Getting untrusted proxy message while trying to setup secure NIFI cluster

[#1]

I'm trying to setup 4 node secure NIFI cluster. I have added all the required properties, i can see nodes sending heartbeats in logs but on screen i'm getting Untrusted proxy message. error screen shot attached.

authorizers.xml contains -

<authorizer>

<identifier>file-provider</identifier>

<class>org.apache.nifi.authorization.FileAuthorizer</class>

<property name="Authorizations File">./conf/authorizations.xml</property>

<property name="Users File">./conf/users.xml</property>

<property name="Initial Admin Identity">CN=myAdmin, OU=MY-ORG</property>

<property name="Legacy Authorized Users File"></property>

<property name="Node Identity 1">CN=hostname1, OU=NIFI</property>

<property name="Node Identity 2">CN=hostname2, OU=NIFI</property>

<property name="Node Identity 3">CN=hostname3, OU=NIFI</property>

<property name="Node Identity 4">CN=hostname4, OU=NIFI</property>

</authorizer>

[#2]

Was the DN in the access denied message one of the DNs in the Node Identities?

Every node in the cluster needs to have READ access on /proxy which is defined through the global policies in the top right menu. The Node Identities should get this policy automatically, but you can double check if your node is in the list for /proxy, and if not add it.

[#3]

yes mentioned DN was part of Node identities.

what is /proxy? cannot find it under nifi setup. is it an autogenerated file?

[#4]

It is a resource identifier for a policy that should be auto-generated for each node that you put in "Node Identities". Normally you would go to the UI and go to the global policies from the top-right menu, but since you can't get into the UI you can check the users.xml and authorizations.xml. There should be a user for each cluster node in users.xml, and there should be a policy in authorizations.xml for /proxy that all the cluster node users belong to.

[#5 · Accepted solution]

@Ankit Jain

When a secure NiFi is started for the first time, a users.xml and authorizations.xml file is generated.

The users.xml that is created will have your users added to it using the provided DN form your authorizers.xml file:

Initial Admin Identity

Node Identity 1

Node Identity 2

Node Identity 3

Node Identity 4

etc...

Each of those "users" are assigned a UUID which is then used to set some required policies in the authorizations.xml file in order to be able to access the NiFi UI.

At a minimum, all "Node Identity" DN's UUIDs need to be assigned to the /proxy resource (Policy) and /flow (read/R )resource inside that file.

You "Initial Admin" DN should have /flow (READ/R and Write/W) and /policies (R and W).

If NiFi was secured and started prior to some or all of the above DNs being set in the authorizers.xml, the users.xml and authorizations.xml files will be created without any entries. Updates to these DN properties in the authorizers.xml file later will not cause updated to occur two these files. If you find this is what occurred in your case, you can stop your NiFi nodes, deleted both the users.xml and authorizations.xml files from all nodes and restart. On restart NiFi will again generate these files since they do not exist using the DNs in your authorizers.xml file on each node.

Thanks,

Matt

[#6]

From our experience, if you are going to setup SSL, you Must setup the Authorization services first. If you are going to try to leverage Ranger to do the authentication/authorizations, you will find you need SSL setup first. So, to do that, you must set up the Authorizations to another source before attempting to enable SSL. You will get very interesting messages if you don't, and could end up spending days on a wrong path troubleshooting those. The error you are seeing, is because of the intra-cluster communications identifying itself as the DN (from the ssl key). The Node Identity is not yet setup, and that is the error you are getting.

The instructions provided above (by mclark) assume that you are going to have a unique key per server, and would use the CN for each server to identify the Node. It is possible to have just 1 key used on all nodes though. In that case, you would just set 1 Node Identity, and use that DN.

So, if you are gettting Untrusted proxy EMAILADDRESS=NIFI-support@apache.com, CN=vanityalias.mycompany.com, OU=Tech, O=NIFI Services, L=City, ST=STATE, C=US Then, your node identity in the authorizers.xml would be set to <property name="Node Identity 1">EMAILADDRESS=NIFI-support@apache.com, CN=vanityalias.mycompany.com, OU=Tech, O=NIFI Services, L=City, ST=STATE, C=US</property>

If you have a key per server, just add the DN for each key to the appropriate Node Identity in that file.

I highly recommend reading Bryan's blog around "apache-nifi-1-0-0-authorization-and-multi-tenancy" if you are reading this comment.

[#7]

step1 :

remove the authorization.xml from all the nodes

rm /var/lib/nifi/conf/authorizations.xml

step2 :

update node identities in advanced_nifi_ambari_ssl_configuration section with

<property name="Node Identity 1">CN=hostname1, OU=XXXXX</property>

...

for all the nodes (make sure you remove comment tags in XML).

step3 :

restart the NiFi service

found that authorizations.xml is not being update after first generation, hence this is causing the problem.