Modified: nifi/site/trunk/docs/nifi-registry-docs/html/administration-guide.html URL: http://svn.apache.org/viewvc/nifi/site/trunk/docs/nifi-registry-docs/html/administration-guide.html?rev=1841991&r1=1841990&r2=1841991&view=diff ============================================================================== --- nifi/site/trunk/docs/nifi-registry-docs/html/administration-guide.html (original) +++ nifi/site/trunk/docs/nifi-registry-docs/html/administration-guide.html Wed Sep 26 01:37:13 2018 @@ -457,7 +457,7 @@ body.book #toc,body.book #preamble,body. <ul class="sectlevel1"> <li><a href="administration-guide.html#system-requirements">System Requirements</a></li> <li><a href="administration-guide.html#how-to-install-and-start-nifi-registry">How to install and start NiFi Registry</a></li> -<li><a href="administration-guide.html#security-configuration">Security Configuration</a></li> +<li><a href="administration-guide.html#security_configuration">Security Configuration</a></li> <li><a href="administration-guide.html#user_authentication">User Authentication</a> <ul class="sectlevel2"> <li><a href="administration-guide.html#ldap_identity_provider">Lightweight Directory Access Protocol (LDAP)</a></li> @@ -501,6 +501,13 @@ body.book #toc,body.book #preamble,body. <li><a href="administration-guide.html#data-model-version-of-serialized-flow-snapshots">Data model version of serialized Flow snapshots</a></li> </ul> </li> +<li><a href="administration-guide.html#event-hooks">Event Hooks</a> +<ul class="sectlevel2"> +<li><a href="administration-guide.html#shared-event-hook-properties">Shared Event Hook Properties</a></li> +<li><a href="administration-guide.html#scripteventhookprovider">ScriptEventHookProvider</a></li> +<li><a href="administration-guide.html#loggingeventhookprovider">LoggingEventHookProvider</a></li> +</ul> +</li> </ul> </div> </div> @@ -527,7 +534,7 @@ body.book #toc,body.book #preamble,body. <td class="content"> When running Registry with only a JRE you may encounter the following error as Flyway (database migration tool) attempts to utilize a resource from the JDK:<br> <br> - java.lang.RuntimeException: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'flywayInitializer' defined in class path resource [org/springframework/boot/autoconfigure/flyway/FlywayAutoConfiguration$FlywayConfiguration.class]: Invocation of init method failed; nested exception is org.flywaydb.core.api.FlywayException: Validate failed: Detected failed migration to version 1.3 (DropBucketItemNameUniqueness) + <code>java.lang.RuntimeException: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'flywayInitializer' defined in class path resource [org/springframework/boot/autoconfigure/flyway/FlywayAutoConfiguration$FlywayConfiguration.class]: Invocation of init method failed; nested exception is org.flywaydb.core.api.FlywayException: Validate failed: Detected failed migration to version 1.3 (DropBucketItemNameUniqueness)</code> </td> </tr> </table> @@ -583,36 +590,36 @@ When running Registry with only a JRE yo <p>Decompress and untar into desired installation directory</p> </li> <li> -<p>Make any desired edits in files found under <installdir>/conf</p> +<p>Make any desired edits in files found under <code><installdir>/conf</code></p> </li> <li> -<p>From the <installdir>/bin directory, execute the following commands by typing ./nifi-registry.sh <command>:</p> +<p>From the <code><installdir>/bin</code> directory, execute the following commands by typing <code>./nifi-registry.sh <command></code>:</p> <div class="ulist"> <ul> <li> -<p>start: starts NiFi Registry in the background</p> +<p><code>start</code>: starts NiFi Registry in the background</p> </li> <li> -<p>stop: stops NiFi Registry that is running in the background</p> +<p><code>stop</code>: stops NiFi Registry that is running in the background</p> </li> <li> -<p>status: provides the current status of NiFi Registry</p> +<p><code>status</code>: provides the current status of NiFi Registry</p> </li> <li> -<p>run: runs NiFi Registry in the foreground and waits for a Ctrl-C to initiate shutdown of NiFi Registry</p> +<p><code>run</code>: runs NiFi Registry in the foreground and waits for a Ctrl-C to initiate shutdown of NiFi Registry</p> </li> <li> -<p>install: installs NiFi Registry as a service that can then be controlled via</p> +<p><code>install</code>: installs NiFi Registry as a service that can then be controlled via</p> <div class="ulist"> <ul> <li> -<p>service nifi-registry start</p> +<p><code>service nifi-registry start</code></p> </li> <li> -<p>service nifi-registry stop</p> +<p><code>service nifi-registry stop</code></p> </li> <li> -<p>service nifi-registry status</p> +<p><code>service nifi-registry status</code></p> </li> </ul> </div> @@ -626,24 +633,24 @@ When running Registry with only a JRE yo </ul> </div> <div class="paragraph"> -<p>When NiFi Registry first starts up, the following files and directories are created:</p> +<p>When NiFi Registry first starts up, the following directories are created:</p> </div> <div class="ulist"> <ul> <li> -<p>flow_storage directory</p> +<p><code>flow_storage</code></p> </li> <li> -<p>database directory</p> +<p><code>database</code></p> </li> <li> -<p>work directory</p> +<p><code>work</code></p> </li> <li> -<p>logs directory</p> +<p><code>logs</code></p> </li> <li> -<p>run directory</p> +<p><code>run</code></p> </li> </ul> </div> @@ -653,7 +660,7 @@ When running Registry with only a JRE yo </div> </div> <div class="sect1"> -<h2 id="security-configuration"><a class="anchor" href="administration-guide.html#security-configuration"></a>Security Configuration</h2> +<h2 id="security_configuration"><a class="anchor" href="administration-guide.html#security_configuration"></a>Security Configuration</h2> <div class="sectionbody"> <div class="paragraph"> <p>NiFi Registry provides several different configuration options for security purposes. The most important properties are those under the @@ -673,7 +680,7 @@ When running Registry with only a JRE yo <tfoot> <tr> <td class="tableblock halign-left valign-top"><p class="tableblock"><code>nifi.registry.security.needClientAuth</code></p></td> -<td class="tableblock halign-left valign-top"><p class="tableblock">This specifies that connecting clients must authenticate with a client cert. Setting this to <code>false</code> will specify that connecting clients may optionally authenticate with a client cert, but may also login with a username and password against a configured identity provider. The default value is true.</p></td> +<td class="tableblock halign-left valign-top"><p class="tableblock">This specifies that connecting clients must authenticate with a client cert. Setting this to <code>false</code> will specify that connecting clients may optionally authenticate with a client cert, but may also login with a username and password against a configured identity provider. The default value is <code>true</code>.</p></td> </tr> </tfoot> <tbody> @@ -754,15 +761,15 @@ authenticating users via their username/ Currently NiFi Registry offers Identity Providers for LDAP and Kerberos.</p> </div> <div class="paragraph"> -<p>Identity Providers are configured using two properties in the 'nifi-registry.properties' file:</p> +<p>Identity Providers are configured using two properties in the <em>nifi-registry.properties</em> file:</p> </div> <div class="ulist"> <ul> <li> -<p>The <code>nifi.registry.security.identity.providers.configuration.file</code> property specifies the configuration file where identity providers are defined. By default, the 'identity-providers.xml' file located in the root installation conf directory is selected.</p> +<p>The <code>nifi.registry.security.identity.providers.configuration.file</code> property specifies the configuration file where identity providers are defined. By default, the <em>identity-providers.xml</em> file located in the root installation <code>conf</code> directory is selected.</p> </li> <li> -<p>The <code>nifi.registry.security.identity.provider</code> property indicates which of the configured identity providers in the 'identity-providers.xml' file to use. By default, this property is not configured meaning that username/password must be explicitly enabled.</p> +<p>The <code>nifi.registry.security.identity.provider</code> property indicates which of the configured identity providers in the <em>identity-providers.xml</em> file to use. By default, this property is not configured meaning that username/password must be explicitly enabled.</p> </li> </ul> </div> @@ -783,6 +790,17 @@ NiFi Registry can only be configured to <div class="paragraph"> <p>Below is an example and description of configuring a Identity Provider that integrates with a Directory Server to authenticate users.</p> </div> +<div class="paragraph"> +<p>Set the following in <em>nifi-registry.properties</em> to enable LDAP username/password authentication:</p> +</div> +<div class="listingblock"> +<div class="content"> +<pre>nifi.registry.security.identity.provider=ldap-identity-provider</pre> +</div> +</div> +<div class="paragraph"> +<p>Modify <em>identity-providers.xml</em> to enable the <code>ldap-identity-provider</code>. Here is the sample provided in the file:</p> +</div> <div class="listingblock"> <div class="content"> <pre><provider> @@ -817,12 +835,7 @@ NiFi Registry can only be configured to </div> </div> <div class="paragraph"> -<p>With this configuration, username/password authentication can be enabled by referencing this provider in <em>nifi-registry.properties</em>.</p> -</div> -<div class="listingblock"> -<div class="content"> -<pre>nifi.registry.security.identity.provider=ldap-identity-provider</pre> -</div> +<p>The <code>ldap-identity-provider</code> has the following properties:</p> </div> <table class="tableblock frame-all grid-all spread"> <colgroup> @@ -844,7 +857,7 @@ NiFi Registry can only be configured to <tbody> <tr> <td class="tableblock halign-left valign-top"><p class="tableblock"><code>Authentication Strategy</code></p></td> -<td class="tableblock halign-left valign-top"><p class="tableblock">How the connection to the LDAP server is authenticated. Possible values are ANONYMOUS, SIMPLE, LDAPS, or START_TLS.</p></td> +<td class="tableblock halign-left valign-top"><p class="tableblock">How the connection to the LDAP server is authenticated. Possible values are <code>ANONYMOUS</code>, <code>SIMPLE</code>, <code>LDAPS</code>, or <code>START_TLS</code>.</p></td> </tr> <tr> <td class="tableblock halign-left valign-top"><p class="tableblock"><code>Manager DN</code></p></td> @@ -864,7 +877,7 @@ NiFi Registry can only be configured to </tr> <tr> <td class="tableblock halign-left valign-top"><p class="tableblock"><code>TLS - Keystore Type</code></p></td> -<td class="tableblock halign-left valign-top"><p class="tableblock">Type of the Keystore that is used when connecting to LDAP using LDAPS or START_TLS (i.e. JKS or PKCS12).</p></td> +<td class="tableblock halign-left valign-top"><p class="tableblock">Type of the Keystore that is used when connecting to LDAP using LDAPS or START_TLS (i.e. <code>JKS</code> or <code>PKCS12</code>).</p></td> </tr> <tr> <td class="tableblock halign-left valign-top"><p class="tableblock"><code>TLS - Truststore</code></p></td> @@ -876,48 +889,48 @@ NiFi Registry can only be configured to </tr> <tr> <td class="tableblock halign-left valign-top"><p class="tableblock"><code>TLS - Truststore Type</code></p></td> -<td class="tableblock halign-left valign-top"><p class="tableblock">Type of the Truststore that is used when connecting to LDAP using LDAPS or START_TLS (i.e. JKS or PKCS12).</p></td> +<td class="tableblock halign-left valign-top"><p class="tableblock">Type of the Truststore that is used when connecting to LDAP using LDAPS or START_TLS (i.e. <code>JKS</code> or <code>PKCS12</code>).</p></td> </tr> <tr> <td class="tableblock halign-left valign-top"><p class="tableblock"><code>TLS - Client Auth</code></p></td> -<td class="tableblock halign-left valign-top"><p class="tableblock">Client authentication policy when connecting to LDAP using LDAPS or START_TLS. Possible values are REQUIRED, WANT, NONE.</p></td> +<td class="tableblock halign-left valign-top"><p class="tableblock">Client authentication policy when connecting to LDAP using LDAPS or START_TLS. Possible values are <code>REQUIRED</code>, <code>WANT</code>, <code>NONE</code>.</p></td> </tr> <tr> <td class="tableblock halign-left valign-top"><p class="tableblock"><code>TLS - Protocol</code></p></td> -<td class="tableblock halign-left valign-top"><p class="tableblock">Protocol to use when connecting to LDAP using LDAPS or START_TLS. (i.e. TLS, TLSv1.1, TLSv1.2, etc).</p></td> +<td class="tableblock halign-left valign-top"><p class="tableblock">Protocol to use when connecting to LDAP using LDAPS or START_TLS. (i.e. <code>TLS</code>, <code>TLSv1.1</code>, <code>TLSv1.2</code>, etc).</p></td> </tr> <tr> <td class="tableblock halign-left valign-top"><p class="tableblock"><code>TLS - Shutdown Gracefully</code></p></td> -<td class="tableblock halign-left valign-top"><p class="tableblock">Specifies whether the TLS should be shut down gracefully before the target context is closed. Defaults to false.</p></td> +<td class="tableblock halign-left valign-top"><p class="tableblock">Specifies whether the TLS should be shut down gracefully before the target context is closed. Defaults to <code>false</code>.</p></td> </tr> <tr> <td class="tableblock halign-left valign-top"><p class="tableblock"><code>Referral Strategy</code></p></td> -<td class="tableblock halign-left valign-top"><p class="tableblock">Strategy for handling referrals. Possible values are FOLLOW, IGNORE, THROW.</p></td> +<td class="tableblock halign-left valign-top"><p class="tableblock">Strategy for handling referrals. Possible values are <code>FOLLOW</code>, <code>IGNORE</code>, <code>THROW</code>.</p></td> </tr> <tr> <td class="tableblock halign-left valign-top"><p class="tableblock"><code>Connect Timeout</code></p></td> -<td class="tableblock halign-left valign-top"><p class="tableblock">Duration of connect timeout. (i.e. 10 secs).</p></td> +<td class="tableblock halign-left valign-top"><p class="tableblock">Duration of connect timeout. (i.e. <code>10 secs</code>).</p></td> </tr> <tr> <td class="tableblock halign-left valign-top"><p class="tableblock"><code>Read Timeout</code></p></td> -<td class="tableblock halign-left valign-top"><p class="tableblock">Duration of read timeout. (i.e. 10 secs).</p></td> +<td class="tableblock halign-left valign-top"><p class="tableblock">Duration of read timeout. (i.e. <code>10 secs</code>).</p></td> </tr> <tr> <td class="tableblock halign-left valign-top"><p class="tableblock"><code>Url</code></p></td> -<td class="tableblock halign-left valign-top"><p class="tableblock">Space-separated list of URLs of the LDAP servers (i.e. ldap://<hostname>:<port>).</p></td> +<td class="tableblock halign-left valign-top"><p class="tableblock">Space-separated list of URLs of the LDAP servers (i.e. <code>ldap://<hostname>:<port></code>).</p></td> </tr> <tr> <td class="tableblock halign-left valign-top"><p class="tableblock"><code>User Search Base</code></p></td> -<td class="tableblock halign-left valign-top"><p class="tableblock">Base DN for searching for users (i.e. CN=Users,DC=example,DC=com).</p></td> +<td class="tableblock halign-left valign-top"><p class="tableblock">Base DN for searching for users (i.e. <code>CN=Users,DC=example,DC=com</code>).</p></td> </tr> <tr> <td class="tableblock halign-left valign-top"><p class="tableblock"><code>User Search Filter</code></p></td> -<td class="tableblock halign-left valign-top"><p class="tableblock">Filter for searching for users against the 'User Search Base'. (i.e. sAMAccountName={0}). The user specified name is inserted into '{0}'.</p></td> +<td class="tableblock halign-left valign-top"><p class="tableblock">Filter for searching for users against the <code>User Search Base</code>. (i.e. <code>sAMAccountName={0}</code>). The user specified name is inserted into '{0}'.</p></td> </tr> <tr> <td class="tableblock halign-left valign-top"><p class="tableblock"><code>Identity Strategy</code></p></td> -<td class="tableblock halign-left valign-top"><p class="tableblock">Strategy to identify users. Possible values are USE_DN and USE_USERNAME. The default functionality if this property is missing is USE_DN in order to retain backward -compatibility. USE_DN will use the full DN of the user entry if possible. USE_USERNAME will use the username the user logged in with.</p></td> +<td class="tableblock halign-left valign-top"><p class="tableblock">Strategy to identify users. Possible values are <code>USE_DN</code> and <code>USE_USERNAME</code>. The default functionality if this property is missing is <code>USE_DN</code> in order to retain backward +compatibility. <code>USE_DN</code> will use the full DN of the user entry if possible. <code>USE_USERNAME</code> will use the username the user logged in with.</p></td> </tr> </tbody> </table> @@ -927,24 +940,30 @@ compatibility. USE_DN will use the full <div class="paragraph"> <p>Below is an example and description of configuring an Identity Provider that integrates with a Kerberos Key Distribution Center (KDC) to authenticate users.</p> </div> +<div class="paragraph"> +<p>Set the following in <em>nifi-registry.properties</em> to enable Kerberos username/password authentication:</p> +</div> +<div class="listingblock"> +<div class="content"> +<pre>nifi.registry.security.user.identity.provider=kerberos-identity-provider</pre> +</div> +</div> +<div class="paragraph"> +<p>Modify <em>identity-providers.xml</em> to enable the <code>kerberos-identity-provider</code>. Here is the sample provided in the file:</p> +</div> <div class="listingblock"> <div class="content"> <pre><provider> <identifier>kerberos-identity-provider</identifier> <class>org.apache.nifi.registry.web.security.authentication.kerberos.KerberosIdentityProvider</class> <property name="Default Realm">NIFI.APACHE.ORG</property> - <property name="Kerberos Config File">/etc/krb5.conf</property> <property name="Authentication Expiration">12 hours</property> + <property name="Enable Debug">false</property> </provider></pre> </div> </div> <div class="paragraph"> -<p>With this configuration, username/password authentication can be enabled by referencing this provider in <em>nifi-registry.properties</em>.</p> -</div> -<div class="listingblock"> -<div class="content"> -<pre>nifi.registry.security.user.identity.provider=kerberos-identity-provider</pre> -</div> +<p>The <code>kerberos-identity-provider</code> has the following properties:</p> </div> <table class="tableblock frame-all grid-all spread"> <colgroup> @@ -959,18 +978,18 @@ compatibility. USE_DN will use the full </thead> <tfoot> <tr> -<td class="tableblock halign-left valign-top"><p class="tableblock"><code>Authentication Expiration</code></p></td> -<td class="tableblock halign-left valign-top"><p class="tableblock">The duration for which the user authentication is valid. If the user never logs out, they will be required to log back in following this duration.</p></td> +<td class="tableblock halign-left valign-top"><p class="tableblock"><code>Enable Debug</code></p></td> +<td class="tableblock halign-left valign-top"><p class="tableblock">Enables debug logging output for the SunJaasKerberosClient used internally by the KerberosIdentityProvider. By default, this is set to <code>false</code>.</p></td> </tr> </tfoot> <tbody> <tr> <td class="tableblock halign-left valign-top"><p class="tableblock"><code>Default Realm</code></p></td> -<td class="tableblock halign-left valign-top"><p class="tableblock">Default realm to provide when user enters incomplete user principal (i.e. NIFI.APACHE.ORG).</p></td> +<td class="tableblock halign-left valign-top"><p class="tableblock">Default realm to provide when user enters incomplete user principal (i.e. <code>NIFI.APACHE.ORG</code>).</p></td> </tr> <tr> -<td class="tableblock halign-left valign-top"><p class="tableblock"><code>Kerberos Config File</code></p></td> -<td class="tableblock halign-left valign-top"><p class="tableblock">Absolute path to Kerberos client configuration file.</p></td> +<td class="tableblock halign-left valign-top"><p class="tableblock"><code>Authentication Expiration</code></p></td> +<td class="tableblock halign-left valign-top"><p class="tableblock">The duration for which the user authentication is valid. If the user never logs out, they will be required to log back in following this duration.</p></td> </tr> </tbody> </table> @@ -990,15 +1009,15 @@ This is done by defining policies that g <div class="sect2"> <h3 id="authorizer-configuration"><a class="anchor" href="administration-guide.html#authorizer-configuration"></a>Authorizer Configuration</h3> <div class="paragraph"> -<p>An 'authorizer' manages known users and their access policies. Authorizers are configured using two properties in the 'nifi-registry.properties' file:</p> +<p>An 'authorizer' manages known users and their access policies. Authorizers are configured using two properties in the <em>nifi-registry.properties</em> file:</p> </div> <div class="ulist"> <ul> <li> -<p>The <code>nifi.registry.security.authorizers.configuration.file</code> property specifies the configuration file where authorizers are defined. By default, the 'authorizers.xml' file located in the root installation conf directory is selected.</p> +<p>The <code>nifi.registry.security.authorizers.configuration.file</code> property specifies the configuration file where authorizers are defined. By default, the <em>authorizers.xml</em> file located in the root installation conf directory is selected.</p> </li> <li> -<p>The <code>nifi.registry.security.authorizer</code> property indicates which of the configured authorizers in the 'authorizers.xml' file to use.</p> +<p>The <code>nifi.registry.security.authorizer</code> property indicates which of the configured authorizers in the <em>authorizers.xml</em> file to use.</p> </li> </ul> </div> @@ -1006,28 +1025,71 @@ This is done by defining policies that g <div class="sect2"> <h3 id="authorizers-setup"><a class="anchor" href="administration-guide.html#authorizers-setup"></a>Authorizers.xml Setup</h3> <div class="paragraph"> -<p>The 'authorizers.xml' file is used to define and configure available authorizers. The default authorizer is the StandardManagedAuthorizer. The managed authorizer is comprised of a UserGroupProvider -and a AccessPolicyProvider. The users, group, and access policies will be loaded and optionally configured through these providers. The managed authorizer will make all access decisions based on -these provided users, groups, and access policies.</p> +<p>The <em>authorizers.xml</em> file is used to define and configure available authorizers.</p> +</div> +<div class="sect3"> +<h4 id="standardmanagedauthorizer"><a class="anchor" href="administration-guide.html#standardmanagedauthorizer"></a>StandardManagedAuthorizer</h4> +<div class="paragraph"> +<p>The default Authorizer is the StandardManagedAuthorizer, however, you can develop additional Authorizers as extensions. The StandardManagedAuthorizer has the following properties:</p> +</div> +<table class="tableblock frame-all grid-all spread"> +<colgroup> +<col style="width: 50%;"> +<col style="width: 50%;"> +</colgroup> +<thead> +<tr> +<th class="tableblock halign-left valign-top">Property Name</th> +<th class="tableblock halign-left valign-top">Description</th> +</tr> +</thead> +<tfoot> +<tr> +<td class="tableblock halign-left valign-top"><p class="tableblock"><code>Access Policy Provider</code></p></td> +<td class="tableblock halign-left valign-top"><p class="tableblock">The identifier for an Access Policy Provider defined above.</p></td> +</tr> +</tfoot> +</table> +<div class="paragraph"> +<p>The managed authorizer is comprised of a UserGroupProvider and a AccessPolicyProvider. The users, group, and access policies will be loaded and optionally configured through these providers. The managed authorizer will make all access decisions based on these provided users, groups, and access policies.</p> </div> <div class="paragraph"> <p>During startup there is a check to ensure that there are no two users/groups with the same identity/name. This check is executed regardless of the configured implementation. This is necessary because this is how users/groups are identified and authorized during access decisions.</p> </div> +</div> +<div class="sect3"> +<h4 id="usergroupprovider"><a class="anchor" href="administration-guide.html#usergroupprovider"></a>UserGroupProvider</h4> +<div class="sect4"> +<h5 id="fileusergroupprovider"><a class="anchor" href="administration-guide.html#fileusergroupprovider"></a>FileUserGroupProvider</h5> <div class="paragraph"> <p>The default UserGroupProvider is the FileUserGroupProvider, however, you can develop additional UserGroupProviders as extensions. The FileUserGroupProvider has the following properties:</p> </div> -<div class="ulist"> -<ul> -<li> -<p>Users File - The file where the FileUserGroupProvider stores users and groups. -By default, 'users.xml' in the 'conf' directory is chosen.</p> -</li> -<li> -<p>Initial User Identity - The identity of a user or system to seed an empty Users File. -Multiple Initial User Identity properties can be specified, but the name of each property must be unique, for example: "Initial User Identity A", "Initial User Identity B", "Initial User Identity C" or "Initial User Identity 1", "Initial User Identity 2", "Initial User Identity 3"</p> -</li> -</ul> -</div> +<table class="tableblock frame-all grid-all spread"> +<colgroup> +<col style="width: 50%;"> +<col style="width: 50%;"> +</colgroup> +<thead> +<tr> +<th class="tableblock halign-left valign-top">Property Name</th> +<th class="tableblock halign-left valign-top">Description</th> +</tr> +</thead> +<tfoot> +<tr> +<td class="tableblock halign-left valign-top"><p class="tableblock"><code>Initial User Identity</code></p></td> +<td class="tableblock halign-left valign-top"><p class="tableblock">The identity of a user or system to seed an empty Users File. + Multiple Initial User Identity properties can be specified, but the name of each property must be unique, for example: <code>"Initial User Identity A"</code>, <code>"Initial User Identity B"</code>, <code>"Initial User Identity C"</code> or <code>"Initial User Identity 1"</code>, <code>"Initial User Identity 2"</code>, <code>"Initial User Identity 3"</code>.</p></td> +</tr> +</tfoot> +<tbody> +<tr> +<td class="tableblock halign-left valign-top"><p class="tableblock"><code>Users File</code></p></td> +<td class="tableblock halign-left valign-top"><p class="tableblock">The file where the FileUserGroupProvider stores users and groups. + By default, <em>users.xml</em> in the <code>conf</code> directory is chosen.</p></td> +</tr> +</tbody> +</table> <div class="admonitionblock note"> <table> <tr> @@ -1040,158 +1102,255 @@ Initial User Identities are only created </tr> </table> </div> +</div> +<div class="sect4"> +<h5 id="ldapusergroupprovider"><a class="anchor" href="administration-guide.html#ldapusergroupprovider"></a>LdapUserGroupProvider</h5> <div class="paragraph"> <p>Another option for the UserGroupProvider is the LdapUserGroupProvider. By default, this option is commented out but can be configured in lieu of the FileUserGroupProvider. This will sync users and groups from a directory server and will present them in NiFi Registry UI in read only form. The LdapUserGroupProvider has the following properties:</p> </div> -<div class="ulist"> -<ul> -<li> -<p>Authentication Strategy - How the connection to the LDAP server is authenticated. Possible values are ANONYMOUS, SIMPLE, LDAPS, or START_TLS</p> -</li> -<li> -<p>Manager DN - The DN of the manager that is used to bind to the LDAP server to search for users.</p> -</li> -<li> -<p>Manager Password - The password of the manager that is used to bind to the LDAP server to search for users.</p> -</li> -<li> -<p>TLS - Keystore - Path to the Keystore that is used when connecting to LDAP using LDAPS or START_TLS.</p> -</li> -<li> -<p>TLS - Keystore Password - Password for the Keystore that is used when connecting to LDAP using LDAPS or START_TLS.</p> -</li> -<li> -<p>TLS - Keystore Type - Type of the Keystore that is used when connecting to LDAP using LDAPS or START_TLS (i.e. JKS or PKCS12).</p> -</li> -<li> -<p>TLS - Truststore - Path to the Truststore that is used when connecting to LDAP using LDAPS or START_TLS.</p> -</li> -<li> -<p>TLS - Truststore Password - Password for the Truststore that is used when connecting to LDAP using LDAPS or START_TLS.</p> -</li> -<li> -<p>TLS - Truststore Type - Type of the Truststore that is used when connecting to LDAP using LDAPS or START_TLS (i.e. JKS or PKCS12).</p> -</li> -<li> -<p>TLS - Client Auth - Client authentication policy when connecting to LDAP using LDAPS or START_TLS. Possible values are REQUIRED, WANT, NONE.</p> -</li> -<li> -<p>TLS - Protocol - Protocol to use when connecting to LDAP using LDAPS or START_TLS. (i.e. TLS, TLSv1.1, TLSv1.2, etc).</p> -</li> -<li> -<p>TLS - Shutdown Gracefully - Specifies whether the TLS should be shut down gracefully before the target context is closed. Defaults to false.</p> -</li> -<li> -<p>Referral Strategy - Strategy for handling referrals. Possible values are FOLLOW, IGNORE, THROW.</p> -</li> -<li> -<p>Connect Timeout - Duration of connect timeout. (i.e. 10 secs).</p> -</li> -<li> -<p>Read Timeout - Duration of read timeout. (i.e. 10 secs).</p> -</li> -<li> -<p>Url - Space-separated list of URLs of the LDAP servers (i.e. ldap://<hostname>:<port>).</p> -</li> -<li> -<p>Page Size - Sets the page size when retrieving users and groups. If not specified, no paging is performed.</p> -</li> -<li> -<p>Sync Interval - Duration of time between syncing users and groups. (i.e. 30 mins).</p> -</li> -<li> -<p>User Search Base - Base DN for searching for users (i.e. ou=users,o=nifi). Required to search users.</p> -</li> -<li> -<p>User Object Class - Object class for identifying users (i.e. person). Required if searching users.</p> -</li> -<li> -<p>User Search Scope - Search scope for searching users (ONE_LEVEL, OBJECT, or SUBTREE). Required if searching users.</p> -</li> -<li> -<p>User Search Filter - Filter for searching for users against the 'User Search Base' (i.e. (memberof=cn=team1,ou=groups,o=nifi) ). Optional.</p> -</li> -<li> -<p>User Identity Attribute - Attribute to use to extract user identity (i.e. cn). Optional. If not set, the entire DN is used.</p> -</li> -<li> -<p>User Group Name Attribute - Attribute to use to define group membership (i.e. memberof). Optional. If not set group membership will not be calculated through the users. Will rely on group membership being defined through 'Group Member Attribute' if set. The value of this property is the name of the attribute in the user LDAP entry that associates them with a group. The value of that user attribute could be a dn or group name for instance. What value is expected is configured in the 'User Group Name Attribute - Referenced Group Attribute'.</p> -</li> -<li> -<p>User Group Name Attribute - Referenced Group Attribute - If blank, the value of the attribute defined in 'User Group Name Attribute' is expected to be the full dn of the group. If not blank, this property will define the attribute of the group LDAP entry that the value of the attribute defined in 'User Group Name Attribute' is referencing (i.e. name). Use of this property requires that 'Group Search Base' is also configured.</p> -</li> -<li> -<p>Group Search Base - Base DN for searching for groups (i.e. ou=groups,o=nifi). Required to search groups.</p> -</li> -<li> -<p>Group Object Class - Object class for identifying groups (i.e. groupOfNames). Required if searching groups.</p> -</li> -<li> -<p>Group Search Scope - Search scope for searching groups (ONE_LEVEL, OBJECT, or SUBTREE). Required if searching groups.</p> -</li> -<li> -<p>Group Search Filter - Filter for searching for groups against the 'Group Search Base'. Optional.</p> -</li> -<li> -<p>Group Name Attribute - Attribute to use to extract group name (i.e. cn). Optional. If not set, the entire DN is used.</p> -</li> -<li> -<p>Group Member Attribute - Attribute to use to define group membership (i.e. member). Optional. If not set group membership will not be calculated through the groups. Will rely on group membership being defined through 'User Group Name Attribute' if set. The value of this property is the name of the attribute in the group LDAP entry that associates them with a user. The value of that group attribute could be a dn or memberUid for instance. What value is expected is configured in the 'Group Member Attribute - Referenced User Attribute'. (i.e. member: cn=User 1,ou=users,o=nifi vs. memberUid: user1)</p> -</li> -<li> -<p>Group Member Attribute - Referenced User Attribute - If blank, the value of the attribute defined in 'Group Member Attribute' is expected to be the full dn of the user. If not blank, this property will define the attribute of the user LDAP entry that the value of the attribute defined in 'Group Member Attribute' is referencing (i.e. uid). Use of this property requires that 'User Search Base' is also configured. (i.e. member: cn=User 1,ou=users,o=nifi vs. memberUid: user1)</p> -</li> -</ul> +<table class="tableblock frame-all grid-all spread"> +<colgroup> +<col style="width: 50%;"> +<col style="width: 50%;"> +</colgroup> +<thead> +<tr> +<th class="tableblock halign-left valign-top">Property Name</th> +<th class="tableblock halign-left valign-top">Description</th> +</tr> +</thead> +<tfoot> +<tr> +<td class="tableblock halign-left valign-top"><p class="tableblock"><code>Group Member Attribute - Referenced User Attribute</code></p></td> +<td class="tableblock halign-left valign-top"><p class="tableblock">If blank, the value of the attribute defined in <code>Group Member Attribute</code> is expected to be the full dn of the user. If not blank, this property will define the attribute of the user LDAP entry that the value of the attribute defined in <code>Group Member Attribute</code> is referencing (i.e. <code>uid</code>). Use of this property requires that <code>User Search Base</code> is also configured. (i.e. <code>member: cn=User 1,ou=users,o=nifi</code> vs. <code>memberUid: user1</code>)</p></td> +</tr> +</tfoot> +<tbody> +<tr> +<td class="tableblock halign-left valign-top"><p class="tableblock"><code>Authentication Strategy</code></p></td> +<td class="tableblock halign-left valign-top"><p class="tableblock">How the connection to the LDAP server is authenticated. Possible values are <code>ANONYMOUS</code>, <code>SIMPLE</code>, <code>LDAPS</code>, or <code>START_TLS</code>.</p></td> +</tr> +<tr> +<td class="tableblock halign-left valign-top"><p class="tableblock"><code>Manager DN</code></p></td> +<td class="tableblock halign-left valign-top"><p class="tableblock">The DN of the manager that is used to bind to the LDAP server to search for users.</p></td> +</tr> +<tr> +<td class="tableblock halign-left valign-top"><p class="tableblock"><code>Manager Password</code></p></td> +<td class="tableblock halign-left valign-top"><p class="tableblock">The password of the manager that is used to bind to the LDAP server to search for users.</p></td> +</tr> +<tr> +<td class="tableblock halign-left valign-top"><p class="tableblock"><code>TLS - Keystore</code></p></td> +<td class="tableblock halign-left valign-top"><p class="tableblock">Path to the Keystore that is used when connecting to LDAP using LDAPS or START_TLS.</p></td> +</tr> +<tr> +<td class="tableblock halign-left valign-top"><p class="tableblock"><code>TLS - Keystore Password</code></p></td> +<td class="tableblock halign-left valign-top"><p class="tableblock">Password for the Keystore that is used when connecting to LDAP using LDAPS or START_TLS.</p></td> +</tr> +<tr> +<td class="tableblock halign-left valign-top"><p class="tableblock"><code>TLS - Keystore Type</code></p></td> +<td class="tableblock halign-left valign-top"><p class="tableblock">Type of the Keystore that is used when connecting to LDAP using LDAPS or START_TLS (i.e. <code>JKS</code> or <code>PKCS12</code>).</p></td> +</tr> +<tr> +<td class="tableblock halign-left valign-top"><p class="tableblock"><code>TLS - Truststore</code></p></td> +<td class="tableblock halign-left valign-top"><p class="tableblock">Path to the Truststore that is used when connecting to LDAP using LDAPS or START_TLS.</p></td> +</tr> +<tr> +<td class="tableblock halign-left valign-top"><p class="tableblock"><code>TLS - Truststore Password</code></p></td> +<td class="tableblock halign-left valign-top"><p class="tableblock">Password for the Truststore that is used when connecting to LDAP using LDAPS or START_TLS.</p></td> +</tr> +<tr> +<td class="tableblock halign-left valign-top"><p class="tableblock"><code>TLS - Truststore Type</code></p></td> +<td class="tableblock halign-left valign-top"><p class="tableblock">Type of the Truststore that is used when connecting to LDAP using LDAPS or START_TLS (i.e. <code>JKS</code> or <code>PKCS12</code>).</p></td> +</tr> +<tr> +<td class="tableblock halign-left valign-top"><p class="tableblock"><code>TLS - Client Auth</code></p></td> +<td class="tableblock halign-left valign-top"><p class="tableblock">Client authentication policy when connecting to LDAP using LDAPS or START_TLS. Possible values are <code>REQUIRED</code>, <code>WANT</code>, <code>NONE</code>.</p></td> +</tr> +<tr> +<td class="tableblock halign-left valign-top"><p class="tableblock"><code>TLS - Protocol</code></p></td> +<td class="tableblock halign-left valign-top"><p class="tableblock">Protocol to use when connecting to LDAP using LDAPS or START_TLS. (i.e. <code>TLS</code>, <code>TLSv1.1</code>, <code>TLSv1.2</code>, etc).</p></td> +</tr> +<tr> +<td class="tableblock halign-left valign-top"><p class="tableblock"><code>TLS - Shutdown Gracefully</code></p></td> +<td class="tableblock halign-left valign-top"><p class="tableblock">Specifies whether the TLS should be shut down gracefully before the target context is closed. Defaults to <code>false</code>.</p></td> +</tr> +<tr> +<td class="tableblock halign-left valign-top"><p class="tableblock"><code>Referral Strategy</code></p></td> +<td class="tableblock halign-left valign-top"><p class="tableblock">Strategy for handling referrals. Possible values are <code>FOLLOW</code>, <code>IGNORE</code>, <code>THROW</code>.</p></td> +</tr> +<tr> +<td class="tableblock halign-left valign-top"><p class="tableblock"><code>Connect Timeout</code></p></td> +<td class="tableblock halign-left valign-top"><p class="tableblock">Duration of connect timeout. (i.e. <code>10 secs</code>).</p></td> +</tr> +<tr> +<td class="tableblock halign-left valign-top"><p class="tableblock"><code>Read Timeout</code></p></td> +<td class="tableblock halign-left valign-top"><p class="tableblock">Duration of read timeout. (i.e. <code>10 secs</code>).</p></td> +</tr> +<tr> +<td class="tableblock halign-left valign-top"><p class="tableblock"><code>Url</code></p></td> +<td class="tableblock halign-left valign-top"><p class="tableblock">Space-separated list of URLs of the LDAP servers (i.e. <code>ldap://<hostname>:<port></code>).</p></td> +</tr> +<tr> +<td class="tableblock halign-left valign-top"><p class="tableblock"><code>Page Size</code></p></td> +<td class="tableblock halign-left valign-top"><p class="tableblock">Sets the page size when retrieving users and groups. If not specified, no paging is performed.</p></td> +</tr> +<tr> +<td class="tableblock halign-left valign-top"><p class="tableblock"><code>Sync Interval</code></p></td> +<td class="tableblock halign-left valign-top"><p class="tableblock">Duration of time between syncing users and groups. (i.e. <code>30 mins</code>).</p></td> +</tr> +<tr> +<td class="tableblock halign-left valign-top"><p class="tableblock"><code>User Search Base</code></p></td> +<td class="tableblock halign-left valign-top"><p class="tableblock">Base DN for searching for users (i.e. <code>ou=users,o=nifi</code>). Required to search users.</p></td> +</tr> +<tr> +<td class="tableblock halign-left valign-top"><p class="tableblock"><code>User Object Class</code></p></td> +<td class="tableblock halign-left valign-top"><p class="tableblock">Object class for identifying users (i.e. <code>person</code>). Required if searching users.</p></td> +</tr> +<tr> +<td class="tableblock halign-left valign-top"><p class="tableblock"><code>User Search Scope</code></p></td> +<td class="tableblock halign-left valign-top"><p class="tableblock">Search scope for searching users (<code>ONE_LEVEL</code>, <code>OBJECT</code>, or <code>SUBTREE</code>). Required if searching users.</p></td> +</tr> +<tr> +<td class="tableblock halign-left valign-top"><p class="tableblock"><code>User Search Filter</code></p></td> +<td class="tableblock halign-left valign-top"><p class="tableblock">Filter for searching for users against the <code>User Search Base</code> (i.e. <code>(memberof=cn=team1,ou=groups,o=nifi)</code>). Optional.</p></td> +</tr> +<tr> +<td class="tableblock halign-left valign-top"><p class="tableblock"><code>User Identity Attribute</code></p></td> +<td class="tableblock halign-left valign-top"><p class="tableblock">Attribute to use to extract user identity (i.e. <code>cn</code>). Optional. If not set, the entire DN is used.</p></td> +</tr> +<tr> +<td class="tableblock halign-left valign-top"><p class="tableblock"><code>User Group Name Attribute</code></p></td> +<td class="tableblock halign-left valign-top"><p class="tableblock">Attribute to use to define group membership (i.e. <code>memberof</code>). Optional. If not set group membership will not be calculated through the users. Will rely on group membership being defined through <code>Group Member Attribute</code> if set. The value of this property is the name of the attribute in the user LDAP entry that associates them with a group. The value of that user attribute could be a dn or group name for instance. What value is expected is configured in the <code>User Group Name Attribute - Referenced Group Attribute</code>.</p></td> +</tr> +<tr> +<td class="tableblock halign-left valign-top"><p class="tableblock"><code>User Group Name Attribute - Referenced Group Attribute</code></p></td> +<td class="tableblock halign-left valign-top"><p class="tableblock">If blank, the value of the attribute defined in <code>User Group Name Attribute</code> is expected to be the full dn of the group. If not blank, this property will define the attribute of the group LDAP entry that the value of the attribute defined in <code>User Group Name Attribute</code> is referencing (i.e. <code>name</code>). Use of this property requires that <code>Group Search Base</code> is also configured.</p></td> +</tr> +<tr> +<td class="tableblock halign-left valign-top"><p class="tableblock"><code>Group Search Base</code></p></td> +<td class="tableblock halign-left valign-top"><p class="tableblock">Base DN for searching for groups (i.e. <code>ou=groups,o=nifi</code>). Required to search groups.</p></td> +</tr> +<tr> +<td class="tableblock halign-left valign-top"><p class="tableblock"><code>Group Object Class</code></p></td> +<td class="tableblock halign-left valign-top"><p class="tableblock">Object class for identifying groups (i.e. <code>groupOfNames</code>). Required if searching groups.</p></td> +</tr> +<tr> +<td class="tableblock halign-left valign-top"><p class="tableblock"><code>Group Search Scope</code></p></td> +<td class="tableblock halign-left valign-top"><p class="tableblock">Search scope for searching groups (<code>ONE_LEVEL</code>, <code>OBJECT</code>, or <code>SUBTREE</code>). Required if searching groups.</p></td> +</tr> +<tr> +<td class="tableblock halign-left valign-top"><p class="tableblock"><code>Group Search Filter</code></p></td> +<td class="tableblock halign-left valign-top"><p class="tableblock">Filter for searching for groups against the <code>Group Search Base</code>. Optional.</p></td> +</tr> +<tr> +<td class="tableblock halign-left valign-top"><p class="tableblock"><code>Group Name Attribute</code></p></td> +<td class="tableblock halign-left valign-top"><p class="tableblock">Attribute to use to extract group name (i.e. <code>cn</code>). Optional. If not set, the entire DN is used.</p></td> +</tr> +<tr> +<td class="tableblock halign-left valign-top"><p class="tableblock"><code>Group Member Attribute</code></p></td> +<td class="tableblock halign-left valign-top"><p class="tableblock">Attribute to use to define group membership (i.e. <code>member</code>). Optional. If not set group membership will not be calculated through the groups. Will rely on group membership being defined through <code>User Group Name Attribute</code> if set. The value of this property is the name of the attribute in the group LDAP entry that associates them with a user. The value of that group attribute could be a dn or memberUid for instance. What value is expected is configured in the <code>Group Member Attribute - Referenced User Attribute</code>. (i.e. <code>member: cn=User 1,ou=users,o=nifi</code> vs. <code>memberUid: user1</code>)</p></td> +</tr> +</tbody> +</table> </div> +<div class="sect4"> +<h5 id="composite-implementations"><a class="anchor" href="administration-guide.html#composite-implementations"></a>Composite Implementations</h5> <div class="paragraph"> <p>Another option for the UserGroupProvider are composite implementations. This means that multiple sources/implementations can be configured and composed. For instance, an admin can configure users/groups to be loaded from a file and a directory server. There are two composite implementations, one that supports multiple UserGroupProviders and one that supports multiple UserGroupProviders and a single configurable UserGroupProvider.</p> </div> <div class="paragraph"> <p>The CompositeUserGroupProvider will provide support for retrieving users and groups from multiple sources. The CompositeUserGroupProvider has the following properties:</p> </div> -<div class="ulist"> -<ul> -<li> -<p>User Group Provider - The identifier of user group providers to load from. The name of each property must be unique, for example: "User Group Provider A", "User Group Provider B", "User Group Provider C" or "User Group Provider 1", "User Group Provider 2", "User Group Provider 3"</p> -</li> -</ul> -</div> +<table class="tableblock frame-all grid-all spread"> +<colgroup> +<col style="width: 50%;"> +<col style="width: 50%;"> +</colgroup> +<thead> +<tr> +<th class="tableblock halign-left valign-top">Property Name</th> +<th class="tableblock halign-left valign-top">Description</th> +</tr> +</thead> +<tfoot> +<tr> +<td class="tableblock halign-left valign-top"><p class="tableblock"><code>User Group Provider</code></p></td> +<td class="tableblock halign-left valign-top"><p class="tableblock">The identifier of user group providers to load from. The name of each property must be unique, for example: <code>"User Group Provider A"</code>, <code>"User Group Provider B"</code>, <code>"User Group Provider C"</code> or <code>"User Group Provider 1"</code>, <code>"User Group Provider 2"</code>, <code>"User Group Provider 3"</code></p></td> +</tr> +</tfoot> +</table> <div class="paragraph"> <p>The CompositeConfigurableUserGroupProvider will provide support for retrieving users and groups from multiple sources. Additionally, a single configurable user group provider is required. Users from the configurable user group provider are configurable, however users loaded from one of the User Group Provider [unique key] will not be. The CompositeConfigurableUserGroupProvider has the following properties:</p> </div> -<div class="ulist"> -<ul> -<li> -<p>Configurable User Group Provider - A configurable user group provider.</p> -</li> -<li> -<p>User Group Provider - The identifier of user group providers to load from. The name of each property must be unique, for example: "User Group Provider A", "User Group Provider B", "User Group Provider C" or "User Group Provider 1", "User Group Provider 2", "User Group Provider 3"</p> -</li> -</ul> +<table class="tableblock frame-all grid-all spread"> +<colgroup> +<col style="width: 50%;"> +<col style="width: 50%;"> +</colgroup> +<thead> +<tr> +<th class="tableblock halign-left valign-top">Property Name</th> +<th class="tableblock halign-left valign-top">Description</th> +</tr> +</thead> +<tfoot> +<tr> +<td class="tableblock halign-left valign-top"><p class="tableblock"><code>User Group Provider</code></p></td> +<td class="tableblock halign-left valign-top"><p class="tableblock">The identifier of user group providers to load from. The name of each property must be unique, for example: <code>"User Group Provider A"</code>, <code>"User Group Provider B"</code>, <code>"User Group Provider C"</code> or <code>"User Group Provider 1"</code>, <code>"User Group Provider 2"</code>, <code>"User Group Provider 3"</code></p></td> +</tr> +</tfoot> +<tbody> +<tr> +<td class="tableblock halign-left valign-top"><p class="tableblock"><code>Configurable User Group Provider</code></p></td> +<td class="tableblock halign-left valign-top"><p class="tableblock">A configurable user group provider.</p></td> +</tr> +</tbody> +</table> +</div> </div> +<div class="sect3"> +<h4 id="accesspolicyprovider"><a class="anchor" href="administration-guide.html#accesspolicyprovider"></a>AccessPolicyProvider</h4> <div class="paragraph"> -<p>After you have configured a UserGroupProvider, you must configure an AccessPolicyProvider that will control Access Policies for the identities in the UserGroupProvider. -The default AccessPolicyProvider is the FileAccessPolicyProvider, however, you can develop additional AccessPolicyProvider as extensions. The FileAccessPolicyProvider has the following properties:</p> +<p>After you have configured a UserGroupProvider, you must configure an AccessPolicyProvider that will control Access Policies for the identities in the UserGroupProvider.</p> </div> -<div class="ulist"> -<ul> -<li> -<p>User Group Provider - The identifier for an User Group Provider defined above that will be used to access users and groups for use in the managed access policies.</p> -</li> -<li> -<p>Authorizations File - The file where the FileAccessPolicyProvider will store policies. -By default, 'authorizations.xml' in the 'conf' directory is chosen.</p> -</li> -<li> -<p>Initial Admin Identity - The identity of an initial admin user that will be granted access to the UI and given the ability to create additional users, groups, and policies. -For example, a certificate DN, LDAP identity, or Kerberos principal.</p> -</li> -<li> -<p>NiFi Identity - The identity of a NiFi instance/node that will be accessing this registry. Each NiFi Identity will be granted permission to proxy user requests, as well as read any bucket to perform synchronization status checks.</p> -</li> -</ul> +<div class="sect4"> +<h5 id="fileaccesspolicyprovider"><a class="anchor" href="administration-guide.html#fileaccesspolicyprovider"></a>FileAccessPolicyProvider</h5> +<div class="paragraph"> +<p>The default AccessPolicyProvider is the FileAccessPolicyProvider, however, you can develop additional AccessPolicyProvider as extensions. The FileAccessPolicyProvider has the following properties:</p> </div> +<table class="tableblock frame-all grid-all spread"> +<colgroup> +<col style="width: 50%;"> +<col style="width: 50%;"> +</colgroup> +<thead> +<tr> +<th class="tableblock halign-left valign-top">Property Name</th> +<th class="tableblock halign-left valign-top">Description</th> +</tr> +</thead> +<tfoot> +<tr> +<td class="tableblock halign-left valign-top"><p class="tableblock"><code>NiFi Identity</code></p></td> +<td class="tableblock halign-left valign-top"><p class="tableblock">The identity of a NiFi instance/node that will be accessing this registry. Each NiFi Identity will be granted permission to proxy user requests, as well as read any bucket to perform synchronization status checks.</p></td> +</tr> +</tfoot> +<tbody> +<tr> +<td class="tableblock halign-left valign-top"><p class="tableblock"><code>User Group Provider</code></p></td> +<td class="tableblock halign-left valign-top"><p class="tableblock">The identifier for an User Group Provider defined above that will be used to access users and groups for use in the managed access policies.</p></td> +</tr> +<tr> +<td class="tableblock halign-left valign-top"><p class="tableblock"><code>Authorizations File</code></p></td> +<td class="tableblock halign-left valign-top"><p class="tableblock">The file where the FileAccessPolicyProvider will store policies. By default, <em>authorizations.xml</em> in the <code>conf</code> directory is chosen.</p></td> +</tr> +<tr> +<td class="tableblock halign-left valign-top"><p class="tableblock"><code>Initial Admin Identity</code></p></td> +<td class="tableblock halign-left valign-top"><p class="tableblock">The identity of an initial admin user that will be granted access to the UI and given the ability to create additional users, groups, and policies. For example, a certificate DN, LDAP identity, or Kerberos principal.</p></td> +</tr> +</tbody> +</table> <div class="admonitionblock note"> <table> <tr> @@ -1205,25 +1364,40 @@ Changes to the configured Initial Admin </tr> </table> </div> -<div class="paragraph"> -<p>The default Authorizer is the StandardManagedAuthorizer, however, you can develop additional Authorizers as extensions. The StandardManagedAuthorizer has the following properties:</p> </div> -<div class="ulist"> -<ul> -<li> -<p>Access Policy Provider - The identifier for an Access Policy Provider defined above.</p> -</li> -</ul> </div> <div class="sect3"> <h4 id="initial-admin-identity"><a class="anchor" href="administration-guide.html#initial-admin-identity"></a>Initial Admin Identity (New NiFi Registry Instance)</h4> <div class="paragraph"> -<p>If you are setting up a secured NiFi Registry instance for the first time, you must manually designate an âInitial Admin Identityâ in the 'authorizers.xml' file. +<p>If you are setting up a secured NiFi Registry instance for the first time, you must manually designate an âInitial Admin Identityâ in the <em>authorizers.xml</em> file. This initial admin user is granted access to the UI and given the ability to create additional users, groups, and policies. The value of this property could be a certificate DN , LDAP identity (DN or username), or a Kerberos principal. If you are the NiFi Registry administrator, add yourself as the âInitial Admin Identityâ.</p> </div> <div class="paragraph"> +<p>After you have edited and saved the <em>authorizers.xml</em> file, restart NiFi Registry. +The <em>users.xml</em> and <em>authorizations.xml</em> files will be created, and the âInitial Admin Identityâ user and administrative policies are added during start up. +Once NiFi Registry starts, the âInitial Admin Identityâ user is able to access the UI and begin managing users, groups, and policies.</p> +</div> +<div class="admonitionblock note"> +<table> +<tr> +<td class="icon"> +<i class="fa icon-note" title="Note"></i> +</td> +<td class="content"> +If initial NiFi identities are not provided, they can be added through the UI at a later time by first creating a user for the given +NiFi identity, and then giving that user both Proxy permissions and permission to Buckets/READ in order to read all buckets. +</td> +</tr> +</table> +</div> +<div class="paragraph"> +<p>Some common use cases are described below.</p> +</div> +<div class="sect4"> +<h5 id="file-based-ldap-authentication"><a class="anchor" href="administration-guide.html#file-based-ldap-authentication"></a>File-based (LDAP Authentication)</h5> +<div class="paragraph"> <p>Here is an example certificate DN entry using the name John Smith:</p> </div> <div class="listingblock"> @@ -1255,6 +1429,9 @@ If you are the NiFi Registry administrat </authorizers></pre> </div> </div> +</div> +<div class="sect4"> +<h5 id="file-based-kerberos-authentication"><a class="anchor" href="administration-guide.html#file-based-kerberos-authentication"></a>File-based (Kerberos Authentication)</h5> <div class="paragraph"> <p>Here is an example Kerberos entry using the name John Smith and realm <code>NIFI.APACHE.ORG</code>:</p> </div> @@ -1286,27 +1463,12 @@ If you are the NiFi Registry administrat </authorizers></pre> </div> </div> -<div class="paragraph"> -<p>After you have edited and saved the 'authorizers.xml' file, restart NiFi Registry. -The 'users.xml' and 'authorizations.xml' files will be created, and the âInitial Admin Identityâ user and administrative policies are added during start up. -Once NiFi Registry starts, the âInitial Admin Identityâ user is able to access the UI and begin managing users, groups, and policies.</p> -</div> -<div class="admonitionblock note"> -<table> -<tr> -<td class="icon"> -<i class="fa icon-note" title="Note"></i> -</td> -<td class="content"> -If initial NiFi identities are not provided, they can be added through the UI at a later time by first creating a user for the given -NiFi identity, and then giving that user Proxy permissions, and permission to Buckets/READ in order to read all buckets. -</td> -</tr> -</table> </div> +<div class="sect4"> +<h5 id="ldap-based-users-groups-referencing-user-dn"><a class="anchor" href="administration-guide.html#ldap-based-users-groups-referencing-user-dn"></a>LDAP-based Users/Groups Referencing User DN</h5> <div class="paragraph"> <p>Here is an example loading users and groups from LDAP. Group membership will be driven through the member attribute of each group. -Authorization will still use file based access policies.</p> +Authorization will still use file-based access policies.</p> </div> <div class="paragraph"> <p>Given the following LDAP entries exist:</p> @@ -1406,8 +1568,11 @@ member: cn=User 2,ou=users,o=nifi</pre> </div> </div> <div class="paragraph"> -<p>The 'Initial Admin Identity' value would have loaded from the cn of the User 1 entry based on the 'User Identity Attribute' value.</p> +<p>The <code>Initial Admin Identity</code> value would have loaded from the cn of the User 1 entry based on the <code>User Identity Attribute</code> value.</p> +</div> </div> +<div class="sect4"> +<h5 id="composite-file-and-ldap-based-users-groups"><a class="anchor" href="administration-guide.html#composite-file-and-ldap-based-users-groups"></a>Composite - File and LDAP-based Users/Groups</h5> <div class="paragraph"> <p>Here is an example composite implementation loading users and groups from LDAP and a local file. Group membership will be driven through the member attribute of each group. The users from LDAP will be read only while the users loaded from the file will be configurable in UI.</p> @@ -1493,9 +1658,10 @@ the member attribute of each group. The </div> </div> <div class="paragraph"> -<p>In this example, the users and groups are loaded from LDAP but the servers are managed in a local file. The 'Initial Admin Identity' value came -from an attribute in a LDAP entry based on the 'User Identity Attribute'. The 'NiFi Identity' values are established in the local file using the -'Initial User Identity' properties.</p> +<p>In this example, the users and groups are loaded from LDAP but the servers are managed in a local file. The <code>Initial Admin Identity</code> value came +from an attribute in a LDAP entry based on the <code>User Identity Attribute</code>. The <code>NiFi Identity</code> values are established in the local file using the +<code>Initial User Identity</code> properties.</p> +</div> </div> </div> </div> @@ -1536,6 +1702,9 @@ assume you have downloaded the binary fo <pre>./bin/encrypt-config --nifiRegistry [options]</pre> </div> </div> +<div class="paragraph"> +<p>You can use the following command line options with the <code>encrypt-config</code> tool:</p> +</div> <div class="ulist"> <ul> <li> @@ -1557,33 +1726,33 @@ assume you have downloaded the binary fo <p><code>--oldKey <keyhex></code> If the input files are already protected using a key, this specifies the raw hexadecimal key so that the files can be unprotected before re-protecting.</p> </li> <li> -<p><code>-b</code>,<code>--bootstrapConf <file></code> The bootstrap.conf file containing no master key or an existing master key. If a new password/key is specified and no output bootstrap.conf file is specified, then this file will be overwritten to persist the new master key.</p> +<p><code>-b</code>,<code>--bootstrapConf <file></code> The <em>bootstrap.conf</em> file containing no master key or an existing master key. If a new password/key is specified and no output bootstrap.conf file is specified, then this file will be overwritten to persist the new master key.</p> </li> <li> -<p><code>-B</code>,<code>--outputBootstrapConf <file></code> The destination bootstrap.conf file to persist master key. If specified, the input bootstrap.conf will not be modified.</p> +<p><code>-B</code>,<code>--outputBootstrapConf <file></code> The destination <em>bootstrap.conf</em> file to persist master key. If specified, the input <em>bootstrap.conf</em> will not be modified.</p> </li> <li> -<p><code>-r</code>,<code>--nifiRegistryProperties <file></code> The nifi-registry.properties file containing unprotected config values, overwritten if no output file specified.</p> +<p><code>-r</code>,<code>--nifiRegistryProperties <file></code> The <em>nifi-registry.properties</em> file containing unprotected config values, overwritten if no output file specified.</p> </li> <li> -<p><code>-R</code>,<code>--outputNifiRegistryProperties <file></code> The destination nifi-registry.properties file containing protected config values.</p> +<p><code>-R</code>,<code>--outputNifiRegistryProperties <file></code> The destination <em>nifi-registry.properties</em> file containing protected config values.</p> </li> <li> -<p><code>-a</code>,<code>--authorizersXml <file></code> The authorizers.xml file containing unprotected config values, overwritten if no output file specified.</p> +<p><code>-a</code>,<code>--authorizersXml <file></code> The <em>authorizers.xml</em> file containing unprotected config values, overwritten if no output file specified.</p> </li> <li> -<p><code>-A</code>,<code>--outputAuthorizersXml <file></code> The destination authorizers.xml file containing protected config values.</p> +<p><code>-A</code>,<code>--outputAuthorizersXml <file></code> The destination <em>authorizers.xml</em> file containing protected config values.</p> </li> <li> -<p><code>-i</code>,<code>--identityProvidersXml <file></code> The identity-providers.xml file containing unprotected config values, overwritten if no output file specified.</p> +<p><code>-i</code>,<code>--identityProvidersXml <file></code> The <em>identity-providers.xml</em> file containing unprotected config values, overwritten if no output file specified.</p> </li> <li> -<p><code>-I</code>,<code>--outputIdentityProvidersXml <file></code> The destination identity-providers.xml file containing protected config values.</p> +<p><code>-I</code>,<code>--outputIdentityProvidersXml <file></code> The destination <em>identity-providers.xml</em> file containing protected config values.</p> </li> </ul> </div> <div class="paragraph"> -<p>As an example of how the tool works, assuming that you have installed the tool on a machine supporting 256-bit encryption and with the following existing values in the 'nifi-registry.properties' file:</p> +<p>As an example of how the tool works, assume that you have installed the tool on a machine supporting 256-bit encryption and with the following existing values in the <em>nifi-registry.properties</em> file:</p> </div> <div class="listingblock"> <div class="content"> @@ -1609,7 +1778,7 @@ nifi.registry.security.truststorePasswd= </div> </div> <div class="paragraph"> -<p>As a result, the 'nifi-registry.properties' file is overwritten with protected properties and sibling encryption identifiers (<code>aes/gcm/256</code>, the currently supported algorithm):</p> +<p>As a result, the <em>nifi-registry.properties</em> file is overwritten with protected properties and sibling encryption identifiers (<code>aes/gcm/256</code>, the currently supported algorithm):</p> </div> <div class="listingblock"> <div class="content"> @@ -1626,7 +1795,7 @@ nifi.registry.security.truststorePasswd= </div> </div> <div class="paragraph"> -<p>When applied to 'identity-providers.xml' or 'authorizers.xml', the property elements are updated with an <code>encryption</code> attribute. For example:</p> +<p>When applied to <em>identity-providers.xml</em> or <em>authorizers.xml</em>, the property elements are updated with an <code>encryption</code> attribute. For example:</p> </div> <div class="listingblock"> <div class="content"> @@ -1645,7 +1814,7 @@ nifi.registry.security.truststorePasswd= </div> </div> <div class="paragraph"> -<p>Additionally, the 'bootstrap.conf' file is updated with the encryption key as follows:</p> +<p>Additionally, the <em>bootstrap.conf</em> file is updated with the encryption key as follows:</p> </div> <div class="listingblock"> <div class="content"> @@ -1658,8 +1827,8 @@ nifi.registry.bootstrap.sensitive.key=01 To encrypt additional properties, specify them as comma-separated values in the <code>nifi.registry.sensitive.props.additional.keys</code> property.</p> </div> <div class="paragraph"> -<p>If the 'nifi-registry.properties' file already has valid protected values and you wish to protect additional values using the -same master key already present in your 'bootstrap.conf', then run the tool without specifying a new key:</p> +<p>If the <em>nifi-registry.properties</em> file already has valid protected values and you wish to protect additional values using the +same master key already present in your <em>bootstrap.conf</em>, then run the tool without specifying a new key:</p> </div> <div class="listingblock"> <div class="content"> @@ -1675,7 +1844,7 @@ same master key already present in your <div class="paragraph"> <p>In order to change the key used to encrypt the sensitive values, provide the new key or password using the <code>-k</code> or <code>-p</code> flags as usual, and provide the existing key or password using <code>--old-key</code> or <code>--old-password</code> respectively. This will allow the toolkit to decrypt the -existing values and re-encrypt them, and update 'bootstrap.conf' with the new key. Only one of the key or password needs to be specified +existing values and re-encrypt them, and update <em>bootstrap.conf</em> with the new key. Only one of the key or password needs to be specified for each phase (old vs. new), and any combination is sufficient:</p> </div> <div class="ulist"> @@ -1701,7 +1870,7 @@ for each phase (old vs. new), and any co <h2 id="bootstrap_properties"><a class="anchor" href="administration-guide.html#bootstrap_properties"></a>Bootstrap Properties</h2> <div class="sectionbody"> <div class="paragraph"> -<p>The <em>bootstrap.conf</em> file in the <em>conf</em> directory allows users to configure settings for how NiFi Registry should be started. This includes parameters, such as the size of the Java Heap, what Java command to run, and Java System Properties.</p> +<p>The <em>bootstrap.conf</em> file in the <code>conf</code> directory allows users to configure settings for how NiFi Registry should be started. This includes parameters, such as the size of the Java Heap, what Java command to run, and Java System Properties.</p> </div> <div class="paragraph"> <p>Here, we will address the different properties that are made available in the file. Any changes to this file will take effect only after NiFi Registry has been stopped and restarted.</p> @@ -1717,27 +1886,27 @@ for each phase (old vs. new), and any co <td class="tableblock halign-left valign-top"><p class="tableblock"><strong>Description</strong></p></td> </tr> <tr> -<td class="tableblock halign-left valign-top"><p class="tableblock">java</p></td> +<td class="tableblock halign-left valign-top"><p class="tableblock"><code>java</code></p></td> <td class="tableblock halign-left valign-top"><p class="tableblock">Specifies the fully qualified java command to run. By default, it is simply <code>java</code> but could be changed to an absolute path or a reference an environment variable, such as <code>$JAVA_HOME/bin/java</code></p></td> </tr> <tr> -<td class="tableblock halign-left valign-top"><p class="tableblock">run.as</p></td> -<td class="tableblock halign-left valign-top"><p class="tableblock">The username to run NiFi Registry as. For instance, if NiFi Registry should be run as the 'nifi_registry' user, setting this value to 'nifi_registry' will cause the NiFi Registry Process to be run as the 'nifi_registry' user. This property is ignored on Windows. For Linux, the specified user may require sudo permissions.</p></td> +<td class="tableblock halign-left valign-top"><p class="tableblock"><code>run.as</code></p></td> +<td class="tableblock halign-left valign-top"><p class="tableblock">The username to run NiFi Registry as. For instance, if NiFi Registry should be run as the <code>nifi_registry</code> user, setting this value to <code>nifi_registry</code> will cause the NiFi Registry Process to be run as the <code>nifi_registry</code> user. This property is ignored on Windows. For Linux, the specified user may require sudo permissions.</p></td> </tr> <tr> -<td class="tableblock halign-left valign-top"><p class="tableblock">lib.dir</p></td> +<td class="tableblock halign-left valign-top"><p class="tableblock"><code>lib.dir</code></p></td> <td class="tableblock halign-left valign-top"><p class="tableblock">The <em>lib</em> directory to use for NiFi Registry. By default, this is set to <code>./lib</code></p></td> </tr> <tr> -<td class="tableblock halign-left valign-top"><p class="tableblock">conf.dir</p></td> -<td class="tableblock halign-left valign-top"><p class="tableblock">The <em>conf</em> directory to use for NiFi Registry. By default, this is set to <code>./conf</code></p></td> +<td class="tableblock halign-left valign-top"><p class="tableblock"><code>conf.dir</code></p></td> +<td class="tableblock halign-left valign-top"><p class="tableblock">The <code>conf</code> directory to use for NiFi Registry. By default, this is set to <code>./conf</code></p></td> </tr> <tr> -<td class="tableblock halign-left valign-top"><p class="tableblock">graceful.shutdown.seconds</p></td> -<td class="tableblock halign-left valign-top"><p class="tableblock">When NiFi Registry is instructed to shutdown, the Bootstrap will wait this number of seconds for the process to shutdown cleanly. At this amount of time, if the service is still running, the Bootstrap will "kill" the process, or terminate it abruptly. By default, this is set to <code>20</code>.</p></td> +<td class="tableblock halign-left valign-top"><p class="tableblock"><code>graceful.shutdown.seconds</code></p></td> +<td class="tableblock halign-left valign-top"><p class="tableblock">When NiFi Registry is instructed to shutdown, the Bootstrap will wait this number of seconds for the process to shutdown cleanly. At this amount of time, if the service is still running, the Bootstrap will <code>kill</code> the process, or terminate it abruptly. By default, this is set to <code>20</code>.</p></td> </tr> <tr> -<td class="tableblock halign-left valign-top"><p class="tableblock">java.arg.N</p></td> +<td class="tableblock halign-left valign-top"><p class="tableblock"><code>java.arg.N</code></p></td> <td class="tableblock halign-left valign-top"><p class="tableblock">Any number of JVM arguments can be passed to the NiFi Registry JVM when the process is started. These arguments are defined by adding properties to <em>bootstrap.conf</em> that begin with <code>java.arg.</code>. The rest of the property name is not relevant, other than to different property names, and will be ignored. The default includes properties for minimum and maximum Java Heap size, the garbage collector to use, etc.</p></td> </tr> </tbody> @@ -1779,7 +1948,7 @@ this the proxy can send the request to N </div> <div class="paragraph"> <p>An example Apache proxy configuration that sets the required properties may look like the following. Complete proxy configuration is outside of the scope of this document. -Please refer the documentation of the proxy for guidance for your deployment environment and use case.</p> +Please refer to the documentation of the proxy for guidance with your deployment environment and use case.</p> </div> <div class="literalblock"> <div class="content"> @@ -1815,7 +1984,7 @@ and load the user’s Kerberos ticke NiFi Registry will attempt to validate this ticket with the KDC. If it is successful, the user’s <em>principal</em> will be returned as the identity, and the flow will follow login/credential authentication, in that a JWT will be issued in the response to prevent the unnecessary overhead of Kerberos authentication on every subsequent request. If the ticket cannot be validated, it will return with the appropriate error response code. The user will then be able to provide their Kerberos credentials to the login -form if the <code>KerberosIdentityProvider</code> has been configured. See <a href="administration-guide.html#kerberos_identity_provider">Kerberos</a> identity provider for more details.</p> +form if the <code>KerberosIdentityProvider</code> has been configured. See <a href="administration-guide.html#kerberos_identity_provider">Kerberos Identity Provider</a> for more details.</p> </div> <div class="paragraph"> <p>NiFi Registry will only respond to Kerberos SPNEGO negotiation over an HTTPS connection, as unsecured requests are never authenticated.</p> @@ -1839,7 +2008,7 @@ Some will provide the local Kerberos tic <p>Some browsers (legacy IE) do not support recent encryption algorithms such as AES, and are restricted to legacy algorithms (DES). This should be noted when generating keytabs.</p> </li> <li> -<p>The KDC must be configured and a service principal defined for NiFi and a keytab exported. Comprehensive instructions for Kerberos server configuration and administration are beyond the scope of this document (see <a href="http://web.mit.edu/kerberos/krb5-current/doc/admin/index.html"; target="_blank">MIT Kerberos Admin Guide</a>), but an example is below:</p> +<p>The KDC must be configured and a service principal defined for NiFi and a keytab exported. Comprehensive instructions for Kerberos server configuration and administration are beyond the scope of this document (see <a href="http://web.mit.edu/kerberos/krb5-current/doc/admin/index.html"; target="_blank">MIT Kerberos Admin Guide</a>), but an example is below.</p> </li> <li> <p>Kerberos tickets may use AES encryption with keys up to 256-bits in length, and therefore unlimited strength encryption policies may be required for the Jave Runtime Environment (JRE) used for NiFi Registry when Kerberos SPNEGO is configured.</p> @@ -1881,7 +2050,7 @@ root@kdc:~#</pre> <h2 id="system_properties"><a class="anchor" href="administration-guide.html#system_properties"></a>System Properties</h2> <div class="sectionbody"> <div class="paragraph"> -<p>The <em>nifi-registry.properties</em> file in the <em>conf</em> directory is the main configuration file for controlling how NiFi Registry runs. This section +<p>The <em>nifi-registry.properties</em> file in the <code>conf</code> directory is the main configuration file for controlling how NiFi Registry runs. This section provides an overview of the properties in this file and includes some notes on how to configure it in a way that will make upgrading easier. <strong>After making changes to this file, restart NiFi Registry in order for the changes to take effect.</strong></p> </div> @@ -1913,31 +2082,31 @@ Values for periods of time and data size <td class="tableblock halign-left valign-top"><p class="tableblock"><strong>Description</strong></p></td> </tr> <tr> -<td class="tableblock halign-left valign-top"><p class="tableblock">nifi.registry.web.war.directory</p></td> +<td class="tableblock halign-left valign-top"><p class="tableblock"><code>nifi.registry.web.war.directory</code></p></td> <td class="tableblock halign-left valign-top"><p class="tableblock">This is the location of the web war directory. The default value is <code>./lib</code>.</p></td> </tr> <tr> -<td class="tableblock halign-left valign-top"><p class="tableblock">nifi.registry.web.http.host</p></td> +<td class="tableblock halign-left valign-top"><p class="tableblock"><code>nifi.registry.web.http.host</code></p></td> <td class="tableblock halign-left valign-top"><p class="tableblock">The HTTP host. It is blank by default.</p></td> </tr> <tr> -<td class="tableblock halign-left valign-top"><p class="tableblock">nifi.registry.web.http.port</p></td> +<td class="tableblock halign-left valign-top"><p class="tableblock"><code>nifi.registry.web.http.port</code></p></td> <td class="tableblock halign-left valign-top"><p class="tableblock">The HTTP port. The default value is <code>18080</code>.</p></td> </tr> <tr> -<td class="tableblock halign-left valign-top"><p class="tableblock">nifi.registry.web.https.host</p></td> +<td class="tableblock halign-left valign-top"><p class="tableblock"><code>nifi.registry.web.https.host</code></p></td> <td class="tableblock halign-left valign-top"><p class="tableblock">The HTTPS host. It is blank by default.</p></td> </tr> <tr> -<td class="tableblock halign-left valign-top"><p class="tableblock">nifi.registry.web.https.port</p></td> +<td class="tableblock halign-left valign-top"><p class="tableblock"><code>nifi.registry.web.https.port</code></p></td> <td class="tableblock halign-left valign-top"><p class="tableblock">The HTTPS port. It is blank by default. When configuring NiFi Registry to run securely, this port should be configured.</p></td> </tr> <tr> -<td class="tableblock halign-left valign-top"><p class="tableblock">nifi.registry.web.jetty.working.directory</p></td> +<td class="tableblock halign-left valign-top"><p class="tableblock"><code>nifi.registry.web.jetty.working.directory</code></p></td> <td class="tableblock halign-left valign-top"><p class="tableblock">The location of the Jetty working directory. The default value is <code>./work/jetty</code>.</p></td> </tr> <tr> -<td class="tableblock halign-left valign-top"><p class="tableblock">nifi.registry.web.jetty.threads</p></td> +<td class="tableblock halign-left valign-top"><p class="tableblock"><code>nifi.registry.web.jetty.threads</code></p></td> <td class="tableblock halign-left valign-top"><p class="tableblock">The number of Jetty threads. The default value is <code>200</code>.</p></td> </tr> </tbody> @@ -1947,7 +2116,7 @@ Values for periods of time and data size <h3 id="security-properties"><a class="anchor" href="administration-guide.html#security-properties"></a>Security Properties</h3> <div class="paragraph"> <p>These properties pertain to various security features in NiFi Registry. Many of these properties are covered in more detail in the -Security Configuration section of this Administrator’s Guide.</p> +<a href="administration-guide.html#security_configuration">Security Configuration</a> section.</p> </div> <table class="tableblock frame-all grid-all spread"> <colgroup> @@ -1960,51 +2129,51 @@ Security Configuration section of this A <td class="tableblock halign-left valign-top"><p class="tableblock"><strong>Description</strong></p></td> </tr> <tr> -<td class="tableblock halign-left valign-top"><p class="tableblock">nifi.registry.security.keystore</p></td> +<td class="tableblock halign-left valign-top"><p class="tableblock"><code>nifi.registry.security.keystore</code></p></td> <td class="tableblock halign-left valign-top"><p class="tableblock">The full path and name of the keystore. It is blank by default.</p></td> </tr> <tr> -<td class="tableblock halign-left valign-top"><p class="tableblock">nifi.registry.security.keystoreType</p></td> +<td class="tableblock halign-left valign-top"><p class="tableblock"><code>nifi.registry.security.keystoreType</code></p></td> <td class="tableblock halign-left valign-top"><p class="tableblock">The keystore type. It is blank by default.</p></td> </tr> <tr> -<td class="tableblock halign-left valign-top"><p class="tableblock">nifi.registry.security.keystorePasswd</p></td> +<td class="tableblock halign-left valign-top"><p class="tableblock"><code>nifi.registry.security.keystorePasswd</code></p></td> <td class="tableblock halign-left valign-top"><p class="tableblock">The keystore password. It is blank by default.</p></td> </tr> <tr> -<td class="tableblock halign-left valign-top"><p class="tableblock">nifi.registry.security.keyPasswd</p></td> +<td class="tableblock halign-left valign-top"><p class="tableblock"><code>nifi.registry.security.keyPasswd</code></p></td> <td class="tableblock halign-left valign-top"><p class="tableblock">The key password. It is blank by default.</p></td> </tr> <tr> -<td class="tableblock halign-left valign-top"><p class="tableblock">nifi.registry.security.truststore</p></td> +<td class="tableblock halign-left valign-top"><p class="tableblock"><code>nifi.registry.security.truststore</code></p></td> <td class="tableblock halign-left valign-top"><p class="tableblock">The full path and name of the truststore. It is blank by default.</p></td> </tr> <tr> -<td class="tableblock halign-left valign-top"><p class="tableblock">nifi.registry.security.truststoreType</p></td> +<td class="tableblock halign-left valign-top"><p class="tableblock"><code>nifi.registry.security.truststoreType</code></p></td> <td class="tableblock halign-left valign-top"><p class="tableblock">The truststore type. It is blank by default.</p></td> </tr> <tr> -<td class="tableblock halign-left valign-top"><p class="tableblock">nifi.registry.security.truststorePasswd</p></td> +<td class="tableblock halign-left valign-top"><p class="tableblock"><code>nifi.registry.security.truststorePasswd</code></p></td> <td class="tableblock halign-left valign-top"><p class="tableblock">The truststore password. It is blank by default.</p></td> </tr> <tr> -<td class="tableblock halign-left valign-top"><p class="tableblock">nifi.registry.security.needClientAuth</p></td> -<td class="tableblock halign-left valign-top"><p class="tableblock">This specifies that connecting clients must authenticate with a client cert. Setting this to <code>false</code> will specify that connecting clients may optionally authenticate with a client cert, but may also login with a username and password against a configured identity provider. The default value is true.</p></td> +<td class="tableblock halign-left valign-top"><p class="tableblock"><code>nifi.registry.security.needClientAuth</code></p></td> +<td class="tableblock halign-left valign-top"><p class="tableblock">This specifies that connecting clients must authenticate with a client cert. Setting this to <code>false</code> will specify that connecting clients may optionally authenticate with a client cert, but may also login with a username and password against a configured identity provider. The default value is <code>true</code>.</p></td> </tr> <tr> -<td class="tableblock halign-left valign-top"><p class="tableblock">nifi.registry.security.authorizers.configuration.file</p></td> +<td class="tableblock halign-left valign-top"><p class="tableblock"><code>nifi.registry.security.authorizers.configuration.file</code></p></td> <td class="tableblock halign-left valign-top"><p class="tableblock">This is the location of the file that specifies how authorizers are defined. The default value is <code>./conf/authorizers.xml</code>.</p></td> </tr> <tr> -<td class="tableblock halign-left valign-top"><p class="tableblock">nifi.registry.security.authorizer</p></td> -<td class="tableblock halign-left valign-top"><p class="tableblock">Specifies which of the configured Authorizers in the authorizers.xml file to use. By default, it is set to <code>managed-authorizer</code>.</p></td> +<td class="tableblock halign-left valign-top"><p class="tableblock"><code>nifi.registry.security.authorizer</code></p></td> +<td class="tableblock halign-left valign-top"><p class="tableblock">Specifies which of the configured Authorizers in the <em>authorizers.xml</em> file to use. By default, it is set to <code>managed-authorizer</code>.</p></td> </tr> <tr> -<td class="tableblock halign-left valign-top"><p class="tableblock">nifi.registry.security.identity.providers.configuration.file</p></td> +<td class="tableblock halign-left valign-top"><p class="tableblock"><code>nifi.registry.security.identity.providers.configuration.file</code></p></td> <td class="tableblock halign-left valign-top"><p class="tableblock">This is the location of the file that specifies how username/password authentication is performed. This file is only considered if <code>nifi.registry.security.identity.provider</code> is configured with a provider identifier. The default value is <code>./conf/identity-providers.xml</code>.</p></td> </tr> <tr> -<td class="tableblock halign-left valign-top"><p class="tableblock">nifi.registry.security.identity.provider</p></td> +<td class="tableblock halign-left valign-top"><p class="tableblock"><code>nifi.registry.security.identity.provider</code></p></td> <td class="tableblock halign-left valign-top"><p class="tableblock">This indicates what type of identity provider to use. The default value is blank, can be set to the identifier from a provider in the file specified in <code>nifi.registry.security.identity.providers.configuration.file</code>. Setting this property will trigger NiFi Registry to support username/password authentication.</p></td> </tr> </tbody> @@ -2027,7 +2196,7 @@ content of the flows saved to the regist <td class="tableblock halign-left valign-top"><p class="tableblock"><strong>Description</strong></p></td> </tr> <tr> -<td class="tableblock halign-left valign-top"><p class="tableblock">nifi.registry.providers.configuration.file</p></td> +<td class="tableblock halign-left valign-top"><p class="tableblock"><code>nifi.registry.providers.configuration.file</code></p></td> <td class="tableblock halign-left valign-top"><p class="tableblock">This is the location of the file where flow persistence providers are configured. The default value is <code>./conf/providers.xml</code>.</p></td> </tr> </tbody> @@ -2052,11 +2221,11 @@ content of the flows saved to the regist <td class="tableblock halign-left valign-top"><p class="tableblock"><strong>Description</strong></p></td> </tr> <tr> -<td class="tableblock halign-left valign-top"><p class="tableblock">nifi.registry.db.directory</p></td> +<td class="tableblock halign-left valign-top"><p class="tableblock"><code>nifi.registry.db.directory</code></p></td> <td class="tableblock halign-left valign-top"><p class="tableblock">The location of the Registry database directory. The default value is <code>./database</code>.</p></td> </tr> <tr> -<td class="tableblock halign-left valign-top"><p class="tableblock">nifi.registry.db.url.append</p></td> +<td class="tableblock halign-left valign-top"><p class="tableblock"><code>nifi.registry.db.url.append</code></p></td> <td class="tableblock halign-left valign-top"><p class="tableblock">This property specifies additional arguments to add to the connection string for the Registry database. The default value should be used and should not be changed. It is: <code>;LOCK_TIMEOUT=25000;WRITE_DELAY=0;AUTO_SERVER=FALSE</code>.</p></td> </tr> </tbody> @@ -2076,32 +2245,32 @@ is configured via the following properti <td class="tableblock halign-left valign-top"><p class="tableblock"><strong>Description</strong></p></td> </tr> <tr> -<td class="tableblock halign-left valign-top"><p class="tableblock">nifi.registry.db.url</p></td> -<td class="tableblock halign-left valign-top"><p class="tableblock">The full JDBC connection string. The default value will specify a new H2 database in the same location as the previous one. For example, 'jdbc:h2:./database/nifi-registry-primary;'.</p></td> +<td class="tableblock halign-left valign-top"><p class="tableblock"><code>nifi.registry.db.url</code></p></td> +<td class="tableblock halign-left valign-top"><p class="tableblock">The full JDBC connection string. The default value will specify a new H2 database in the same location as the previous one. For example, <code>jdbc:h2:./database/nifi-registry-primary;</code>.</p></td> </tr> <tr> -<td class="tableblock halign-left valign-top"><p class="tableblock">nifi.registry.db.driver.class</p></td>
[... 385 lines stripped ...]
