You seem to have a good understanding of the situation... There isn't really a big pro or con with NiFI's authorizer vs Ranger... If you are already using Ranger for other things then it gives you a nice central place to manage all policies across your enterprise and a nice way to look at audit logs. The current downside would be that when using an external authorizer like Ranger, NiFi's UI currently doesn't show anything about the policies, so you have to jump back and forth a bit between two UIs sometimes. This is only temporary though and in a future release there are plans to offer a read-only view of policies on the NiFi side when using an external authorizer. Sometimes it is helpful to start out with NiFi's authorizer to get an understanding of the policies before attempting to set them up in Ranger. Regarding the RPG pattern, you are correct that this is one unfortunate scenario regarding multi-tenancy... I think the real way that this should be addressed is by creating a more user-friendly way to do load balancing of a connection across the cluster, most likely a special way to connect two components and indicate the connection should transfer data to each node across the cluster. The RPG approach is used simply because that is all that exists, but site-to-site was really meant for transfer between two separate instances. An alternative option is always to have each team with its own NiFi instance and then they can manage the root canvas themselves, and they can send data across teams via site-to-site, but I realize this requires managing more clusters, just throwing it out there.
... View more
