@Sanaz Janbakhsh The users.xml and authorizations.xml files are generated on initial startup of a secured NiFi instance using the configurations specified in the authorizers.xml file. Once these two files exist, any changes made in the authorizers.xml file will not be made to these existing files. The expectation is that the NiFi UI is used at that point to add additional users and set additional authorizations. So if the initial authorizers.xml file had incorrect entries, the users.xml and authorizations.xml files created will not be correct. You will need to remove these two files and restart so that new users.xml and authorizations.xml files are created based on a correct configuration in the authorizers.xml. The users.xml and authorizations.xml files outputs you shared above are not correct. Neither is your authorizers.xml. Your authorizers.xml file should look something like this:
<authorizers>
<authorizer>
<identifier>file-provider</identifier>
<class>org.apache.nifi.authorization.FileAuthorizer</class>
<property name="Authorizations File">/var/lib/nifi/conf/authorizations.xml</property>
<property name="Users File">/var/lib/nifi/conf/users.xml</property>
<property name="Initial Admin Identity">CN=admin, OU=NIFI</property>
<property name="Legacy Authorized Users File"></property>
<property name="Node Identity 1">CN=nifinode1, OU=NIFI</property>
<property name="Node Identity 2">CN=nifinode2, OU=NIFI</property>
<property name="Node Identity 3">CN=nifinode3, OU=NIFI</property>
</authorizer>
</authorizers> Each node in your cluster must have its own entry.
You must specify an Initial Admin Identity. This will be the only user who can access your NiFi initially. The will given the authorizations needed to add additional users and assign policies for those new users. Using above example, your users.xml file that is generated should look like this: <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<tenants>
<groups/>
<users>
<user identifier="38e35829-435d-3be4-83b6-784cb560e855" identity="CN=admin, OU=NIFI"/>
<user identifier="22f1b808-a02d-3344-93c1-c944af6b5686" identity="CN=nifinode1, OU=NIFI"/>
<user identifier="ea71911e-b2f3-3975-a459-50c9f8e905d1" identity="CN=nifinode2, OU=NIFI"/>
<user identifier="e63552bb-6e32-346d-8b9d-d82ef1616ce9" identity="CN=nifinode3, OU=NIFI"/>
</users>
</tenants> And your authorizations.xml that is generated should look like this: <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<authorizations>
<policies>
<policy identifier="ba421219-28f1-3918-bc27-bf5533cb847e" resource="/flow" action="R">
<user identifier="38e35829-435d-3be4-83b6-784cb560e855"/>
</policy>
<policy identifier="b56e3b5c-a458-3088-a4a6-30c9ad7ea69d" resource="/data/process-groups/f459ab3e-015c-1000-6a96-d0fd4c9da94c" action="R">
<user identifier="38e35829-435d-3be4-83b6-784cb560e855"/>
<user identifier="22f1b808-a02d-3344-93c1-c944af6b5686"/>
<user identifier="ea71911e-b2f3-3975-a459-50c9f8e905d1"/>
<user identifier="e63552bb-6e32-346d-8b9d-d82ef1616ce9"/>
</policy>
<policy identifier="78c6edfa-7c8a-398e-8ffa-716820b5040b" resource="/data/process-groups/f459ab3e-015c-1000-6a96-d0fd4c9da94c" action="W">
<user identifier="38e35829-435d-3be4-83b6-784cb560e855"/>
<user identifier="22f1b808-a02d-3344-93c1-c944af6b5686"/>
<user identifier="ea71911e-b2f3-3975-a459-50c9f8e905d1"/>
<user identifier="e63552bb-6e32-346d-8b9d-d82ef1616ce9"/>
</policy>
<policy identifier="b817348f-f27b-3b42-8b8c-040977436b45" resource="/process-groups/f459ab3e-015c-1000-6a96-d0fd4c9da94c" action="R">
<user identifier="38e35829-435d-3be4-83b6-784cb560e855"/>
</policy>
<policy identifier="dd8ad42a-4266-3646-a804-f612245edbe3" resource="/process-groups/f459ab3e-015c-1000-6a96-d0fd4c9da94c" action="W">
<user identifier="38e35829-435d-3be4-83b6-784cb560e855"/>
</policy>
<policy identifier="efd76cc8-fd81-3cd1-bf21-3065661848bd" resource="/restricted-components" action="W">
<user identifier="38e35829-435d-3be4-83b6-784cb560e855"/>
</policy>
<policy identifier="c2f680ff-bec3-336b-8ed2-512321cc7162" resource="/tenants" action="R">
<user identifier="38e35829-435d-3be4-83b6-784cb560e855"/>
</policy>
<policy identifier="d3840ff8-f56e-3d2c-8361-bab5cf498107" resource="/tenants" action="W">
<user identifier="38e35829-435d-3be4-83b6-784cb560e855"/>
</policy>
<policy identifier="ff398473-528d-3393-85bc-cd6810f47d72" resource="/policies" action="R">
<user identifier="38e35829-435d-3be4-83b6-784cb560e855"/>
</policy>
<policy identifier="a55e48e9-691f-3052-ae92-77fffb2858d6" resource="/policies" action="W">
<user identifier="38e35829-435d-3be4-83b6-784cb560e855"/>
</policy>
<policy identifier="56f51845-8783-3a14-b22c-9971bf232b17" resource="/controller" action="R">
<user identifier="38e35829-435d-3be4-83b6-784cb560e855"/>
</policy>
<policy identifier="ef41b898-79b8-3782-b01a-e54e5bf20661" resource="/controller" action="W">
<user identifier="38e35829-435d-3be4-83b6-784cb560e855"/>
</policy>
<policy identifier="19b83f2b-967e-35d5-8091-f4abc877877b" resource="/proxy" action="W">
<user identifier="22f1b808-a02d-3344-93c1-c944af6b5686"/>
<user identifier="ea71911e-b2f3-3975-a459-50c9f8e905d1"/>
<user identifier="e63552bb-6e32-346d-8b9d-d82ef1616ce9"/>
</policy>
</policies>
</authorizations> Of course all the UUIDs that are generated will be different. Thanks, Matt *** If you found this answer addressed your question please mark it as accepted.
... View more
