[
https://issues.apache.org/jira/browse/NIFI-2561?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15424084#comment-15424084
]
ASF GitHub Bot commented on NIFI-2561:
--------------------------------------
Github user YolandaMDavis commented on the issue:
https://github.com/apache/nifi/pull/873
@mcgilman I was able to validate the changes to separate spnego
authentication from kerberos service authentication. I summarized my tests here:
[NIFI-2561-PR-873 Test
Summary.docx](https://github.com/apache/nifi/files/422040/NIFI-2561-PR-873.Test.Summary.docx)
My tests utilized a remote standalone nifi instance which ran alongside an
instance of Apache Ranger and a KDC. Upon proper configuration for kerberos
locally and on NiFi for each test case I did not encounter any issues related
to kerberos authentication. I think it looks good for merge pending comments
review/discussion.
In addition to the comment I made above, I was wondering, since now two
types of keytabs could be referenced, what's the potential that they could for
different realms, e.g. Ranger existing Realm or different KDC then one used to
authenticate users ? If so it may be useful to have documentation highlighting
that krb5.conf may need to be adjusted for that case (multiple realms).
> Need to separate SPNEGO and service principals for Kerberos
> -----------------------------------------------------------
>
> Key: NIFI-2561
> URL: https://issues.apache.org/jira/browse/NIFI-2561
> Project: Apache NiFi
> Issue Type: Bug
> Components: Core Framework
> Affects Versions: 1.0.0
> Reporter: Joseph Witt
> Assignee: Matt Gilman
> Fix For: 1.0.0
>
>
> Today we have a single principal used for interacting with NiFi via SPNEGO
> and when operating as a service. We should offer a way to specify/establish
> these principals separately such as
> nifi.kerberos.service.principal=nifi/hostname@REALM
> nifi.kerberos.service.keytab=path
> nifi.kerberos.spnego.principal=HTTP/hostname@REALM
> nifi.kerberos.spnego.keytab=path
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
