@pawan soni Is the UI of the NiFi instance running on Node 1 reachable via port 9090? The RPG reports some communication issues there. This may have just been the result of node 1 restart? The invalid state message indicates the state of your Remote Process Group is Enabled ( ); however, the Remote Input Port is stopped (thus an invalid state for data transfer). Either start the "From File" input port or "disable that port in your RPG to get rid of this ERROR. Thanks, Matt ... View more

@David Miller NiFi's default File based authorizer: Advantages: - supports user groups (This can make setting up authorizations for team a lot less cumbersome.) - Integrated within NiFi so no need to worry about connective issues with external service. Disadvantages: - There is no way currently to sync the user with LDAP. User must be added manually. Ranger based authorizer: Advantages: - Ranger can be setup to sync users from LDAP. - Authorizing new users does not require authorization admin to have access to NiFi's UI. Disadvantages: - Ranger user groups are not supported yet. (Each and every user must be added to any policy required) Here is a helpful link that maps Ranger Policies to NiFi's Default user authorizations: https://community.hortonworks.com/content/kbentry/115770/nifi-ranger-based-policy-descriptions.html ----- You are correct that the most common approach to user/team managed authorization is through the user of unique process groups added to the root canvas level. Sub-process groups by default inherit their access policies from the parent process group. The only thing to be aware of is the use of NiFi's Site-To-Site (S2S)capability. Site-To-Site Remote input and output ports must be added at the root canvas level. So when it comes to using S2S to receive or send data from a NiFi, you would need a admin level user who has the ability to add these components to to the root canvas level for your users and connect them to a process group(s) that your users/teams are authorized for. The other side of a S2S connection is a Remote Process Group (RPG). These RPGs can be added at any level (sub-process group) in a dataflow so special considerations are needed here. A typical approach might be to create a Remote Input port for each team (Process group) and connect that port(s) to their assigned process group. Once in the team group, a routing processor could be shared by all sub teams/users so direct a particular feed of incoming S2S data to a particular sub-process group. Teams are still going to need to work with admins to authorize remote NiFi instance to connect to these ports, so it cannot be completely team managed after creation. Thanks, Matt ... View more