@yoonli
That issue is unrelated to the issue here with getting your NiFi authorizer setup correctly. Glad you were able to get that resolved. If the feedback helped you resolve that issue, please accept that solution to help others in the community.
What you are describing now is a missing authorization policy for your admin user. When NiFi's authorizer seeds the initial policies for the "admin" user, that does not mean the admin user has been given all access. It seeds the policies the admin user would need to access the UI and manage/modify authorizations for all users.
The dataflow construction icon along the top of the UI are only visible to users who have been authorized on the Process Group (PG) being displayed. When NiFi is started for the first time it has no flow.json.gz file to load, so it generates one. That flow.json.gz will contain the root PG (NiFi default names the root PG "NiFi Flow"). Since your admin user is not authorized yet on this root PG, all the icons are greyed out. You'll also notice in the lower left corner or the UI and in the "Operation" panel on left side of canvas that the PG displays a UUID instead of the name "NiFi Flow".
Now your admin user would have the authorization set to global manage authorization policies, so in that "Operations" panel you should see a key icon that is not greyed out.
Clicking on that key will allow you admin to authorize users (including the admin user) to the authorizations polices specific to that PG:
Select the Policy from the drop down you want to modify and you'll see a list of users and/or groups already authorized (I expect your's will be blank). After selecting the policy, you'll see an "Add users/groups to this policy" icon to the far right.
Click on that and locate your admin user identity from the displayed list and click apply.
View the component - will allow and authorized user to view details and configuration of a component. If that component is a process group, this authorization will be inherited by all components (processors, controller services, child process groups, etc) added to the canvas of that process group. But you have the ability to set authorizations explicitly on any component directly. So after setting this one you should start seeing "NiFi flow" PG name.
Modify the component - will allow you to make changes. For a PG this means making all the construct icon to become available to you along the top of the UI.
Please help our community grow. If you found any of the suggestions/solutions provided helped you with solving your issue or answering your question, please take a moment to login and click "Accept as Solution" on one or more of them that helped.
Thank you,
Matt
@yoonli
Did you setup your authorizers.xml with cluster recommended structure i outlined earlier:
From the log shared you can see following cause for your issue:
Caused by: org.apache.nifi.authorization.exception.AuthorizerCreationException: org.apache.nifi.authorization.exception.AuthorizerCreationException: Unable to locate node CN=nifi-cluster, OU=NiFi, O=NiFi Cluster, L=Hanoi, ST=HaNoi, C=VN to seed policies.What this exception tells me is that you added your node's certificate DN to the file-access-policy-provider only. So on startup the file-access-policy-provider is attempting to seed NiFi nodes policies for that user identity, but it could not find that user identity because none of the configured user-group providers in the authorizers.xml created it.
Since this user identity derived from your node's certificate DN is not being returned by your ldap-user-group-provider, it would need to be returned by the file-user-group-provider.
For clarity, you are logging in just fine with your user. What is happening is your are logging into just one of yoru NiFi cluster nodes. So upon successful authentication the request to see the UI is sent to the elected cluster coordinator and replicated to all nodes in the cluster on your behalf. This is where the node is the proxy doing this for your successfully authenticated user. So you node is not authorized to proxy user requests. Replicating the user requests is required so changes are made all nodes in the cluster and so one node's UI can show data from all connected nodes.
Please help our community grow. If you found any of the suggestions/solutions provided helped you with solving your issue(s) or answering your question(s), please take a moment to login and click "Accept as Solution" on one or more of them that helped.
Thank you,
Matt
@yoonli
That issue is unrelated to the issue here with getting your NiFi authorizer setup correctly. Glad you were able to get that resolved. If the feedback helped you resolve that issue, please accept that solution to help others in the community.
What you are describing now is a missing authorization policy for your admin user. When NiFi's authorizer seeds the initial policies for the "admin" user, that does not mean the admin user has been given all access. It seeds the policies the admin user would need to access the UI and manage/modify authorizations for all users.
The dataflow construction icon along the top of the UI are only visible to users who have been authorized on the Process Group (PG) being displayed. When NiFi is started for the first time it has no flow.json.gz file to load, so it generates one. That flow.json.gz will contain the root PG (NiFi default names the root PG "NiFi Flow"). Since your admin user is not authorized yet on this root PG, all the icons are greyed out. You'll also notice in the lower left corner or the UI and in the "Operation" panel on left side of canvas that the PG displays a UUID instead of the name "NiFi Flow".
Now your admin user would have the authorization set to global manage authorization policies, so in that "Operations" panel you should see a key icon that is not greyed out.
Clicking on that key will allow you admin to authorize users (including the admin user) to the authorizations polices specific to that PG:
Select the Policy from the drop down you want to modify and you'll see a list of users and/or groups already authorized (I expect your's will be blank). After selecting the policy, you'll see an "Add users/groups to this policy" icon to the far right.
Click on that and locate your admin user identity from the displayed list and click apply.
View the component - will allow and authorized user to view details and configuration of a component. If that component is a process group, this authorization will be inherited by all components (processors, controller services, child process groups, etc) added to the canvas of that process group. But you have the ability to set authorizations explicitly on any component directly. So after setting this one you should start seeing "NiFi flow" PG name.
Modify the component - will allow you to make changes. For a PG this means making all the construct icon to become available to you along the top of the UI.
Please help our community grow. If you found any of the suggestions/solutions provided helped you with solving your issue or answering your question, please take a moment to login and click "Accept as Solution" on one or more of them that helped.
Thank you,
Matt
