gresockj commented on a change in pull request #5262:
URL: https://github.com/apache/nifi/pull/5262#discussion_r680166368
##########
File path: nifi-docs/src/main/asciidoc/administration-guide.adoc
##########
@@ -489,6 +489,28 @@ To enable authentication via Apache Knox the following
properties must be config
this listing. The audience that is populated in the token can be configured in
Knox.
|==================================================================================================================================================
+[[json_web_token]]
+=== JSON Web Tokens
+
+NiFi uses JSON Web Tokens to provide authenticated access after the initial
login process. Generated JSON Web Tokens include the authenticated user identity
+as well as the issuer and expiration from the configured Login Identity
Provider.
+
+NiFi uses generated RSA Key Pairs with a key size of 4096 bits to support the
`RS512` algorithm for JSON Web Signatures. The system stores RSA
+Public Keys using the configured local State Provider and retains the RSA
Private Key in memory. This approach supports signature verification
+for the expiration configured in the Login Identity Provider without
persisting the private key.
+
+JSON Web Token support includes revocation on logout using JSON Web Token
Identifiers. The system denies access for expired tokens based on the
+Login Identity Provider configuration, but revocation invalidates the token
prior to expiration. The system stores revoked identifiers using the
Review comment:
I noticed that the SingleUserLoginIdentityProvider is hard-coded to 8
hours rather than being configured in login-identity-provider.xml as this
implies. I think that's appropriate for this provider, but you may want to
clarify here. It may also be useful to add the 8-hour expiration time in the
`login-identity-providers.xml` comments.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
