Support Questions
Find answers, ask questions, and share your expertise
Announcements
Alert: Welcome to the Unified Cloudera Community. Former HCC members be sure to read and learn how to activate your account here.

NiFi support for Active Directory Groups

Solved Go to solution

NiFi support for Active Directory Groups

New Contributor

I'm trying to permission NiFi using Active Directory groups.

I'm aware there is a problem using groups in AD with the NiFi-Ranger plugin, but I'm attempting to authorize using the Kerberos identity provider and and the file provider within NiFi itself.

Is there any way to pull in AD groups into the NiFi application, and use them to authorize access? Ideally I don't want to create static groups in NiFi that contain my principals, which are updated manually.

As a fallback I was considering writing a script that generates NiFi groups based on an ldapsearch and populates it with the relevant principals.

1 ACCEPTED SOLUTION

Accepted Solutions

Re: NiFi support for Active Directory Groups

Master Guru

@Oliver Fletcher

Authentication and authorization are two separate processes within NiFi.

There is no way currently for NiFi to pull LDAP groups in to its authorizer. While NiFi's file based local authorizer does support groups, those groups are not mapped to any LDAP groups. With NiFi's latest release authentication via LDAP supports only two "Identity Strategies":

Identity Strategy Strategy to identify users. Possible values are USE_DN and USE_USERNAME. The default functionality if this property is missing is USE_DN in order to retain backward compatibility. USE_DN will use the full DN of the user entry if possible. USE_USERNAME will use the username the user logged in with.

So either the DN returned by LDAP (USE_DN) or the username enter on the login screen (USE_USERNAME) is passed to the authorizer post any configured pattern mapping. There are currently is no Strategy for passing the user's LDAP group to the authorizer.

NiFi has no support for Ranger groups as you are already aware. However, you could create a set of groups in NiFi's local file based authorizers that each provide a distinct set of access policies. You could then use your script idea to conduct ldap searches and map users DNs or usernames to those specific NiFi groups. You scripts could make calls to the nifi-api to automate adding these users to the those groups.

Thanks,

Matt

1 REPLY 1

Re: NiFi support for Active Directory Groups

Master Guru

@Oliver Fletcher

Authentication and authorization are two separate processes within NiFi.

There is no way currently for NiFi to pull LDAP groups in to its authorizer. While NiFi's file based local authorizer does support groups, those groups are not mapped to any LDAP groups. With NiFi's latest release authentication via LDAP supports only two "Identity Strategies":

Identity Strategy Strategy to identify users. Possible values are USE_DN and USE_USERNAME. The default functionality if this property is missing is USE_DN in order to retain backward compatibility. USE_DN will use the full DN of the user entry if possible. USE_USERNAME will use the username the user logged in with.

So either the DN returned by LDAP (USE_DN) or the username enter on the login screen (USE_USERNAME) is passed to the authorizer post any configured pattern mapping. There are currently is no Strategy for passing the user's LDAP group to the authorizer.

NiFi has no support for Ranger groups as you are already aware. However, you could create a set of groups in NiFi's local file based authorizers that each provide a distinct set of access policies. You could then use your script idea to conduct ldap searches and map users DNs or usernames to those specific NiFi groups. You scripts could make calls to the nifi-api to automate adding these users to the those groups.

Thanks,

Matt