Created 03-13-2017 06:09 PM
getting this exception on UI:
Unable to perform the desired action due to insufficient permissions. Contact the system administrator.
As i have configured nifi.properties.
initial-user.identity.
ldap settings even then not able to login.
Created 03-14-2017 02:46 PM
Want to get a detailed solution you have to login/registered on the community
Register/LoginCreated on 03-13-2017 06:32 PM - edited 08-18-2019 05:29 AM
Accessing the NiFi UI requires to things to be successful:
1. User Authentication: You appear to be using LDAP to handle this part.
2. User Authorization: By default NiFi uses its internal file based authorizer (Configured in authorizers.xml)
If an authenticated user lacks sufficient authorization to access a NiFi resource, you will see the "Unable to perform the desired action due to insufficient permissions. Contact the system administrator." response from NiFi.
In order for an authenticated user to see the NiFi UI, they must at a minimum be granted the "view the user interface" access policy. Whichever user was configured as your "Initial admin Identity" will need to access the UI and add additional users and access policies for those users.
Also keep in mind that NiFi generates the users.xml and authorizations.xml files only once the first time your NiFi is started securely. If you update who your initial admin identity is later, it will not get updated if these files already exist. If this is the first time setting up a new system, simply delete the users.xml and authorizations.xml files and restart NiFi. They will then be created again based on the current configurations in the authorizers.xml.
Before updating your initial admin identity in the authorizers.xml file, I suggest looking in your nifi-user.log to versify the exact string being passed to the authorizer. It must match exactly since it is case sensitive and spaces also count as valid characters. (for example: CN= is not the same as cn=) The string you see output in the nifi-user.log is what will be passed to the authorizer.
Thanks,
Matt
Created 03-14-2017 11:23 AM
Hi Matt C,
Now getting login promt but not able to login and it gives me a message mentioned below
Access Denied
Unable to perform the desired action due to insufficient permissions. Contact the system administrator.
Thanks
Matt N
Created 03-14-2017 12:21 PM
Hi Matt,
Just want to update you on the below issue as we are getting exception in the logs that
Unknown user with identity 'employeenumber= ....
so seems like it is not picking the user provided in the authorised.xml as we are following the suggested way by deleting the user.xml and authorizations.xml before starting nifi.
Appreciate for any further advice.
Thanks
Matt
Created 03-14-2017 10:18 AM
Thanks for the reply Matt.
But the the issue is we have diffrent CN,Ou parameter for Ldap and the certificate we are using have diffrent CN and ou etc entries.
so i have installed the certificate in browser and got the parameters of my certificate in my user.logs but i have tried working with those parameter as suggested by you but still getting the same exception on ui .
Unable to perform the desired action due to insufficient permissions. Contact the system administrator
Not sure where i am wrong now.
Please suggest .
Thanks
Matt
Created 03-14-2017 11:08 AM
Hi Matt C,
Now getting login promt but not able to login and it gives me a message mentioned below
Access DeniedUnable to perform the desired action due to insufficient permissions. Contact the system administrator.
Thanks
Matt N
Created 03-14-2017 02:46 PM
Want to get a detailed solution you have to login/registered on the community
Register/LoginCreated 09-15-2021 03:11 PM
Hello Matt- really appreciate how active you are in this community, I see your helpful answers everywhere.
I'm getting the same error as the OP, I was wondering if you could help.
When I cat users.xml my user is there (CN,DC are capitalized in the cert itself and in the log, but lowercase in the file)
When I check authorizations.xml, my user id is given access to everything I need I believe:
<policies>
<policy identifier="f99bccd1-a30e-3e4a-98a2-dbc708edc67f" resource="/flow" action="R">
<user identifier="b54195a2-7067-3bf3-a33b-f09e6c3caafe"/>
</policy>
<policy identifier="b8775bd4-704a-34c6-987b-84f2daf7a515" resource="/restricted-components" action="W">
<user identifier="b54195a2-7067-3bf3-a33b-f09e6c3caafe"/>
</policy>
<policy identifier="627410be-1717-35b4-a06f-e9362b89e0b7" resource="/tenants" action="R">
<user identifier="b54195a2-7067-3bf3-a33b-f09e6c3caafe"/>
</policy>
<policy identifier="15e4e0bd-cb28-34fd-8587-f8d15162cba5" resource="/tenants" action="W">
<user identifier="b54195a2-7067-3bf3-a33b-f09e6c3caafe"/>
</policy>
<policy identifier="ff96062a-fa99-36dc-9942-0f6442ae7212" resource="/policies" action="R">
<user identifier="b54195a2-7067-3bf3-a33b-f09e6c3caafe"/>
</policy>
<policy identifier="ad99ea98-3af6-3561-ae27-5bf09e1d969d" resource="/policies" action="W">
<user identifier="b54195a2-7067-3bf3-a33b-f09e6c3caafe"/>
</policy>
<policy identifier="2e1015cb-0fed-3005-8e0d-722311f21a03" resource="/controller" action="R">
<user identifier="b54195a2-7067-3bf3-a33b-f09e6c3caafe"/>
</policy>
<policy identifier="c6322e6c-4cc1-3bcc-91b3-2ed2111674cf" resource="/controller" action="W">
<user identifier="b54195a2-7067-3bf3-a33b-f09e6c3caafe"/>
</policy>
</policies>
So I don't know what else may be causing this. Let me know if you see anything.
Created 09-15-2021 11:15 PM
@Ronman as this is an older post, you would have a better chance of receiving a resolution by starting a new thread. This will also be an opportunity to provide details specific to your environment that could aid others in assisting you with a more accurate answer to your question. You can link this thread as a reference in your new post.
Regards,
Vidya Sargur,