Support Questions

Find answers, ask questions, and share your expertise

How to enable User Authentication with Kerberos in nifi 1.x

avatar
Rising Star

There is a page to enable User Authentication with Kerberos step by step for nifi 0.x

https://community.hortonworks.com/articles/34147/nifi-security-user-authentication-with-kerberos.htm...

But nifi 1.x change the conf. I follow parts of steps as above, and then login with username/password . But I get following message:

"Unable to perform the desired action due to insufficient permissions. Contact the system administrator."

(it seem that the username/password has been authed by kerberos )

How to resolve? Thanks for you reply.

@Jobin George: please update your article. Thanks very much.

1 ACCEPTED SOLUTION

avatar
Master Mentor
@David DN

NiFi 1.x (HDF 2.x) versions have gone through a major framework upgrade/change. A multi-tenancy approach has been added that allows users to control the access of users down to the component level. As part of this change, the way the initial admin user is added has changed. In previous NiFi 0.x (HDF 1.x) versions, this was simply done by adding the DN of your first admin user to the authorized-users.xml file. In NiFi 1.x (HDF 2.x) versions you need to set that user DN in the following property in the authorizers.xml file:

<property name="Initial Admin Identity"></property>

For those who previously worked with NiFi 0.x (HDF 1.x) versions, you can use an old authorized-users.xml file to seed the new NiFi version's user authorization by setting this property in the same file:

<property name="Legacy Authorized Users File"></property>

NiFi 1.x (HDF 2.x) version no longer provide new users the ability to "request access". An Admin will need to manually added each users and assign them component level access through the UI.

adding new users is done through the users UI found in the hamburger menu in the upper right corner of the UI. (Remember this can only be done once initial admin as given access as described above).

7145-screen-shot-2016-08-31-at-80708-am.png

From the Users UI, select the add user icon in the upper right corner 7146-screen-shot-2016-08-31-at-80954-am.png:

7147-screen-shot-2016-08-31-at-81037-am.png

The above UI will appear to add your new users. Supply your kerberos, LDAP, or certificate DN and click "OK"

Now that you have added a user you need grant them component level access back on the main NiFi UI.

Select the component you which to control access to. In the below example we will select the root canvas:

7148-screen-shot-2016-08-31-at-81919-am.png

A new "Access Policies" Ui will appear where you need select the access policy you want to add the user to from the pull down menu:

7149-screen-shot-2016-08-31-at-81858-am.png

Once you select Policy, click on the add user icon in the upper right to grant access to one of the users added earlier.

Thanks,

Matt

View solution in original post

11 REPLIES 11

avatar
Explorer

@Matt

Thank you, It works now!

avatar
Master Mentor

NiFi 1.x was just officially released yesterday. HDF 2.x has not been released yet (look for it soon). @Jobin George article is still valid for the NiFi 0.x (HDF 1.x) versions. A new article should be written for the new versions.