Unable to Clear Queue in NiFi 2.4.0 Cluster – Processor Modification Error

[#1]

Hello,

I have set up a 4-node NiFi 2.4.0 cluster. When I attempt to clear the queue from the NiFi UI, I encounter the following error:

Node x.x.x.x:8443 is unable to fulfill this request due to: Unable to modify the data for Processor with ID d3a802c6-0196-1000-ffff-ffff90fdc7b8. Contact the system administrator.

My user has admin privileges with both operate and modify permissions granted.

As a workaround, I disconnected each node from the cluster one by one, cleared the queues locally on each node, and then reconnected them back to the cluster. While this temporarily resolved the issue, it is not a practical or sustainable solution.

I am looking for a permanent fix to this issue.

I would appreciate your assistance on this matter.

[#2]

@melek6199 

What you have is an authorization issue.

When you access you multi-node NiFi  cluster, you are authorized only into the node in which you authenticated.   When you make a request like List Queue or Empty Queue, you are making a request from one node to all the other nodes to list or empty the connection queue.   This means that the nodes themselves need to be authorized to request other nodes to share back their queue list or empty their target node queues.

All 4 of your NiFi nodes should already have been authorized for "proxy user requests", but in order to list or empty queues, your node will need these additional authorizations:

"view the data"  - authorizes a node(s) to list the data from other nodes (user must also be authorized)
"modify the data" - authorizes a node(s) to empty a connection queue on other nodes.

You can see from the nfi-user.log output you shared the identity and policy missing to perform this action on the specific connection UUID:

Node x.x.x.x:8443 is unable to fulfill this request due to: Unable to modify the data for Processor with ID d3a802c6-0196-1000-ffff-ffff90fdc7b8

You would have seen this same exception for all but one node when you made the request to empty the queue.

Authorizations are inherited form parent Process groups unless explicitly set on the individual component directly.  

So you don't need to authorize your nodes for "view the data" and "modify the data" on the connection "d3a802c6-0196-1000-ffff-ffff90fdc7b8" directly, but rather set these authorization instead on the parent process group.  Keep in mind that child process groups also inherit from parent process groups unless policy is explicitly set on that child process group..  Typically you would set these authorization policies on the root process group (top level).  You'll also notice when you are viewing policies on a component it will tell you if it is inheriting policies and if you choose to set explicit policies on that component it asks you if you want to copy the inherited policy before  modifying.

Please help our community grow. If you found any of the suggestions/solutions provided helped you with solving your issue or answering your question, please take a moment to login and click "Accept as Solution" on one or more of them that helped.

Thank you,
Matt