NIFI - Unknown user with identity 'user'. Contact the system administrator.

Hi @yagoaparecidoti,

Seems due to the configs NiFi is just using the identity instead of the complete DN. Without having more information you could try the following:

1. Change the initial admin identity to "user.bind"

2. Save and stop nifi

3. Remove the current users.xml and authorizations.xml from /var/lib/nifi

4. Start NiFi. 

It should recreate the users.xml and authorizations.xml files, please note that any customizations will be lost and will need to be recreated.

@yagoaparecidoti 

NiFi will treat the identity strings "user.bind" and  "cn=user.bind,ou=USERS,ou=CLOUDERA,dc=lab,dc=local" as two different users.

The identity string being passed to NiFi configured authorizer post successful authentication in yoru current configuration is "user.bind".  However, it appears you have configured your initial admin configured in the authorizers.xml configuration file as "cn=user.bind,ou=USERS,ou=CLOUDERA,dc=lab,dc=local" which resulted in admin policies being initially setup in the authorizations.xml and users.xml files as this string.

Now within the login-identity-providers.xml file you have your ldap-provider configured which is handling your authentication.  One of the configurable properties in that ldap-provider can be configured two ways:

<property name="Identity Strategy">USE_USERNAME</property>

<property name="Identity Strategy">USE_DN</property>

USE_USERNAME setting will pass whatever string was entered in the username login window to the authorizer if authentication was successful.
USE_DN setting will pass the users DN (post any matching identity mapping pattern modification) to the authorizer.

So you are either using the USE_USERNAME option or you have a identity mapping pattern configured in your nifi.properties file that is matching on the full DN returned by USE_DN and trimming just the "user.bind" from that DN before being passed to the Authorizer.

Example:
nifi.security.identity.mapping.pattern.dn=^cn=(.*?),ou=(.*?),ou=(.*?),dc=lab,dc=(.*?)$
nifi.security.identity.mapping.value.dn=$1
nifi.security.identity.mapping.transform.dn=LOWER

Above PATTERN would match "cn=user.bind,ou=USERS,ou=CLOUDERA,dc=lab,dc=local"
and only capture group one ($1) "user.bind" VALUE would be returnedin all LOWERCASE (TRANSFORM).

https://nifi.apache.org/docs/nifi-docs/html/administration-guide.html#identity-mapping-properties

One other important thing to keep in mind here.  The file-access-policy and file-user-group-providers in the authorizers.xml file will ONLY build the authorizations.xml and users.xml files if they do NOT already exist.  So if you edit the configured initial admin string, what is already configured in those files will not get modified and that configuration change will have not affect.  If you remove the existing users.xml and authorizations.xml files before restarting your NiFi if you decide to change your Initial Admin identity string, then on restart a new users.xml and authorizations.xml will be created with your change.

If you found this response assisted with your query, please take a moment to login and click on "Accept as Solution" below this post.

Thank you,

Matt

@yagoaparecidoti Has the reply helped resolve your issue? If so, please mark the appropriate reply as the solution, as it will make it easier for others to find the answer in the future. Thanks