gresockj commented on a change in pull request #5262:
URL: https://github.com/apache/nifi/pull/5262#discussion_r680402358
##########
File path: nifi-docs/src/main/asciidoc/administration-guide.adoc
##########
@@ -489,6 +489,28 @@ To enable authentication via Apache Knox the following
properties must be config
this listing. The audience that is populated in the token can be configured in
Knox.
|==================================================================================================================================================
+[[json_web_token]]
+=== JSON Web Tokens
+
+NiFi uses JSON Web Tokens to provide authenticated access after the initial
login process. Generated JSON Web Tokens include the authenticated user identity
+as well as the issuer and expiration from the configured Login Identity
Provider.
+
+NiFi uses generated RSA Key Pairs with a key size of 4096 bits to support the
`RS512` algorithm for JSON Web Signatures. The system stores RSA
+Public Keys using the configured local State Provider and retains the RSA
Private Key in memory. This approach supports signature verification
+for the expiration configured in the Login Identity Provider without
persisting the private key.
+
+JSON Web Token support includes revocation on logout using JSON Web Token
Identifiers. The system denies access for expired tokens based on the
+Login Identity Provider configuration, but revocation invalidates the token
prior to expiration. The system stores revoked identifiers using the
Review comment:
I see your point -- I had read "based on the Login Identity Provider
configuration" as only referring to the explicit configuration values, but it
makes sense that this would also cover the default settings, so no change
should be needed. A separate PR to update the Single User documentation sounds
fine.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
