christofe lintermans created NIFI-14183:
-------------------------------------------
Summary: NiFi cluster UI fails to proxy user requests with OIDC
Authentication due to missing node authorization
Key: NIFI-14183
URL: https://issues.apache.org/jira/browse/NIFI-14183
Project: Apache NiFi
Issue Type: Bug
Components: Configuration, Core UI, Docker
Affects Versions: 2.1.0
Reporter: christofe lintermans
The official NiFi Docker image (e.g., {{{}apache/nifi:2.1.0{}}}) does not
provide a way to dynamically configure users with the {{proxy}} policy when
using {{AUTH=oidc, tls,...}} and setting {{{}INITIAL_ADMIN_IDENTITY{}}}.
While I understand that requests to the NiFi UI are proxied by the receiving
node to the cluster coordinator, which replicates the request across all nodes,
configuring dynamic clusters remains a challenge.
To authorize new nodes, I must manually add the Common Name (CN) of each node
to the {{authorizers.xml or }}{{users.xml}} and {{{}authorizations.xml{}}}.
Even when adding the node's CN to {{{}authorizers.xml{}}}, deleting
{{{}{}}}{{{}users.xml{}}} and {{authorizations.xml, restarting nifi nodes }}the
required {{proxy}} policy is missing. This requires additional manual edits to
{{users.xml}} and {{{}authorizations.xml{}}}, which makes the process
impractical for dynamic, scalable environments such as Kubernetes.
*Impact:*
* Prevents automated scaling of NiFi clusters in environments like Kubernetes.
* Requires manual intervention to authorize new nodes, breaking automation
workflows and dynamic scaling capabilities.
*Proposed Solution:*
# Add support for defining node proxy user policies through environment
variables.
# Document best practices for dynamic user and node authorization in the
official Docker image.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
