Kotaro Terada created NIFI-5752:
-----------------------------------
Summary: Load balancing fails with wildcard certs
Key: NIFI-5752
URL: https://issues.apache.org/jira/browse/NIFI-5752
Project: Apache NiFi
Issue Type: Bug
Affects Versions: 1.8.0
Reporter: Kotaro Terada
Load balancing fails when we construct a secure cluster with wildcard certs.
For example, assume that we have a valid wildcard cert for {{*.example.com}}
and a cluster consists of {{nf1.example.com}}, {{nf2.example.com}}, and
{{nf3.example.com}} . We cannot transfer a FlowFile between nodes for load
balancing because of the following authorization error:
{noformat}
2018-10-25 19:05:13,520 WARN [Load Balance Server Thread-2]
o.a.n.c.q.c.s.ClusterLoadBalanceAuthorizer Authorization failed for Client ID's
[*.example.com] to Load Balance data because none of the ID's are known Cluster
Node Identifiers
2018-10-25 19:05:13,521 ERROR [Load Balance Server Thread-2]
o.a.n.c.q.c.s.ConnectionLoadBalanceServer Failed to communicate with Peer
/xxx.xxx.xxx.xxx:xxxxx
org.apache.nifi.controller.queue.clustered.server.NotAuthorizedException:
Client ID's [*.example.com] are not authorized to Load Balance data
at
org.apache.nifi.controller.queue.clustered.server.ClusterLoadBalanceAuthorizer.authorize(ClusterLoadBalanceAuthorizer.java:65)
at
org.apache.nifi.controller.queue.clustered.server.StandardLoadBalanceProtocol.receiveFlowFiles(StandardLoadBalanceProtocol.java:142)
at
org.apache.nifi.controller.queue.clustered.server.ConnectionLoadBalanceServer$CommunicateAction.run(ConnectionLoadBalanceServer.java:176)
at
java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
at java.util.concurrent.FutureTask.run(FutureTask.java:266)
at
java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(ScheduledThreadPoolExecutor.java:180)
at
java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:293)
at
java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
at
java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
at java.lang.Thread.run(Thread.java:748)
{noformat}
This problem occurs because in {{authorize}} method in
{{ClusterLoadBalanceAuthorizer}} class, authorization is tried by just matching
strings.
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
