[
https://issues.apache.org/jira/browse/NIFI-13878?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
David Handermann updated NIFI-13878:
------------------------------------
Affects Version/s: (was: 2.0.0-M4)
> Implement an option in nifi.properties that forces authentication with
> OpenID/SSO
> ---------------------------------------------------------------------------------
>
> Key: NIFI-13878
> URL: https://issues.apache.org/jira/browse/NIFI-13878
> Project: Apache NiFi
> Issue Type: Improvement
> Components: Configuration
> Environment: RHEL 9.4 on AWS EC2 with Okta as Identity Provider.
> Reporter: Hans Deragon
> Priority: Major
> Labels: OpenID, certificate
>
> This is a feature request to implement an option in nifi.properties that
> forces authentication with OpenID/SSO, or disable X.509 certificate use for
> authentication.
> We discovered with NiFi 2.0.0-M4 that if a personal X.509 certificate is set
> in user accounts under Windows, that certificate is getting used by NiFi for
> authentication instead of the normal OpenID/SSO headers. The user id in the
> X.509 certificate is not the same as the one in OpenID/SSO (Okta) and thus,
> the person is denied access to NiFi.
> This particular certificate is not meant to be used by NiFi to authenticate
> and authorize users in NiFi even though it is recognized by our Identity
> Provider. We desire that NiFi only authenticate and authorize users with
> OpenID/SSO (which works when I remove the personal certificate from user's
> Windows workstations).
> This issue has been discussed in NiFi User's mailing list but nobody seams to
> come up with a solution to our problem, thus this Jira.
> See: [NiFi 2.0 and possibility to ignore X.509 certificate or force
> authorization with
> OpenID/SSO.|https://lists.apache.org/thread/yphnmj27dpkpdm548mt7dd0jkbjn3wch]
> More details:
> * In
> nifi-framework-bundle/.../web/security/x509/X509AuthenticationFilter.java, I
> commented out code in attemptAuthentication() so it always returns null and
> that works (of course).
> * I attempted to play with the order of addFilterBefore() in
> nifi-framework-bundle/.../web/security/configuration/WebSecurityConfiguration.java
> to hope that OpenID/SSO would always be
> tested first, without success.
> * I had one machine (an AWS EC2) that OpenID/SSO always worked despite the
> certificate. I do not understand why that happened and of course, I compared
> the conf/ directory to another EC2 which uses the certificate instead to
> authenticate the user and found not significant difference, nothing related
> to this topic. I was using Chrome when this happened and clearing the
> cookies did not change the behavior. Using Edge to access the same machine
> would cause the certificate being used. Very odd behavior which I cannot
> explain.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
