Hi, I'm running HDF 2.1.4 and have the following components working:
2 Nodes NiFi Cluster (SSL Enabled using NiFi CA) Ranger (integrated with NiFi and I have Initial Admin Identity working from browser) I am now trying to configure AD on my setup. I managed to get Ranger Usync to work and I can see my AD users in Ranger but when I make the changes for NiFi the servicde won't start. I made the following changes in Ambari under Advanced nifi-properties: nifi.security.user.login.identity.provider ldap-provider nifi.security.identity.mapping.pattern.dn ^CN=(.*?), OU=(.*?)$ nifi.security.identity.mapping.value.dn $1@$2
And this is what my Template for login-identity-providers.xml looks like <loginIdentityProviders>
<provider>
<identifier>ldap-provider</identifier>
<class>org.apache.nifi.ldap.LdapProvider</class>
<property name="Authentication Strategy">SIMPLE</property>
<property name="Manager DN">CN=xxx,OU=Administrator & Service Accounts,OU=Administration,OU=NOC,DC=xxx,DC=xxx</property>
<property name="Manager Password">xxx_password</property>
<property name="TLS - Keystore">/usr/hdf/current/nifi/conf/keystore.jks</property>
<property name="TLS - Keystore Password">keystore_password</property>
<property name="TLS - Keystore Type">jks</property>
<property name="TLS - Truststore">/usr/hdf/current/nifi/conf/truststore.jks</property>
<property name="TLS - Truststore Password">truststore_password</property>
<property name="TLS - Truststore Type">jks</property>
<property name="TLS - Client Auth"></property>
<property name="TLS - Protocol">TLS</property>
<property name="TLS - Shutdown Gracefully"></property>
<property name="Referral Strategy">FOLLOW</property>
<property name="Connect Timeout">10 secs</property>
<property name="Read Timeout">10 secs</property>
<property name="Url">ldap://ad_controller:389</property>
<property name="User Search Base">OU=Administration,OU=NOC,DC=xxx,DC=xxx</property>
<property name="User Search Filter">sAMAccountName={0}</property>
<property name="Authentication Expiration">12 hours</property>
</provider>
</loginIdentityProviders>
After saving these changes and restarting NiFi I get the following errors: Traceback (most recent call last):
File "/var/lib/ambari-agent/cache/common-services/NIFI/1.0.0/package/scripts/nifi.py", line 360, in <module>
Master().execute()
File "/usr/lib/python2.6/site-packages/resource_management/libraries/script/script.py", line 280, in execute
method(env)
File "/usr/lib/python2.6/site-packages/resource_management/libraries/script/script.py", line 720, in restart
self.start(env, upgrade_type=upgrade_type)
File "/var/lib/ambari-agent/cache/common-services/NIFI/1.0.0/package/scripts/nifi.py", line 164, in start
self.configure(env, is_starting = True)
File "/var/lib/ambari-agent/cache/common-services/NIFI/1.0.0/package/scripts/nifi.py", line 145, in configure
params.nifi_flow_config_dir, params.nifi_sensitive_props_key, is_starting)
File "/var/lib/ambari-agent/cache/common-services/NIFI/1.0.0/package/scripts/nifi.py", line 286, in encrypt_sensitive_properties
if nifi_toolkit_util.contains_providers(nifi_config_dir+'/login-identity-providers.xml'):
File "/var/lib/ambari-agent/cache/common-services/NIFI/1.0.0/package/scripts/nifi_toolkit_util.py", line 257, in contains_providers
dom = xml.dom.minidom.parseString(content)
File "/usr/lib64/python2.7/xml/dom/minidom.py", line 1931, in parseString
return expatbuilder.parseString(string)
File "/usr/lib64/python2.7/xml/dom/expatbuilder.py", line 940, in parseString
return builder.parseString(string)
File "/usr/lib64/python2.7/xml/dom/expatbuilder.py", line 223, in parseString
parser.Parse(string, True)
xml.parsers.expat.ExpatError: not well-formed (invalid token): line 7, column 74 The login provider configuration looks ok to me but I've never configured NiFi with AD so I could well be missing something. Any ideas? Regards, Geouffrey
... View more
