greyp9 commented on a change in pull request #5262:
URL: https://github.com/apache/nifi/pull/5262#discussion_r683865470
##########
File path: nifi-docs/src/main/asciidoc/administration-guide.adoc
##########
@@ -489,6 +489,28 @@ To enable authentication via Apache Knox the following
properties must be config
this listing. The audience that is populated in the token can be configured in
Knox.
|==================================================================================================================================================
+[[json_web_token]]
+=== JSON Web Tokens
+
+NiFi uses JSON Web Tokens to provide authenticated access after the initial
login process. Generated JSON Web Tokens include the authenticated user identity
+as well as the issuer and expiration from the configured Login Identity
Provider.
+
+NiFi uses generated RSA Key Pairs with a key size of 4096 bits to support the
`RS512` algorithm for JSON Web Signatures. The system stores RSA
Review comment:
I see the recent industry movement to 3072-bit minimum RSA key lengths.
4096 is probably a good choice to future proof this implementation. I have
concerns about performance of key generation at startup on lower-end devices,
but this is probably not a valid concern for NiFi.
https://knowledge.digicert.com/alerts/code-signing-new-minimum-rsa-keysize.html
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
