NiFi RBAC using certificates

nifi-rbac-certs.md

NiFi RBAC using certificates

Using certificates for authentication and authorization with NiFi is not recommended, but carried over from legacy NiFi and still supported. These instructions require openssl and Java's keytool.

1. Create a cert and key for user1.

openssl req -x509 -newkey rsa:2048 -keyout user1-key.pem -out user1-cert.pem -days 3650 -subj "/CN=user1" -nodes

2. Add user1 cert to NiFi's truststore. This will create a truststore if it doesn't already exist.

keytool -importcert -v -trustcacerts -alias user1 -file /path/to/user1-cert.pem -keystore /path/to/truststore.jks  -storepass mysupersecretpassword -noprompt

3. Stop NiFi if running.

4. Ensure the following properties are set in nifi.properties:

nifi.security.truststore=/path/to/truststore.jks
nifi.security.truststoreType=JKS
nifi.security.truststorePasswd=mysupersecretpassword

4. Add user1 and desired roles to NiFi's authorized-users.xml. If the file doesn't exist, create it using this example. The following will grant user1 all privileges:

<users>
  ...
  <user dn="CN=user1">
      <role name="ROLE_ADMIN"/>
      <role name="ROLE_DFM"/>
      <role name="ROLE_MONITOR"/>
      <role name="ROLE_PROVENANCE"/>
      <role name="ROLE_NIFI"/>
      <role name="ROLE_PROXY"/>
  </user>
  ...
</users>

5. Ensure the following properties are set in authorizers.xml:

...
<userGroupProvider>
  ...
  <property name="Legacy Authorized Users File">/path/to/authorized-users.xml</property>
  ...
</userGroupProvider>
...
<accessPolicyProvider>
  ...
  <property name="Legacy Authorized Users File">/path/to/authorized-users.xml</property>
  ...
</accessPolicyProvider>
...

5. Delete NiFi's authorizations.xml and users.xml files if they exist. They will be recreated on startup.

6. Start NiFi.

7. Create a PFX file for user1 from the cert and key created earlier.

openssl pkcs12 -inkey /path/to/user1-key.pem -in /path/to/user1-cert.pem -export -out user1.pfx -passout pass:anothersupersecretpassword

8. Have user1 install the cert to their browser. Here are instructions for Chrome on Windows.

9. Navigate to NiFi in the browser. To login, choose the cert when prompted.