Hello, I have a 3 node NiFi Cluster up and running.  The Initial Admin User is able now to successfully log into the NiFi cluster.     I would now like to add new users to the NiFi cluster and SSL i.e., signed PKI certs for each user as the basis for these users to gain access to NiFi.   I do not want to use LDAP, I am in an environment that will require use of PKI certs for access to NiFi.   Can someone provide a prescriptive set of steps I can follow to successfully use PKI certs/SSL as a means of providing access to new NiFi cluster users and specifically, how do I add new users?   I would think the process of creating new users and using SSL would be explained explicitly.     Can someone help me with this?   VR,   Dave ... View more

I have a 3 node NiFi cluster set up and running in our environment.  I used a user called "ec2-user" to perform the NiFi install. For this initial install (in a development environment) I used the NiFi Toolkit to create the certificates for the 3 nodes as well as for the ec2-user   I would now like to use the NiFi registry tool to create additional NiFi users. I have been following this post by alim: Setting Up a Secure Apache NiFi Registry - Cloudera Community - 247753.   I started with "Registry Configuration" in this post since I had already used the Toolkit to generate the keystore, truststore and a client certificate for the ec2-user. I copied the keystore and truststore to the conf directory of the Registry install. I then copied the values rom the keystore and truststore properties from the nifi.properties file into the corresponding values in the nifi-registry.properties file. I also modified the HTTP and HTTPS web properties as indicated in the post. I then modified the authorizers.xml file.  First in the userGroupProvider section, adding the "ec2-user" DN to the initial Admin Identity 1" property. And, then in the accessPolicyProvider section, adding the "ec2-user" DN to the "Initial Admin Identity" property.   I then copied the certificate associated with the ec2-user to the nifi1 host browser.   I then started the Registry ./bin/nifi-registry.sh start   I then accessed the url:  (I changed the host to nifi1 instead of localhost):  https://nifi1:18443/nifi-registry .   I was prompted for the ec2-user certificate which i provided.   Then I was able to access the nifi-registry GUI but i do not see the wrench on the far upper right of the page.   Also, when I look at the nifi-registry log, I see that the Kerberos service ticket not supported by the NiFi Registry.  Also receive an AccessDeniedExceptionMapper:  identity CN=ec2-user does not have permission to access the requested resource.   Can you provide guidance on how I can create a user with administrator access in the NiFi Registry tool?  Are there any previous tickets that describe how to to do this?   Thank you for any guidance, recommendations.... ... View more