Here's what I see there. 2018-01-19 11:30:24,421 INFO [NiFi Web Server-284700] o.a.n.w.s.NiFiAuthenticationFilter Attempting request for (<myuser@realm><hostname><CN=hostname, OU=myorg, O=mycompany, L=mylocation, ST=mystate, C=US>) GET https:/<hostname>:9091/nifi-api/process-groups/7c84501d-d10c-407c-b9f3-1d80e38fe36a
2018-01-19 11:30:24,421 INFO [NiFi Web Server-284700] o.a.n.w.s.NiFiAuthenticationFilter Authentication success for <myuser>@<realm>
2018-01-19 11:30:24,421 INFO [NiFi Web Server-284700] o.a.n.w.a.c.AccessDeniedExceptionMapper <myuser>@<realm> does not have permission to access the requested resource. No applicable policies could be found. Returning Forbidden response. Edit: I actually was sort of able to resolve this. For some reason the curl command is sending myuser@realm instead of just myuser, which is what I gave access to in Ranger. When I granted myuser@realm access in Ranger, the curl command worked. So the question is why am I able to login to the UI by just granting myuser access but in order to curl I have to give myuser@realm access? Edit 2: I'm thinking it's due to the way I have the pattern mapping configured. I'm guessing when I log into the UI it's using kerberos, and then when I'm running a curl it's using the CN, which is myuser@realm instead of just myuser. Is it possible to configure so I can just use myuser?
... View more
