Nifi LDAP user login issue.

[#1]

Hello Team,

I have configured apache Nifi and integrated with LDAP, now when i try to login it gives below error.

Insufficient Permissions

• log out
• home

Unknown user with identity 'cn=Mohit Kumar,ou=FM-Users,ou=Managed services,dc=CORP,dc=SA,dc=ZAIN,dc=COM'. Contact the system administrator.

==

my login-identity-providers.xml

-->
<provider>
<identifier>ldap-provider</identifier>
<class>org.apache.nifi.ldap.LdapProvider</class>
<property name="Authentication Strategy">SIMPLE</property>

<property name="Manager DN">CN=***********,OU=Groups,OU=*********,OU=********,DC=CORP,DC=SA,DC=ZAIN,DC=COM</property>
<property name="Manager Password">**********</property>

<property name="TLS - Keystore"></property>
<property name="TLS - Keystore Password"></property>
<property name="TLS - Keystore Type"></property>
<property name="TLS - Truststore"></property>
<property name="TLS - Truststore Password"></property>
<property name="TLS - Truststore Type"></property>
<property name="TLS - Client Auth"></property>
<property name="TLS - Protocol"></property>
<property name="TLS - Shutdown Gracefully"></property>

<property name="Referral Strategy">FOLLOW</property>
<property name="Connect Timeout">10 secs</property>
<property name="Read Timeout">10 secs</property>

<property name="Url">ldap://****************:389</property>
<property name="User Search Base">OU=Managed services,DC=CORP,DC=SA,DC=ZAIN,DC=COM</property>
<property name="User Search Filter">sAMAccountName={0}</property>

<property name="Identity Strategy">USE_DN</property>
<property name="Authentication Expiration">12 hours</property>
</provider>

=======

my conf/authorizers.xml

=====

<authorizers>
<userGroupProvider>
<identifier>file-user-group-provider</identifier>
<class>org.apache.nifi.authorization.FileUserGroupProvider</class>
<property name="Users File">./conf/users.xml</property>
<property name="Legacy Authorized Users File"></property>

<property name="Initial User Identity 1">CN=Mohit Kumar,OU=FM-Users,OU=Managed services,DC=CORP,DC=SA,DC=ZAIN,DC=COM</property>
</userGroupProvider>
<accessPolicyProvider>
<identifier>file-access-policy-provider</identifier>
<class>org.apache.nifi.authorization.FileAccessPolicyProvider</class>
<property name="User Group Provider">file-user-group-provider</property>
<property name="Authorizations File">./conf/authorizations.xml</property>
<property name="Initial Admin Identity">CN=Mohit Kumar,OU=FM-Users,OU=Managed services,DC=CORP,DC=SA,DC=ZAIN,DC=COM</property>
<property name="Legacy Authorized Users File"></property>

<property name="Node Identity 1"></property>
</accessPolicyProvider>
<authorizer>
<identifier>managed-authorizer</identifier>
<class>org.apache.nifi.authorization.StandardManagedAuthorizer</class>
<property name="Access Policy Provider">file-access-policy-provider</property>
</authorizer>
</authorizers>

=======

ldapsearch shows this user

# filter: sAMAccountName=mohit.kumar
# requesting: ALL
#

# Mohit Kumar, FM-Users, Managed services, CORP.SA.ZAIN.COM
dn: CN=Mohit Kumar,OU=FM-Users,OU=Managed services,DC=CORP,DC=SA,DC=ZAIN,DC=COM

Please help me to fix this issue.

[#2]

Hi @cotopaul @SAMSAL @MattWho @steven-matison

Kindly help me to fix the issue.

user logs are below.

2023-05-23 02:52:25,863 INFO [main] o.a.n.a.FileUserGroupProvider Users/Groups file loaded at Tue May 23 02:52:25 EDT 2023
2023-05-23 02:52:25,864 INFO [main] o.a.n.a.FileAccessPolicyProvider Creating new authorizations file at /var/nifi/./conf/authorizations.xml
2023-05-23 02:52:26,254 INFO [main] o.a.n.a.FileAccessPolicyProvider Populating authorizations for Initial Admin: CN=mohit.kumar,OU=Managed services,DC=CORP,DC=SA,DC=ZAIN,DC=COM
2023-05-23 02:52:26,260 INFO [main] o.a.n.a.FileAccessPolicyProvider Authorizations file loaded at Tue May 23 02:52:26 EDT 2023
2023-05-23 02:52:26,263 INFO [main] o.a.n.a.FileUserGroupProvider Users/Groups file loaded at Tue May 23 02:52:26 EDT 2023
2023-05-23 02:52:26,268 INFO [main] o.a.n.a.FileAccessPolicyProvider Authorizations file loaded at Tue May 23 02:52:26 EDT 2023
2023-05-23 02:52:43,772 INFO [NiFi Web Server-24] o.a.n.w.s.NiFiAuthenticationFilter Authentication Started 192.168.32.206 [<anonymous>] GET https://10.*.*.*:9443/nifi-api/flow/current-user
2023-05-23 02:52:43,776 INFO [NiFi Web Server-24] o.a.n.w.s.NiFiAuthenticationFilter Authentication Success [anonymous] 192.168.32.206 GET https://10.*.*.*:9443/nifi-api/flow/current-user
2023-05-23 02:52:43,891 INFO [NiFi Web Server-24] o.a.n.w.a.c.AccessDeniedExceptionMapper identity[anonymous], groups[none] does not have permission to access the requested resource. Unknown user with identity 'anonymous'. Returning Unauthorized response.
2023-05-23 02:53:37,220 INFO [NiFi Web Server-21] o.a.n.w.a.c.AccessDeniedExceptionMapper identity[mohit.kumar], groups[] does not have permission to access the requested resource. Unknown user with identity 'mohit.kumar'. Returning Forbidden response.

[#3]

@mks27,

To be really honest, when it comes to login and certificates, I am in no position to provide an input, as I never got to fully understand how they work 😞

While you are waiting for a better answer, from somebody with far more experience and knowledge as me, I would try the following:
- Assuming that you configured LDAP authentication, I assume that you have the User and Policies Menu in your NiFi Menu (top Right).
- Now, based on your error, I see that you are using the user mohit.kumar and you have no privileges to do anything.
- What I would suggest is to login with the user which was provided as Initial Admin Identity and provide your user (mohit.kumar) with all the necessary roles to perform the action you are trying to perform.

See: https://nifi.apache.org/docs/nifi-docs/html/administration-guide.html#initial-admin-identity
Have a look here as well: https://pierrevillard.com/2017/01/24/integration-of-nifi-with-ldap/comment-page-1/