Support Questions
Find answers, ask questions, and share your expertise

Nifi Registry + openid ?

Contributor

Hi, is there a way to login to NiFi registry via openid (ej google)?

I'm thinking of how I can secure the instance without a domain like in NiFi

Thanks!

1 ACCEPTED SOLUTION

Accepted Solutions

Re: Nifi Registry + openid ?

Master Guru

@Alexandros 

Securing NiFi and NiFi-registry will always require TLS certificates.  There are then numerous options for authentication in to those secured sevices.

Both NiFi and NiFi Registry both offer:

1. User based certificate authentication.  You would need to create a user certificate for each user who will access NiFi or NiFi-registry
2. Spnego - This requires that you have a KDC and your users have Spnego enabled in their browser
3. LDAP/AD user authentication.  You would need to have your own LDAP/AD setup which you can use to authenticate your users.
4. kerberos login provider.  This would require you to setup your own KDC as well.

NiFi also supports OpenID connect compatible service based authentication; however, the same is not offered in NiFi-Registry.  The jira for adding OpenID connect capability to NiFi-Registry is still open here:
https://issues.apache.org/jira/browse/NIFIREG-313

So based on options above and depending on the number of users you want to give access to, your best options are either by issuing each of your users a user/client certificate or setting up a simple LDAP server or KDC server.

 

Hope this helps,

Matt

View solution in original post

1 REPLY 1

Re: Nifi Registry + openid ?

Master Guru

@Alexandros 

Securing NiFi and NiFi-registry will always require TLS certificates.  There are then numerous options for authentication in to those secured sevices.

Both NiFi and NiFi Registry both offer:

1. User based certificate authentication.  You would need to create a user certificate for each user who will access NiFi or NiFi-registry
2. Spnego - This requires that you have a KDC and your users have Spnego enabled in their browser
3. LDAP/AD user authentication.  You would need to have your own LDAP/AD setup which you can use to authenticate your users.
4. kerberos login provider.  This would require you to setup your own KDC as well.

NiFi also supports OpenID connect compatible service based authentication; however, the same is not offered in NiFi-Registry.  The jira for adding OpenID connect capability to NiFi-Registry is still open here:
https://issues.apache.org/jira/browse/NIFIREG-313

So based on options above and depending on the number of users you want to give access to, your best options are either by issuing each of your users a user/client certificate or setting up a simple LDAP server or KDC server.

 

Hope this helps,

Matt

View solution in original post