- Subscribe to RSS Feed
- Mark Question as New
- Mark Question as Read
- Float this Question for Current User
- Bookmark
- Subscribe
- Mute
- Printer Friendly Page
Ranger user sync issue for Nifi
- Labels:
-
Apache NiFi
-
Apache Ranger
Created ‎06-08-2017 11:26 AM
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Team,
I have configured Ranger for Nifi and ranger already synced with LDAP, do i need to create user in ranger with DN to access nifi eventhough its synced already?
synced username : anish
Manually created username in Ranger : CN=anish, OU=User, OU=Accounts, OU=ITSC, DC=zone1, DC=dcb, DC=net (why its required when its already synced with LDAP?)
because its working if i created user in Ranger else i am getting below error
2017-06-08 09:56:25,528 INFO [NiFi Web Server-1043] o.a.n.w.a.c.AccessDeniedExceptionMapper CN=anish, OU=User, OU=Accounts, OU=ITSC, DC=zone1, DC=dcb, DC=net does not have permission to access the requested resource. Returning Forbidden response.
Created on ‎06-08-2017 12:17 PM - edited ‎08-17-2019 10:20 PM
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
There are two parts that need to be successful to access NiFi:
- User authentication: In your case, you are using LDAP to authenticate your users. The NiFi login-identity-providers.xml is used to configure the ldap-provider. NiFI offers two supported configurable "Identity Strategy" options (USE_DN or USE_USERNAME). USE_DN is the default. With "USE_DN" the full DN returned by LDAP after successfully authenticating a used. With "USE_USERNAME" the username entered at login will be used. Which ever strategy is used, the value used will be passed through any configured "Identity Mapping Properties" in NiFi before the resulting mapped value is passed to part two. (Review LDAP settings and Identity mapping Properties in NiFi Admin guide for more details on setup)
- User Authorization: In you case, you are using Ranger for user authorization. (default is NiFi's file-based authorizer). The final value derived form step one above is passed to the configured authorizer to determine what NiFi resources that authenticated user has been granted access.
Based on your output above, you appear to have two options possibly to match your authenticated value with your ldap sync'd user in Ranger:
- Configure an "Identity Mapping Property" in NiFi that will extract on the value from CN= from the entire returned DN.
Based on the DN pattern you shared, your pattern mapping would look like this:
nifi.security.identity.mapping.pattern.dn=^CN=(.*?), OU=(.*?), OU=(.*?), OU=(.*?), DC=(.*?), DC=(.*?), DC=(.*?)$nifi.security.identity.mapping.value.dn=$1
This will return just "anish" from the DN and that is what will be passed to the authorizer. - Change your "Identity Strategy" configuration in your login-identity-providers.xml file to use "USE_USERNAME". This assumes the username supplied at login matches exactly with the LDAP sync username. Add/Modify the following line in your ldap-provider:
<property name="Identity Strategy">USE_USERNAME</property>
Thanks,
Matt
Created on ‎06-08-2017 12:17 PM - edited ‎08-17-2019 10:20 PM
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
There are two parts that need to be successful to access NiFi:
- User authentication: In your case, you are using LDAP to authenticate your users. The NiFi login-identity-providers.xml is used to configure the ldap-provider. NiFI offers two supported configurable "Identity Strategy" options (USE_DN or USE_USERNAME). USE_DN is the default. With "USE_DN" the full DN returned by LDAP after successfully authenticating a used. With "USE_USERNAME" the username entered at login will be used. Which ever strategy is used, the value used will be passed through any configured "Identity Mapping Properties" in NiFi before the resulting mapped value is passed to part two. (Review LDAP settings and Identity mapping Properties in NiFi Admin guide for more details on setup)
- User Authorization: In you case, you are using Ranger for user authorization. (default is NiFi's file-based authorizer). The final value derived form step one above is passed to the configured authorizer to determine what NiFi resources that authenticated user has been granted access.
Based on your output above, you appear to have two options possibly to match your authenticated value with your ldap sync'd user in Ranger:
- Configure an "Identity Mapping Property" in NiFi that will extract on the value from CN= from the entire returned DN.
Based on the DN pattern you shared, your pattern mapping would look like this:
nifi.security.identity.mapping.pattern.dn=^CN=(.*?), OU=(.*?), OU=(.*?), OU=(.*?), DC=(.*?), DC=(.*?), DC=(.*?)$nifi.security.identity.mapping.value.dn=$1
This will return just "anish" from the DN and that is what will be passed to the authorizer. - Change your "Identity Strategy" configuration in your login-identity-providers.xml file to use "USE_USERNAME". This assumes the username supplied at login matches exactly with the LDAP sync username. Add/Modify the following line in your ldap-provider:
<property name="Identity Strategy">USE_USERNAME</property>
Thanks,
Matt
Created ‎06-08-2017 02:18 PM
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@Anishkumar Valsalam You would need to do identity mappings for the users. Set the following parameters in your NiFi conf and restart NiFi.
nifi.security.identity.mapping.pattern.dn = ^CN=(.*?), OU=(.*?), OU=(.*?), OU=(.*?), DC=(.*?), DC=(.*?), DC=(.*?)$ nifi.security.identity.mapping.value.dn = $1
You can read following Knowledge articles for more details.
Created ‎06-08-2017 03:46 PM
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@Matt Clarke Thanks ton you are my saviour 🙂
Created ‎06-08-2017 02:18 PM
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@Anishkumar Valsalam You would need to do identity mappings for the users. Set the following parameters in your NiFi conf and restart NiFi.
nifi.security.identity.mapping.pattern.dn =^CN=(.*?), OU=(.*?), OU=(.*?), OU=(.*?), DC=(.*?), DC=(.*?), DC=(.*?)$ nifi.security.identity.mapping.value.dn = $1
You can read following Knowledge articles for more details.
Created ‎06-08-2017 03:47 PM
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks for the useful link 🙂 it worked.
