[
https://issues.apache.org/jira/browse/NIFI-13878?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17890098#comment-17890098
]
David Handermann edited comment on NIFI-13878 at 10/16/24 1:55 PM:
-------------------------------------------------------------------
Thanks for summarizing this issue [~deragon].
At a protocol level, mutual TLS always comes prior to any other authentication,
because the TLS handshake occurs before any HTTP communication. NiFi uses
mutual TLS for cluster communication, so it is required for any secured
deployments. For this reason, the NiFi embedded web server is set to request,
but not require, client certificates for all connections. Based on this
protocol behavior, it is not possible to turn off client certificate requests
at the NiFi server level.
Without any additional changes, one solution is to deployment NiFi with a
reverse proxy server or gateway. In that configuration, the gateway can handle
the TLS communication to NiFi nodes, and then pass through the OpenID Connect
credentials. The gateway would not request a certificate from the client web
browser.
It is worth noting that such a configuration involves additional
infrastructure, and more configuration work, but it is common practice for
production deployments.
was (Author: exceptionfactory):
Thanks for summarizing this issue [~deragon].
At a protocol level, mutual TLS always comes prior to any other authentication,
because the TLS handshake occurs before any HTTP communication. NiFi uses
mutual TLS for cluster communication, so it is required for any secured
deployments. For this reason, the NiFi embedded web server is set to request,
but not require, client certificates for all connections. For this reason, it
is not possible to turn off client certificate requests at the NiFi server
level.
Without any additional changes, one solution is to deployment NiFi with a
reverse proxy server or gateway. In that configuration, the gateway can handle
the TLS communication to NiFi nodes, and then pass through the OpenID Connect
credentials. The gateway would not request a certificate from the client web
browser.
It is worth noting that such a configuration involves additional
infrastructure, and more configuration work, but it is common practice for
production deployments.
> Implement an option in nifi.properties that forces authentication with
> OpenID/SSO
> ---------------------------------------------------------------------------------
>
> Key: NIFI-13878
> URL: https://issues.apache.org/jira/browse/NIFI-13878
> Project: Apache NiFi
> Issue Type: Improvement
> Components: Configuration
> Affects Versions: 2.0.0-M4
> Environment: RHEL 9.4 on AWS EC2 with Okta as Identity Provider.
> Reporter: Hans Deragon
> Priority: Major
> Labels: OpenID, certificate
>
> This is a feature request to implement an option in nifi.properties that
> forces authentication with OpenID/SSO, or disable X.509 certificate use for
> authentication.
> We discovered with NiFi 2.0.0-M4 that if a personal X.509 certificate is set
> in user accounts under Windows, that certificate is getting used by NiFi for
> authentication instead of the normal OpenID/SSO headers. The user id in the
> X.509 certificate is not the same as the one in OpenID/SSO (Okta) and thus,
> the person is denied access to NiFi.
> This particular certificate is not meant to be used by NiFi to authenticate
> and authorize users in NiFi even though it is recognized by our Identity
> Provider. We desire that NiFi only authenticate and authorize users with
> OpenID/SSO (which works when I remove the personal certificate from user's
> Windows workstations).
> This issue has been discussed in NiFi User's mailing list but nobody seams to
> come up with a solution to our problem, thus this Jira.
> See: [NiFi 2.0 and possibility to ignore X.509 certificate or force
> authorization with
> OpenID/SSO.|https://lists.apache.org/thread/yphnmj27dpkpdm548mt7dd0jkbjn3wch]
> More details:
> * In
> nifi-framework-bundle/.../web/security/x509/X509AuthenticationFilter.java, I
> commented out code to attemptAuthentication() always return null and that
> works (of course).
> * I attempted to play with the order of addFilterBefore() in
> nifi-framework-bundle/.../web/security/configuration/WebSecurityConfiguration.java
> to hope that OpenID/SSO would always be
> tested first, without success.
> * I had one machine (an AWS EC2) that OpenID/SSO always worked despite the
> certificate. I do not understand why that happened and of course, I compared
> the conf/ directory to another EC2 which uses the certificate instead to
> authenticate the user and found not significant difference, nothing related
> to this topic. I was using Chrome when this happened and clearing the
> cookies did not change the behavior. Using Edge to access the same machine
> would cause the certificate being used. Very odd behavior which I cannot
> explain.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
