[
https://issues.apache.org/jira/browse/NIFI-13878?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17904861#comment-17904861
]
Hans Deragon commented on NIFI-13878:
-------------------------------------
To help others which could find themselves with the same problem, here is a
template to setup Nginx as a reverse proxy for NiFi. The NiFi instance must
be configured to use TLS (HTTPS) for this to work. If TLS is not on, SSO is
deactivated in NiFi and the user gets to login as an anonymous user only. For
TLS to work, _ssl_certificate_ and _ssl_certificate_key_ must be set to the
same certificate and key that the NiFi instance is using.
There might be more headers passed than necessary in the configuration below.
Content of _/etc/nginx/conf.d/nifi.conf:_
{code:java}
server {
listen 443 ssl http2;
server_name <FQDN of NiFi instance>;
ssl_certificate /etc/nginx/cert/certificate.pem;
ssl_certificate_key /etc/nginx/cert/certificate-private-key.pem;
location / {
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-NginX-Proxy true;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection 'upgrade';
proxy_set_header Host $http_host;
proxy_pass https://<FQDN of NiFi instance>:8443;
proxy_pass_header Server; }
}
{code}
> Implement an option in nifi.properties that forces authentication with
> OpenID/SSO
> ---------------------------------------------------------------------------------
>
> Key: NIFI-13878
> URL: https://issues.apache.org/jira/browse/NIFI-13878
> Project: Apache NiFi
> Issue Type: Improvement
> Components: Configuration
> Environment: RHEL 9.4 on AWS EC2 with Okta as Identity Provider.
> Reporter: Hans Deragon
> Priority: Major
> Labels: OpenID, certificate
>
> This is a feature request to implement an option in nifi.properties that
> forces authentication with OpenID/SSO, or disable X.509 certificate use for
> authentication.
> We discovered with NiFi 2.0.0-M4 that if a personal X.509 certificate is set
> in user accounts under Windows, that certificate is getting used by NiFi for
> authentication instead of the normal OpenID/SSO headers. The user id in the
> X.509 certificate is not the same as the one in OpenID/SSO (Okta) and thus,
> the person is denied access to NiFi.
> This particular certificate is not meant to be used by NiFi to authenticate
> and authorize users in NiFi even though it is recognized by our Identity
> Provider. We desire that NiFi only authenticate and authorize users with
> OpenID/SSO (which works when I remove the personal certificate from user's
> Windows workstations).
> This issue has been discussed in NiFi User's mailing list but nobody seams to
> come up with a solution to our problem, thus this Jira.
> See: [NiFi 2.0 and possibility to ignore X.509 certificate or force
> authorization with
> OpenID/SSO.|https://lists.apache.org/thread/yphnmj27dpkpdm548mt7dd0jkbjn3wch]
> More details:
> * In
> nifi-framework-bundle/.../web/security/x509/X509AuthenticationFilter.java, I
> commented out code in attemptAuthentication() so it always returns null and
> that works (of course).
> * I attempted to play with the order of addFilterBefore() in
> nifi-framework-bundle/.../web/security/configuration/WebSecurityConfiguration.java
> to hope that OpenID/SSO would always be
> tested first, without success.
> * I had one machine (an AWS EC2) that OpenID/SSO always worked despite the
> certificate. I do not understand why that happened and of course, I compared
> the conf/ directory to another EC2 which uses the certificate instead to
> authenticate the user and found not significant difference, nothing related
> to this topic. I was using Chrome when this happened and clearing the
> cookies did not change the behavior. Using Edge to access the same machine
> would cause the certificate being used. Very odd behavior which I cannot
> explain.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
