Team , We have upgraded NIFI from 1.5 to 1.11 and trying to configure ranger authorization at group level instead of user level . But its not working . Below are the properties i have given in authorizers.xml <userGroupProvider> <identifier>ldap-user-group-provider</identifier> <class>org.apache.nifi.ldap.tenants.LdapUserGroupProvider</class> <property name="Authentication Strategy">LDAPS</property> <property name="Manager DN">CN=xxxx,OU=Users,OU=Standard Users,OU=Users and Computers,OU=Atlanta Corporate,OU=CCI,DC=CORP,DC=COX,DC=com</property> <property name="Manager Password">xxxxx</property> <property name="TLS - Keystore">/etc/nifi/conf/signed-keystore.jks</property> <property name="TLS - Keystore Password">xxx</property> <property name="TLS - Keystore Type">JKS</property> <property name="TLS - Truststore">/etc/nifi/conf/coxca-truststore.jks</property> <property name="TLS - Truststore Password">xxx</property> <property name="TLS - Truststore Type">JKS</property> <property name="TLS - Client Auth">WANT</property> <property name="TLS - Protocol">TLS</property> <property name="TLS - Shutdown Gracefully">TRUE</property> <property name="Referral Strategy">FOLLOW</property> <property name="Connect Timeout">10 secs</property> <property name="Read Timeout">10 secs</property> <property name="Url">ldaps://xxxxx:636</property> <property name="Page Size"></property> <property name="Sync Interval">30 mins</property> <property name="User Search Base">ou=cci,dc=corp,dc=cox,dc=com</property> <property name="User Object Class">user</property> <property name="User Search Scope">sub</property> <property name="User Search Filter">(|(memberof=CN=CATL0BDDEVSA,OU=groups,OU=Atlanta Corporate,OU=CCI,DC=CORP,DC=COX,DC=com)(memberof=CN=CATL0BDDEVADMINS,OU=groups,OU=Atlanta Corporate,OU=CCI,DC=CORP,DC=COX,DC=com)(memberof=CN=CATL0BDDEVDEVELOPERS,OU=groups,OU=Atlanta Corporate,OU=CCI,DC=CORP,DC=COX,DC=com))</property> <property name="User Identity Attribute">cn</property> <property name="User Group Name Attribute">memberof, ismemberof</property> <property name="User Group Name Attribute - Referenced Group Attribute"></property> <property name="Group Search Base">ou=cci,dc=corp,dc=cox,dc=com</property> <property name="Group Object Class">group</property> <property name="Group Search Scope">sub</property> <property name="Group Search Filter">(|(cn=CATL0BDDEVSA)(cn=CATL0BDDEVADMINS)(cn=CATL0BDDEVDEVELOPERS))</property> <property name="Group Name Attribute">cn</property> <property name="Group Member Attribute">member</property> <property name="Group Member Attribute - Referenced User Attribute">uid</property> </userGroupProvider> <authorizer> <identifier>ranger-authorizer</identifier> <class>org.apache.nifi.ranger.authorization.ManagedRangerAuthorizer</class> <property name="User Group Provider">ldap-user-group-provider</property> <property name="Ranger Audit Config Path">/usr/hdf/current/nifi/conf/ranger-nifi-audit.xml</property> <property name="Ranger Security Config Path">/usr/hdf/current/nifi/conf/ranger-nifi-security.xml</property> <property name="Ranger Service Type">nifi</property> <property name="Ranger Application Id">nifi</property> <property name="Allow Anonymous">true</property> <property name="Ranger Admin Identity"></property> <property name="Ranger Kerberos Enabled">false</property> </authorizer> when i add AD group in ranger for access i get this error 2020-07-13 17:13:33,737 INFO [NiFi Web Server-31] o.a.n.w.a.c.AccessDeniedExceptionMapper identity[bbhimava], groups[none] does not have permission to access the requested resource. No applicable policies could be found. Returning Forbidden response. 2020-07-13 17:13:45,698 INFO [NiFi Web Server-41] o.a.n.w.s.NiFiAuthenticationFilter Attempting request for (CN=xxxx, OU=NIFI) GET https://xxxxxx/nifi-api/site-to-site (source ip: 10.220.3.176) @MattWhorequesting your help .
... View more
