 08:45:33 Caused by: java.net.UnknownHostException: ldap
2025-02-04 08:45:33 at java.base/sun.nio.ch.NioSocketImpl.connect(NioSocketImpl.java:567)
2025-02-04 08:45:33 at java.base/java.net.SocksSocketImpl.connect(SocksSocketImpl.java:327)
2025-02-04 08:45:33 at java.base/java.net.Socket.connect(Socket.java:751)
2025-02-04 08:45:33 at java.naming/com.sun.jndi.ldap.Connection.createConnectionSocket(Connection.java:340)
2025-02-04 08:45:33 at java.naming/com.sun.jndi.ldap.Connection.createSocket(Connection.java:283)
2025-02-04 08:45:33 at java.naming/com.sun.jndi.ldap.Connection.<init>(Connection.java:230)


2025-02-04 08:45:33 Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'authorizer': FactoryBean threw exception on object creation
2025-02-04 08:45:33 at org.springframework.beans.factory.support.FactoryBeanRegistrySupport.doGetObjectFromFactoryBean(FactoryBeanRegistrySupport.java:192)
2025-02-04 08:45:33 at org.springframework.beans.factory.support.FactoryBeanRegistrySupport.getObjectFromFactoryBean(FactoryBeanRegistrySupport.java:125)
2025-02-04 08:45:33 at org.springframework.beans.factory.support.AbstractBeanFactory.getObjectForBeanInstance(AbstractBeanFactory.java:1863)
2025-02-04 08:45:33 at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.getObjectForBeanInstance(AbstractAutowireCapableBeanFactory.java:1298)
2025-02-04 08:45:33 at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:346)
2025-02-04 08:45:33 at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:199)
2025-02-04 08:45:33 at org.springframework.beans.factory.config.DependencyDescriptor.resolveCandidate(DependencyDescriptor.java:254)
2025-02-04 08:45:33 at org.springframework.beans.factory.support.DefaultListableBeanFactory.doResolveDependency(DefaultListableBeanFactory.java:1631)
2025-02-04 08:45:33 at org.springframework.beans.factory.support.DefaultListableBeanFactory.resolveDependency(DefaultListableBeanFactory.java:1519)
2025-02-04 08:45:33 at org.springframework.beans.factory.support.ConstructorResolver.resolveAutowiredArgument(ConstructorResolver.java:913)
2025-02-04 08:45:33 at org.springframework.beans.factory.support.ConstructorResolver.createArgumentArray(ConstructorResolver.java:791)
2025-02-04 08:45:33 ... 116 common frames omitted
2025-02-04 08:45:33 Caused by: org.springframework.ldap.CommunicationException: ldap:3890
2025-02-04 08:45:33 at org.springframework.ldap.support.LdapUtils.convertLdapException(LdapUtils.java:107)

[#2]

@Darryl Welcome to the Cloudera Community!

To help you get the best possible solution, I have tagged our NiFi experts @MattWho @mburgess  who may be able to assist you further.

Please keep us updated on your post, and we hope you find a satisfactory solution to your query.

[#3]

Thank you!

[#4]

@Darryl 

Welcome to the Cloudera Community!

From the exception shared the communications exception is Caused by: java.net.UnknownHostException: ldap

You have the ldap-user-group-provider configured in your authorizers.xml with:

<property name="Url">ldap://ldap:3890</property>

But the NiFi host server is unable to resolve "ldap" to an ip address and thus can not communicate with your ldap.  On NiFi startup, it will execute the ldap-user-group-provider to pull in your ldap users and groups based on your ldap search configuration and filters.  If this provider can't execute successfully, NiFi will not continue to start.

Also note that you have the same URL configured in your ldap-provider login-identity-providers.xml file. 

I see other issues you will hit later once get past the above in your ldap-provider.

Also your user search base does not look correct:

<property name="User Search Base">CN=users</property>

Unfortunately without a sample user ldap entry output, I really can't tell you what the correct value would be for your setup, but the Search Base would typically be as follows:
Assume a ldap user has the DN of "cn=John,ou=users,ou=mycompany,ou=nifi".
Your Search Base would be "ou=users,ou=mycompany,ou=nifi"

In your ldap-user-group-provider, you trying to return all entries with uid=* (The "uid=*" search filter is not necessary here) and then extracting the value from the "cn" field as your user identity for each user returned.  However, in your ldap-provider you are expecting users to login with their "sAMAccountName".  Do your ldap user entries even have a "sAMAccountName=" field/entry?  Assuming your ldap does, yoru ldap-provider is configured to use the user's full DN (<property name="Identity Strategy">USE_DN</property>) as the user's identity.  That full DN will not match the user strings being returned by the "cn" field from your ldap-user-group-provider.  
so you should set the below instead in your ldap-provider:

<property name="Identity Strategy">USE_USERNAME</property>

This will result in the username entered at the login window being used upon successful authentication as the user identity in NiFi which will be looked up by the authorizer to determine authorizations.

And if you are logging in user a user's sAMAccountName, then you should set the below in your ldap-user-group-provider:

<property name="User Identity Attribute">sAMAccountName</property>

Please help our community grow and thrive. If you found any of the suggestions/solutions provided helped you with solving your issue or answering your question, please take a moment to login and click "Accept as Solution" on one or more of them that helped.

Thank you,
Matt

[#5]

Thank you Matt for the quick reply!
To give some context, I am simply trying to prove to my team that we can configure Nifi to use LDAP.

I created an LDAP server using Light Ldap which can be found here: https://github.com/lldap/lldap

 I  created some local certs using keytool since the tls toolkit doesn't seem to be in version 2.1 (unless there is another way in the newer versions?)
I have also tried to change the url to localhost instead of ldap
<property name="Url">ldap://localhost:6360</property>
Just not sure how to get the 2 docker containers to talk to each other on my localhost

[#6]

@Darryl 

I understand your use case.  I use LDAP on every NiFi install I have, but I am not running on Docker containers.  I was highlighting the exception cause and other various configuration issues that will block success with your NiFi configuration setup.

As far as making it so your Docker containers can communicate with one another, this discussion in the Docker forum should be able to help you:
https://forums.docker.com/t/how-to-create-a-network-of-containers-that-can-communicate-with-each-oth...

Please help our community grow and thrive. If you found any of the suggestions/solutions provided helped you with solving your issue or answering your question, please take a moment to login and click "Accept as Solution" on one or more of them that helped.

Thank you,
Matt

[#7]

Okay, i may have made some progress. I forgot to add the networks to the ldap container.

I am now seeing this error:

2025-02-04 12:59:29 Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
2025-02-04 12:59:29 at java.base/sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:388)
2025-02-04 12:59:29 at java.base/sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:271)
2025-02-04 12:59:29 at java.base/sun.security.validator.Validator.validate(Validator.java:256)
2025-02-04 12:59:29 at java.base/sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:230)
2025-02-04 12:59:29 at java.base/sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:132)
2025-02-04 12:59:29 at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.checkServerCerts(CertificateMessage.java:1302)
2025-02-04 12:59:29 ... 167 common frames omitted
2025-02-04 12:59:29 Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

nifi.security.autoreload.enabled=false
nifi.security.autoreload.interval=10 secs
nifi.security.keystore=./conf/keystore.p12
nifi.security.keystore.certificate=
nifi.security.keystore.privateKey=
nifi.security.keystoreType=PKCS12
nifi.security.keystorePasswd=password
nifi.security.keyPasswd=password
nifi.security.truststore=./conf/truststore.p12
nifi.security.truststore.certificate=
nifi.security.truststoreType=PKCS12
nifi.security.truststorePasswd=password

I have all of these certs that will get copied into the docker container once it is started up:

[#8]

is there a tls toolkit command in version 2.1?

./bin/tls-toolkit.sh standalone -h

[#9]

@Darryl 

sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

above indicates a trust issue in a TLS handshake.  However, there is not enough logging shared to understand what action occurred leading to this exception.

The ldap-user-group-provider and ldap-provider configurations you shared has this set:

<property name="Authentication Strategy">SIMPLE</property>

SIMPLE does not use TLS, so I don't believe this is where your exception is coming from unless you made other configuration changes there.

My guess would be a Mutual TLS exchange trust issue between nodes in your NiFi cluster resulting in the exception.

No the Toolkit included with NiFi 2 no longer includes the tls-toolkit.  This is because there are som many sites and means to create server and client certificates that this really should not be something the done or maintained by the NiFi service.

That being said:

• you could use the tls-toolkit from a NiFi 1.x to create your certificates.
• You could use an external service to create signed certificates for your NiFi servers.
• You could create self signed certificates manually yourself.

NiFi server certificate minimum requirements are:

• The Keystore can contain only 1 private key entry.
• The Private key entry must support both clientAuth and serverAuth ExtendedKeyUsages
• The private key must contain a SubjectAlternativeName (SAN) entry for the hostname of the server on which the NiFi service is installed.
• Typically you would create a unique private key for each NiFi node.

The truststore can contain 1 too many trusted cert entries (public certificate).  But in order for trust to be established between client and server the truststore must contain the trusted cert entry for the signer of the private key of each NiFi host. 

Please help our community grow and thrive. If you found any of the suggestions/solutions provided helped you with solving your issue or answering your question, please take a moment to login and click "Accept as Solution" on one or more of them that helped.

Thank you,
Matt

[#10]

I changed my setting to use LDAPS. I have now changed it to ANONYMOUS.
I get this error code: 

Caused by: javax.naming.NoPermissionException: [LDAP: error code 50 - No user currently bound]
2025-02-05 09:20:33 at java.naming/com.sun.jndi.ldap.LdapCtx.mapErrorCode(LdapCtx.java:3268)

login-identity-providers.xml

    <provider>

        <identifier>ldap-provider</identifier>

        <class>org.apache.nifi.ldap.LdapProvider</class>

        <property name="Authentication Strategy">ANONYMOUS</property>

        <property name="Manager DN">cn=localhost</property>

        <property name="Manager Password">password</property>

        <property name="TLS - Keystore">./conf/keystore.p12</property>

        <property name="TLS - Keystore Password">password</property>

        <property name="TLS - Keystore Type">PKCS12</property>

        <property name="TLS - Truststore">./conf/truststore.p12</property>

        <property name="TLS - Truststore Password">password</property>

        <property name="TLS - Truststore Type">PKCS12</property>

        <property name="TLS - Client Auth">NONE</property>

        <property name="TLS - Protocol">TLS</property>

        <property name="TLS - Shutdown Gracefully"></property>

        <property name="Referral Strategy">FOLLOW</property>

        <property name="Connect Timeout">10 secs</property>

        <property name="Read Timeout">10 secs</property>

        <property name="Url">ldap://ldap:3890</property>

        <property name="User Search Base">cn=users</property>

<property name="User Search Filter">sAMAccountName={0}</property>

        <!--<property name="User Search Filter">cn={0}</property>-->

        <property name="Identity Strategy">USE_USERNAME</property>

        <property name="Authentication Expiration">12 hours</property>

    </provider>


authorizers.xml

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<authorizers>
<userGroupProvider>
<identifier>file-user-group-provider</identifier>
<class>org.apache.nifi.authorization.FileUserGroupProvider</class>
<property name="Users File">./conf/users.xml</property>
<property name="Legacy Authorized Users File"></property>
<property name="Initial User Identity 1">cn=localhost,ou=ngc</property>
<property name="Initial User Identity 2">CN=localhost,O=ngc,L=San Diego,ST=California,C=US</property>
</userGroupProvider>
<userGroupProvider>
<identifier>ldap-user-group-provider</identifier>
<class>org.apache.nifi.ldap.tenants.LdapUserGroupProvider</class>
<property name="Authentication Strategy">ANONYMOUS</property>
<property name="Manager DN">cn=localhost</property>
<property name="Manager Password">password</property>
<property name="Referral Strategy">FOLLOW</property>
<property name="Connect Timeout">10 secs</property>
<property name="Read Timeout">10 secs</property>
<property name="Url">ldap://ldap:3890</property>
<property name="Page Size"></property>
<property name="Sync Interval">30 mins</property>
<property name="Group Membership - Enforce Case Sensitivity">false</property>
<property name="User Search Base">CN=users</property>
<property name="User Object Class">person</property>
<property name="User Search Scope">ONE_LEVEL</property>
<!--<property name="User Search Filter">(uid=*)</property>
<property name="User Identity Attribute">sAMAccountName</property>-->
<property name="User Group Name Attribute"></property>
<property name="User Group Name Attribute - Referenced Group Attribute"></property>
<property name="Group Search Base"></property>
<property name="Group Object Class">group</property>
<property name="Group Search Scope">ONE_LEVEL</property>
<property name="Group Search Filter"></property>
<property name="Group Name Attribute"></property>
<property name="Group Member Attribute"></property>
<property name="Group Member Attribute - Referenced User Attribute"></property>
</userGroupProvider>
<userGroupProvider>
<identifier>composite-configurable-user-group-provider</identifier>
<class>org.apache.nifi.authorization.CompositeConfigurableUserGroupProvider</class>
<property name="Configurable User Group Provider">file-user-group-provider</property>
<property name="User Group Provider 1">ldap-user-group-provider</property>
</userGroupProvider>

<accessPolicyProvider>
<identifier>file-access-policy-provider</identifier>
<class>org.apache.nifi.authorization.FileAccessPolicyProvider</class>
<property name="User Group Provider">composite-configurable-user-group-provider</property>
<property name="Authorizations File">./conf/authorizations.xml</property>
<property name="Initial Admin Identity">cn=localhost,ou=ngc</property>
<property name="Legacy Authorized Users File"></property>
<property name="Node Group"></property>
</accessPolicyProvider>
<authorizer>
<identifier>managed-authorizer</identifier>
<class>org.apache.nifi.authorization.StandardManagedAuthorizer</class>
<property name="Access Policy Provider">file-access-policy-provider</property>
</authorizer>
</authorizers>