Support Questions

Find answers, ask questions, and share your expertise
Announcements
Celebrating as our community reaches 100,000 members! Thank you!

NiFi privilege - Allow modify but not operate component

avatar
Rising Star

Hello

I'm trying to create NiFi user to modify the component but can't operate it. This is needed to segregate the duties where someone will create and components and another one will run them. I tried the current privileges but when I set the "Modify component" privilege. The user is able to operate as well even if I removed the "Operate" Privilege

can you help ?

Screenshots for test user

1 ACCEPTED SOLUTION

avatar
Guru

Hi @Yahya Najjar

The "operate the component" policy was added to support a role where a user could only start/stop components (https://issues.apache.org/jira/browse/NIFI-375). That can be implemented by removing the user from the "modify the component" policy and adding the user to the "operate the component" policy.

What you are trying to accomplish is to have a user that can only modify and not operate, which is not currently supported. The way the "modify the component" policy is implemented, if the user is on that policy, the user can also start/stop components. This supports what is likely the more common scenario: a user who can change a component can also operate it.

If you feel NiFi needs to support your use case and would like to see if others in the NiFi community agree, please file an enhancement Jira in the NiFi project (https://issues.apache.org/jira/projects/NIFI/summary).

View solution in original post

3 REPLIES 3

avatar
Guru

Hi @Yahya Najjar

The "operate the component" policy was added to support a role where a user could only start/stop components (https://issues.apache.org/jira/browse/NIFI-375). That can be implemented by removing the user from the "modify the component" policy and adding the user to the "operate the component" policy.

What you are trying to accomplish is to have a user that can only modify and not operate, which is not currently supported. The way the "modify the component" policy is implemented, if the user is on that policy, the user can also start/stop components. This supports what is likely the more common scenario: a user who can change a component can also operate it.

If you feel NiFi needs to support your use case and would like to see if others in the NiFi community agree, please file an enhancement Jira in the NiFi project (https://issues.apache.org/jira/projects/NIFI/summary).

avatar
Rising Star

Many thanks for your advise, I filed a jira for that.

avatar
Guru

No problem, glad the advice was helpful. For others following this thread, the Jira filed is:

https://issues.apache.org/jira/browse/NIFI-5934