Member since
07-29-2020
530
Posts
272
Kudos Received
159
Solutions
My Accepted Solutions
Title | Views | Posted |
---|---|---|
305 | 09-07-2024 12:59 AM | |
410 | 09-03-2024 12:36 AM | |
339 | 09-03-2024 12:09 AM | |
251 | 08-30-2024 06:23 AM | |
940 | 08-26-2024 04:39 PM |
05-20-2021
05:04 PM
Hi Matt, Thank you very much for taking the time and explaining how this process works. I spent a lot of time trying to troubleshoot the issue and I think I was able to resolve. what caught my eye in other similar post is the case of DN being authenticated and authorized which what you also highlighted "...which means the DN form that clientAuth certificate is going to be the user that needs to be authorized for both the "retrieve Site-To-Site details" and "receive data via site-to-site" NiFi authorization policies". Im not a security expert here but I assume DN refers to Domain, right? In any case for me to resolve this issue I had to do the following: 1- In the "SiteToSiteBulletinReportingTask" properties I kept the default value for "Instance URL" which is "http://${hostname(true)}:8080/nifi" despite my nifi instance is being secured. Im stil not very clear what this value is for and the tutorial doesnt give much info on and I always thought it has to match what is set for the Destination URL but its not. 2- In Nifi I have added the user "CN=localhost , OU=NIFI" and made sure to give it all kind of permission including view & modify data. Im thinking since my domain is "locahost" and the domain "DN" is what is being authenticated\authorized I needed to create this user account. 3- In the nifi.properties file I made sure the following properties are set as follows: nifi.remote.input.host= nifi.remote.input.secure= nifi.remote.input.socket.port=8080 nifi.remote.input.http.enabled=true If I set the "nifi.remote.input.secure" to true then I will keep getting 403 Forbidden error despite my instance is secured! Not sure if all of the above helped or combination of it but at least its working and I'm able to replicate playing with those parameters. Im hoping someone from the Nifi community can maybe elaborate more on this to confirm as Im not a security expert. Thank you.
... View more
05-18-2021
10:46 AM
Hi, I have SiteToSiteBulletinReportingTask setup to capture bulletin information for a standalone secure nifi instance. the reporting task is pointing to an input port as expected but when I start the task it doesnt work and it keeps giving this warning: SiteToSiteBulletinReportingTask[id=e99b03f1-0173-1000-c7ef-4e475ed2416d] org.apache.nifi.remote.client.PeerSelector@24677b11 Unable to refresh Remote Group's peers due to response code 403:Forbidden with explanation: null" The reporting task is setup as follows: The SSL context service is setup with the same values for the keystore and truststore as in the nifi.properties file which is working to secure my instance. I have added the policy "receive data via site-to-site" to the input port "S2S_Bulletins_rec" . The user created by securing the instance has the policy "retrieve site-to-site details". The error doesn't give much details. Can you please help? Thank you.
... View more
Labels:
- Labels:
-
Apache NiFi
01-25-2021
10:26 AM
OK, Its unfortunate that I did not get any help from the support community about this but the good news after several trials and many hours I was able to resolve it and Im sharing my experience to help those who might get stuck in the future regarding the same issue: 1- No need to set up any of the TLS properties if you are connecting to LDAP:// url and not LDAPS://. You can comment or remove this part. 3- Authentication Strategy: SIMPLE 2- Manager DN: if you are using windows open Active Directory Administrative Center (can be installed ). Do global search for one of the accounts you are familiar with and going to use, once located right click to select properties, scroll down to Extensions section and click Attribute Editor tab, locate the distinguishedName attribute and that will be the value to use in the Manager DN. It will be something like : CN=lastName.FirstName,OU=Standard Users,OU=Users,OU=LocationOU,OU=OrgName,OU=SomeOU,OU=AnotherOU,DC=DomainName,DC=com 3- Manager Password: the selected account password from above. 4-Url: The Ldap url, example : LDAP://ldap.DomainName.com/ 5- User Search Base: Use the Same string from Step 2 without the the account CN, Example: OU=Standard Users,OU=Users,OU=Location,OU=OrgName,OU=SomeOU,OU=AnotherOU,DC=DomainName,DC=com 6- User Search Filter: This is what you will use to add user and login to nifi. What worked for me is the "sAMAccountName={0}" which you can find set under the Attribute Editor (step 2) and it refers to search by the user name (example: lastname.firstname). 7- Identity Strategy: USE_USERNAME 8- Make sure to add the provider name (Example: ldap-provider) to nifi.properties. 9- Restart nifi. 10- using the default admin account created when setting up secure TLS on the installation server (Example: my_username) to add the AD user to Users and Set the Policies using user name from above. 11- From another machine launch nifi from the browser and you should be prompted to log in. Login using the same account credential you added to nifi and you should be in. Other helpful information can be found: https://pierrevillard.com/2017/01/24/integration-of-nifi-with-ldap/comment-page-1/ good luck.
... View more
12-12-2020
07:42 AM
Can someone help please. Im trying to run a test pilot for to see if Nifi can be adapted as tool of choice. The tool is impressive in terms of capabilities and out of the box components but It cant be used if its not easily integrated with our environment. I tried calling support on the phone and left a message, contacted sales via email but no response. One of the factor we have to adapt a tool is the ease of getting support when needed and so far the coulder community is not showing that unless Im doing something wrong.
... View more
12-09-2020
08:10 AM
Hi Im having trouble configuring the ldap to work with Nifi. First I was able to secure my nifi instance following the instruction under : "https://nifi.apache.org/docs/nifi-docs/html/walkthroughs.html#securing-nifi-with-tls" When I access Nifi and select the certificate I can see the account CN=my_username, OU=Nifi top right. Next step was to setup Ldap and for that I followed this link "https://pierrevillard.com/2017/01/24/integration-of-nifi-with-ldap/comment-page-1/" . In my login-identity-providers.xml file the ldap-provider was configured as the following (I used #### for sensitive info): <provider> <identifier>ldap-provider</identifier> <class>org.apache.nifi.ldap.LdapProvider</class> <property name="Authentication Strategy">SIMPLE</property> <property name="Manager DN"></property> <property name="Manager Password"></property> <property name="TLS - Keystore">./conf/keystore.jks</property> <property name="TLS - Keystore Password">####</property> <property name="TLS - Keystore Type">jks</property> <property name="TLS - Truststore">./conf/truststore.jks</property> <property name="TLS - Truststore Password">###</property> <property name="TLS - Truststore Type">jks</property> <property name="TLS - Client Auth"></property> <property name="TLS - Protocol">TLSv1.2</property> <property name="TLS - Shutdown Gracefully"></property> <property name="Referral Strategy">FOLLOW</property> <property name="Connect Timeout">10 secs</property> <property name="Read Timeout">10 secs</property> <property name="Url">LDAP://ldap.####.com</property> <property name="User Search Base">OU=Standard Users,OU=Users,OU=US-Houston,OU=####,OU=Engineering,OU=Divisions,DC=####,DC=com</property> <property name="User Search Filter">sAMAccountName={0}</property> <property name="Identity Strategy">USE_USERNAME</property> <property name="Authentication Expiration">12 hours</property> </provider> However when I go back to Nifi and select Users I dont see anything added there from the ldap server except for the main user added while securing nifi. The log file doesnt show any error. What am I doing wrong? Can you help please.
... View more
Labels:
- Labels:
-
Apache NiFi
08-07-2020
10:31 AM
Hi, Im trying to utilize the rety relation of the PutSQL processor by redirecting it to the RetryFlowFile processor. However nothing seem to trigger this relationship. My understanding is that the retry is triggered when the DB could not be reached such as bad connection string, sql server is down...etc. but no matter what I do on the sql server to test this scenario, the retry is not triggered, instead an an exception is thrown (jdbc.SQLServerException) and the flowfile is pushed back to the queue and penalized! Here is what I did on my sql server express instance to test: - Disable the SQL Server service. - Changing the connection string in the JDBC connection pool service to be incorrect. - Taking the Database instance offline - Even blocking the target table by doing select inside transaction with wait time None of the above seem to trigger the Retry. The failure relation seem to be triggered by query error and is working fine. My question is why the Retry is not getting triggered and what condition triggers it? Thanks
... View more
Labels:
- Labels:
-
Apache NiFi
08-07-2020
10:14 AM
Thank you very much! After installing the proper java version the Groovy script started to work.
... View more
08-06-2020
11:49 AM
OK, will try to install the required java version. My bad, I did not think that would cause the problem. Do I have to uninstall nifi and reinstall everything or just uninstalling\reinstalling java would suffice.? Thanks for your help
... View more
08-06-2020
11:11 AM
Im using single instance. I just ran the "java -version" command, and here is what I have: java version "14.0.1" 2020-04-14 Java(TM) SE Runtime Environment (build 14.0.1+7) Java HotSpot(TM) 64-Bit Server VM (build 14.0.1+7, mixed mode, sharing)
... View more
- « Previous
- Next »