Member since
07-30-2019
3135
Posts
1565
Kudos Received
909
Solutions
My Accepted Solutions
Title | Views | Posted |
---|---|---|
162 | 01-09-2025 11:14 AM | |
906 | 01-03-2025 05:59 AM | |
445 | 12-13-2024 10:58 AM | |
497 | 12-05-2024 06:38 AM | |
392 | 11-22-2024 05:50 AM |
01-25-2017
04:54 PM
@Michael Rivera
NiFi is designed to accept many triggers words sec, second, secs, seconds, min, minutes, mins, hr, hrs , day, days, etc.... The max it will accept as of NiFi 1.x is week or weeks (or wk or wks). If you enter an invalid trigger word, the processor will let you know it is invalid. Such as trying to use month or year will produce the below: Keep in mind that by using the "timer driven" scheduling strategy you are not setting a specific execution time. You are setting an execution interval where the first interval is scheduled upon start of the processor. The second execution will occur x amount of configured "run schedule" later. If you stop and then start the processor again, the interval starts over. The "CRON Driven" scheduling strategy allow you to configure an exact time(s) for execution. Thanks, Matt
... View more
01-24-2017
06:57 PM
@Anishkumar Valsalam You need to add this as a new user in NiFi:
cn=o.1548691,ou=Users,ou=Accounts,ou=ITSC,dc=zone1,dc=testdev,dc=net Click "Users" to open the users and groups NiFi UI. The "individual" "identity" string must match EXACTLY with what you saw in the nifi-user.log. It is case sensitive and make sure you have not copied in the single quotes or any leading or trailing spaces. Click on "Policies" to access the below UI and grant this newly added user a minimum of "view the user interface": Thanks, Matt
... View more
01-24-2017
06:23 PM
@Anishkumar Valsalam Trying to keep one answer going here rather then starting a new answer to add details. 🙂 What do you see in your nifi-user.log? I suspect you see on a line that says authentication success for user XYZ. then another line that says user XYZ has insufficient permissions. NiFi uses the DN returned by LDAP to perform its authorization lookup.
You have to make sure that user "XYZ" was added as a user in your NiFi. That user must be added exactly as you see it. It is case and sensitive and should not have any quotes around it. Be mindful of any spaces between DN elements or unexpected leading or trailing spaces. At a minimum, that new user must be granted the “view the user interface” access policy or they will not be able to load the NiFi UI. They will need additional policies granted to them to do other things once they access the UI, but that is for you to decide what you want to grant each user access to do. Matt
... View more
01-24-2017
03:29 PM
1 Kudo
@Adda Fuentes Since you started your new node with a configured authorizers.xml file pointing at a legacy authorized-users.xml file, the users.xml and authorizations.xml files in NiFi 1.1 where generated from that rather then inheriting those files form your already running cluster. Clear out the setting in your new nodes authorizers.xml file, remove the users.xml and authorizations.xml files, remove the flow.xml.gz file and restart this new node. It should successfully obtain these files from your existing cluster at this point. You will need to do one additional step once this new node has joined your cluster. Since the original clusters authorizations and users will not include this new node yet, you will need to access the cluster's UI from one of the original cluster nodes using and admin account and add the new node's DN as a user and then provide that new node with all the same access policies as the your existing node have. At a minimum you need to make sure your new node is granted the "Proxy user requests" access policy: If you do not do this the following issues could occur: 1. You will not be able to access the cluster's UI via the newly added node (you will get untrusted proxy message) 2. You will still be able to access the UI via the other nodes as long as NiFi does not switch the cluster coordinator to your newly added node. You cannot restrict NiFi from picking any node in your cluster to serve this role. Matt
... View more
01-24-2017
03:15 PM
@Balakrishnan Ramasamy
The NiFi expression language allows users to dynamically retrieve values from FlowFile Attributes, environment variables, JVM properties, or a variable registry file. Only properties that are marked as supporting expression language can be passed value dynamically. Floating your cursor over the little question mark next to any property will tell you if it support expression language or not. For sensitive property fields, the value entered is encrypted upon hitting OK. It is then stored in the encrypted format in the flow.xml.gz file. It does not support the expression language.
Please accept my answer if you feel i have addressed your question. Thank you, Matt
... View more
01-24-2017
01:33 PM
2 Kudos
@Anishkumar Valsalam NiFi supports three types of user authentication strategies: 1. SSL Certificates - This is the default authentication strategy and is always on. NiFi will always accept a user supplied SSL certificate in the connection before trying any other configured authentication strategy. If a SSL certificate is not presented in the connection, NiFi will close the connection unless another authentication strategy has been configured. Those other strategy must be configured and include: 2. LDAP - NiFi can be configured to fall back on this strategy which can be configured to connect to either LDAP or LDAPS. If your user use LDAP, they do not need to have user SSL certificates issued to them. If they do have SSL certificates loaded in their browser, NiFi will accept them and will not even try using LDAP to authenticate that user. 3. Kerberos - NiFi can be configured to fall back on this strategy. If they do have SSL certificates loaded in their browser, NiFi will accept them and will not even try using Kerberos to authenticate that user. Note: Alternate authentication strategies are configured in NiFi's login-identity-providers.xml file. NiFi SSL certificate authentication is the default (first strategy that is always attempted) and cannot be disabled. NiFi will only try one of the other authentication strategies (if configured) if SSL certificates are not presented for the user. Note: Only one alternative authentication Strategy can be configured. While SSL is always enabled, you can only add either LDAP or Kerberos, but not both. Note: Authentication is only step one or a two step process that needs to be successful before a user can successfully access NiFi. NiFi authorization occurs after successful authentication. User who can successfully authenticate via any one of the above authentication strategies still need to be authorized within NiFi for access to specific NiFi resources and components. Authorization of users requires adding those users to the configured authorizer and granted those added users access to whichever access policies are needed by that user. Thanks, Matt
... View more
01-20-2017
05:23 PM
@Anishkumar Valsalam NiFi user authentication supports LDAP, Kerberos, or Users TLS certificates (default) only.
I thought you were already using LDAP for user authentication?
What do you have configured in your login-identity-providers.xml? Matt
... View more
01-20-2017
04:57 PM
@Anishkumar Valsalam The log you provided shows that user authentication is successful. What is failing is the users authorization inside NiFi. When setting up NiFi securely for the first time (enable SSL), you need to provide an "Initial Admin Identity". The Identity provided here will be used to seed the admin related access policies (Authorizations) within NiFi which will give that user the ability to access the UI. The issue you are running in to is that what your LDAP has returned and what you have configured in your authorizers.xml file do not match exactly. Configured value: EMAILADDRESS=07anis@gmail.com,CN=admin,OU=EDM,O=XXX,L=HK,ST=HK,C=HK LDAP value: EMAILADDRESS=07anis@gmail.com, CN=admin, OU=EDM, O=XXX, L=HK, ST=HK, C=HK These are case sensitive and spaces do count. You cannot simply update the authorizers.xml config file to resolve your issue. When NiFi is started securely for the first time, users.xml and authorizations.xml files are generated based on the configs in the authorizers.xml file. Subsequent restarts of NiFi will not trigger a modification or re-creation of these files if they already exist. So to correct your issue, you will need to correct your "Initial Admin Identity" configuration so it matches what is being returned by LDAP, remove the existing users.xml and authorizations.xml files and then restart so they get created with the correct value/user identity. Once you have gained access to your NiFi UI, you can add additional users and set authorizations for those users directly form the UI. Thanks, Matt
... View more
01-20-2017
04:35 PM
@Balakrishnan Ramasamy The behavior of the input dialog box is not configurable. Once you apply the password, it is encrypted and stored in the flow.xml.gz file. If any user opens the dialog box the users is simply informed that a sensitive property has been set. It is not possible to retrieve the plain text unencrypted version of the password after it has been applied.
If you can, please accept the answer if it addressed your initial question. Thanks, Matt
... View more
01-20-2017
03:05 PM
3 Kudos
@Michal R You can use an UpdateAttribute processor to change the filename. However, this would end up with every file having the same filename. Assuming each input filename is unique excpet has a .csv extension, you could do the following:
This would essentially replace the .csv extension with .avro while leaving the rest of the original filename unchanged. Thanks, Matt
... View more