alopresto commented on issue #3362: NIFI-6085 - Added /access/logout endpoint to allow JWT auth tokens toβ¦ URL: https://github.com/apache/nifi/pull/3362#issuecomment-490320877 I tested this with a standalone instance secured using TLS Toolkit and a local LDAP server. I first verified the existing behavior (the bearer token is still valid for a curl request after the user logs out via the UI), then built with the PR and verified the expected behavior (the bearer token is no longer valid for a curl request after the user logs out via the UI). (Full steps to configure an LDAP server and connect via NiFi available on [Pierre's blog](https://pierrevillard.com/2017/01/24/integration-of-nifi-with-ldap/); I use [`dnsmasq`](https://www.stevenrombauts.be/2018/01/use-dnsmasq-instead-of-etc-hosts/) for local hostname mapping [e.g. `https://andy.nifi:9443/nifi -> https://localhost:9443/nifi`].) Selected command output: ### Existing behavior ### Before UI logout (token should be valid) ``` ~W/scratch/ldap (master) π π 0s @ 18:57:14 $ curl -v --cacert /Users/alopresto/Workspace/nifi/nifi-assembly/target/nifi-1.10.0-SNAPSHOT-bin/nifi-1.10.0-SNAPSHOT/conf/nifi-cert.pem -H "Authorization: Bearer eyJhbGci...QHIXNNaY" https://andy.nifi:9443/nifi-api/flow/status * Trying 127.0.0.1... * TCP_NODELAY set * Connected to andy.nifi (127.0.0.1) port 9443 (#0) * ALPN, offering h2 * ALPN, offering http/1.1 * Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH * successfully set certificate verify locations: * CAfile: /Users/alopresto/Workspace/nifi/nifi-assembly/target/nifi-1.10.0-SNAPSHOT-bin/nifi-1.10.0-SNAPSHOT/conf/nifi-cert.pem CApath: none ... * Server certificate: * subject: OU=NIFI; CN=andy.nifi * start date: May 8 01:42:09 2019 GMT * expire date: May 7 01:42:09 2022 GMT * subjectAltName: host "andy.nifi" matched cert's "andy.nifi" * issuer: OU=NIFI; CN=localhost * SSL certificate verify ok. > GET /nifi-api/flow/status HTTP/1.1 > Host: andy.nifi:9443 > User-Agent: curl/7.54.0 > Accept: */* > Authorization: Bearer eyJhbGci...QHIXNNaY > < HTTP/1.1 200 OK ... < Content-Length: 364 < Server: Jetty(9.4.11.v20180605) < * Connection #0 to host andy.nifi left intact {"controllerStatus":{"activeThreadCount":0,"terminatedThreadCount":0,"queued":"0 / 0 bytes","flowFilesQueued":0,"bytesQueued":0,"runningCount":0,"stoppedCount":0,"invalidCount":0,"disabledCount":0,"activeRemotePortCount":0,"inactiveRemotePortCount":0,"upToDateCount":0,"locallyModifiedCount":0,"staleCount":0,"locallyModifiedAndStaleCount":0,"syncFailureCount":0}} ``` #### After UI logout (token should not be valid) ``` ~W/scratch/ldap (master) π π 0s @ 18:58:17 $ curl -v --cacert /Users/alopresto/Workspace/nifi/nifi-assembly/target/nifi-1.10.0-SNAPSHOT-bin/nifi-1.10.0-SNAPSHOT/conf/nifi-cert.pem -H "Authorization: Bearer eyJhbGci...QHIXNNaY" https://andy.nifi:9443/nifi-api/flow/status * Trying 127.0.0.1... * TCP_NODELAY set * Connected to andy.nifi (127.0.0.1) port 9443 (#0) * ALPN, offering h2 * ALPN, offering http/1.1 * Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH * successfully set certificate verify locations: * CAfile: /Users/alopresto/Workspace/nifi/nifi-assembly/target/nifi-1.10.0-SNAPSHOT-bin/nifi-1.10.0-SNAPSHOT/conf/nifi-cert.pem CApath: none ... * Server certificate: * subject: OU=NIFI; CN=andy.nifi * start date: May 8 01:42:09 2019 GMT * expire date: May 7 01:42:09 2022 GMT * subjectAltName: host "andy.nifi" matched cert's "andy.nifi" * issuer: OU=NIFI; CN=localhost * SSL certificate verify ok. > GET /nifi-api/flow/status HTTP/1.1 > Host: andy.nifi:9443 > User-Agent: curl/7.54.0 > Accept: */* > Authorization: Bearer eyJhbGci...QHIXNNaY > < HTTP/1.1 200 OK ... < Content-Length: 364 < Server: Jetty(9.4.11.v20180605) < * Connection #0 to host andy.nifi left intact {"controllerStatus":{"activeThreadCount":0,"terminatedThreadCount":0,"queued":"0 / 0 bytes","flowFilesQueued":0,"bytesQueued":0,"runningCount":0,"stoppedCount":0,"invalidCount":0,"disabledCount":0,"activeRemotePortCount":0,"inactiveRemotePortCount":0,"upToDateCount":0,"locallyModifiedCount":0,"staleCount":0,"locallyModifiedAndStaleCount":0,"syncFailureCount":0}} ``` ### Expected behavior (after applying PR) #### Before UI logout (token should be valid) ``` ~W/scratch/ldap (master) π π 0s @ 19:07:52 $ curl -v --cacert /Users/alopresto/Workspace/nifi/nifi-assembly/target/nifi-1.10.0-SNAPSHOT-bin/nifi-1.10.0-SNAPSHOT/conf/nifi-cert.pem -H "Authorization: Bearer eyJhbGci...utn2MCGAs" https://andy.nifi:9443/nifi-api/flow/status * Trying 127.0.0.1... * TCP_NODELAY set * Connected to andy.nifi (127.0.0.1) port 9443 (#0) * ALPN, offering h2 * ALPN, offering http/1.1 * Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH * successfully set certificate verify locations: * CAfile: /Users/alopresto/Workspace/nifi/nifi-assembly/target/nifi-1.10.0-SNAPSHOT-bin/nifi-1.10.0-SNAPSHOT/conf/nifi-cert.pem CApath: none ... * Server certificate: * subject: OU=NIFI; CN=andy.nifi * start date: May 8 01:42:09 2019 GMT * expire date: May 7 01:42:09 2022 GMT * subjectAltName: host "andy.nifi" matched cert's "andy.nifi" * issuer: OU=NIFI; CN=localhost * SSL certificate verify ok. > GET /nifi-api/flow/status HTTP/1.1 > Host: andy.nifi:9443 > User-Agent: curl/7.54.0 > Accept: */* > Authorization: Bearer eyJhbGci...utn2MCGAs > < HTTP/1.1 200 OK ... < Content-Length: 364 < Server: Jetty(9.4.11.v20180605) < * Connection #0 to host andy.nifi left intact {"controllerStatus":{"activeThreadCount":0,"terminatedThreadCount":0,"queued":"0 / 0 bytes","flowFilesQueued":0,"bytesQueued":0,"runningCount":0,"stoppedCount":0,"invalidCount":0,"disabledCount":0,"activeRemotePortCount":0,"inactiveRemotePortCount":0,"upToDateCount":0,"locallyModifiedCount":0,"staleCount":0,"locallyModifiedAndStaleCount":0,"syncFailureCount":0}} ``` #### After UI logout (token should not be valid) ``` ~W/scratch/ldap (master) π π 0s @ 19:08:00 $ curl -v --cacert /Users/alopresto/Workspace/nifi/nifi-assembly/target/nifi-1.10.0-SNAPSHOT-bin/nifi-1.10.0-SNAPSHOT/conf/nifi-cert.pem -H "Authorization: Bearer eyJhbGci...utn2MCGAs" https://andy.nifi:9443/nifi-api/flow/status * Trying 127.0.0.1... * TCP_NODELAY set * Connected to andy.nifi (127.0.0.1) port 9443 (#0) * ALPN, offering h2 * ALPN, offering http/1.1 * Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH * successfully set certificate verify locations: * CAfile: /Users/alopresto/Workspace/nifi/nifi-assembly/target/nifi-1.10.0-SNAPSHOT-bin/nifi-1.10.0-SNAPSHOT/conf/nifi-cert.pem CApath: none ... * Server certificate: * subject: OU=NIFI; CN=andy.nifi * start date: May 8 01:42:09 2019 GMT * expire date: May 7 01:42:09 2022 GMT * subjectAltName: host "andy.nifi" matched cert's "andy.nifi" * issuer: OU=NIFI; CN=localhost * SSL certificate verify ok. > GET /nifi-api/flow/status HTTP/1.1 > Host: andy.nifi:9443 > User-Agent: curl/7.54.0 > Accept: */* > Authorization: Bearer eyJhbGci...utn2MCGAs > < HTTP/1.1 401 Unauthorized ... < Content-Length: 37 < Server: Jetty(9.4.11.v20180605) < Unable to validate the access token. * Connection #0 to host andy.nifi left intact ```
---------------------------------------------------------------- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: [email protected] With regards, Apache Git Services
