You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@nifi.apache.org by "exceptionfactory (via GitHub)" <gi...@apache.org> on 2023/03/06 14:22:20 UTC

[GitHub] [nifi] exceptionfactory opened a new pull request, #7013: NIFI-4890 Refactor OIDC with support for Refresh Tokens

exceptionfactory opened a new pull request, #7013:
URL: https://github.com/apache/nifi/pull/7013

   # Summary
   
   [NIFI-4890](https://issues.apache.org/jira/browse/NIFI-4890) Refactors the NiFi OpenID Connect integration using Spring Security 5 with support for extended application sessions using [Refresh Tokens](https://www.rfc-editor.org/rfc/rfc6749#section-1.5).
   
   The new implementation replaces custom REST Resources with Spring Security filters to maintain existing support for the [Authorization Code Grant Flow](https://openid.net/specs/openid-connect-core-1_0.html#CodeFlowSteps). The new implementation also maintains support for [OpenID Connect RP-Initiated Logout 1.0](https://openid.net/specs/openid-connect-rpinitiated-1_0.html) when the OpenID Connect Provider supports ending sessions.
   
   As part of supporting session continuation with Refresh Tokens, the new implementation supports [OAuth 2.0 Token Revocation](https://www.rfc-editor.org/rfc/rfc7009). The updated Administrator's Guide documentation describes the Refresh Token handling. As noted in the documentation, application use of Refresh Tokens is conditional on the Authorization Server returning a Refresh Token during authentication. OIDC support follows the same pattern as other authentication strategies when the Authorization Server does not provide a Refresh Token.
   
   The implementation introduces a new property named `nifi.security.user.oidc.token.refresh.window` to control the duration of time between when the application Bearer Token expires and when the application should attempt to renew access using the Refresh Token.
   
   # Tracking
   
   Please complete the following tracking steps prior to pull request creation.
   
   ### Issue Tracking
   
   - [X] [Apache NiFi Jira](https://issues.apache.org/jira/browse/NIFI) issue created
   
   ### Pull Request Tracking
   
   - [X] Pull Request title starts with Apache NiFi Jira issue number, such as `NIFI-00000`
   - [X] Pull Request commit message starts with Apache NiFi Jira issue number, as such `NIFI-00000`
   
   ### Pull Request Formatting
   
   - [X] Pull Request based on current revision of the `main` branch
   - [X] Pull Request refers to a feature branch with one commit containing changes
   
   # Verification
   
   Please indicate the verification steps performed prior to pull request creation.
   
   ### Build
   
   - [X] Build completed using `mvn clean install -P contrib-check`
     - [X] JDK 11
     - [X] JDK 17
   
   ### Licensing
   
   - [ ] New dependencies are compatible with the [Apache License 2.0](https://apache.org/licenses/LICENSE-2.0) according to the [License Policy](https://www.apache.org/legal/resolved.html)
   - [ ] New dependencies are documented in applicable `LICENSE` and `NOTICE` files
   
   ### Documentation
   
   - [ ] Documentation formatting appears as expected in rendered files
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@nifi.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

[GitHub] [nifi] exceptionfactory commented on pull request #7013: NIFI-4890 Refactor OIDC with support for Refresh Tokens

Posted by "exceptionfactory (via GitHub)" <gi...@apache.org>.
exceptionfactory commented on PR #7013:
URL: https://github.com/apache/nifi/pull/7013#issuecomment-1485828462

   Thanks for the feedback and testing @mtien-apache and @mcgilman! I pushed one more update correcting some spelling and naming issues. 


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@nifi.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

[GitHub] [nifi] mcgilman merged pull request #7013: NIFI-4890 Refactor OIDC with support for Refresh Tokens

Posted by "mcgilman (via GitHub)" <gi...@apache.org>.
mcgilman merged PR #7013:
URL: https://github.com/apache/nifi/pull/7013


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@nifi.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

[GitHub] [nifi] exceptionfactory commented on pull request #7013: NIFI-4890 Refactor OIDC with support for Refresh Tokens

Posted by "exceptionfactory (via GitHub)" <gi...@apache.org>.
exceptionfactory commented on PR #7013:
URL: https://github.com/apache/nifi/pull/7013#issuecomment-1478804044

   Thanks for the testing @emiliosetiadarma!
   
   After some discussion with @mcgilman, I pushed an update to change the source of initial application Bearer Token expiration.
   
   The previous implementation derived the application Bearer Token expiration from the ID Token, but the update changes the approach to derive the expiration from the Access Token. This strategy aligns both initial expiration and refreshed expiration to derive from the Access Token expiration.
   
   Some Identity Providers return the same expiration value for both the ID Token and the Access Token, so the end result will not change for those providers. Changing the source of the application Bearer Token expiration to the Access Token expiration provides a consistent approach, and the updated section of the Administrator's Guide reflects these changes. Some Identity Providers make the Access Token expiration configurable, so this also aligns with expected integration behavior.
   
   I also rebased the pull request from the current main branch.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@nifi.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

[GitHub] [nifi] mcgilman commented on pull request #7013: NIFI-4890 Refactor OIDC with support for Refresh Tokens

Posted by "mcgilman (via GitHub)" <gi...@apache.org>.
mcgilman commented on PR #7013:
URL: https://github.com/apache/nifi/pull/7013#issuecomment-1478228509

   Reviewing...


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@nifi.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

[GitHub] [nifi] greyp9 commented on a diff in pull request #7013: NIFI-4890 Refactor OIDC with support for Refresh Tokens

Posted by "greyp9 (via GitHub)" <gi...@apache.org>.
greyp9 commented on code in PR #7013:
URL: https://github.com/apache/nifi/pull/7013#discussion_r1145543210


##########
nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-security/src/main/java/org/apache/nifi/web/security/oidc/client/web/StandardOidcAuthorizedAuthorizedClientRepository.java:
##########
@@ -0,0 +1,276 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.nifi.web.security.oidc.client.web;
+
+import org.apache.nifi.components.state.Scope;
+import org.apache.nifi.components.state.StateManager;
+import org.apache.nifi.components.state.StateMap;
+import org.apache.nifi.web.security.oidc.client.web.converter.AuthorizedClientConverter;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.oauth2.client.OAuth2AuthorizedClient;
+import org.springframework.security.oauth2.client.authentication.OAuth2AuthenticationToken;
+import org.springframework.security.oauth2.client.web.OAuth2AuthorizedClientRepository;
+import org.springframework.security.oauth2.core.OAuth2AccessToken;
+import org.springframework.security.oauth2.core.oidc.OidcIdToken;
+import org.springframework.security.oauth2.core.oidc.user.OidcUser;
+import org.springframework.security.oauth2.core.user.OAuth2User;
+
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import java.io.IOException;
+import java.io.UncheckedIOException;
+import java.time.Instant;
+import java.util.ArrayList;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Objects;
+import java.util.function.Consumer;
+
+/**
+ * OpenID Connect implementation of Authorized Client Repository for storing OAuth2 Tokens
+ */
+public class StandardOidcAuthorizedAuthorizedClientRepository implements OAuth2AuthorizedClientRepository, TrackedAuthorizedClientRepository {
+    private static final Logger logger = LoggerFactory.getLogger(StandardOidcAuthorizedAuthorizedClientRepository.class);
+
+    private static final Scope SCOPE = Scope.LOCAL;
+
+    private final StateManager stateManager;
+
+    private final AuthorizedClientConverter authorizedClientConverter;
+
+    /**
+     * Standard OpenID Connect Authorized Client Repository Constructor
+     *
+     * @param stateManager State Manager for storing authorized clients
+     * @param authorizedClientConverter Authorized Client Converter
+     */
+    public StandardOidcAuthorizedAuthorizedClientRepository(
+            final StateManager stateManager,
+            final AuthorizedClientConverter authorizedClientConverter
+    ) {
+        this.stateManager = Objects.requireNonNull(stateManager, "State Manager required");
+        this.authorizedClientConverter = Objects.requireNonNull(authorizedClientConverter, "Authorized Client Converter required");
+    }
+
+    /**
+     * Load Authorized Client from State Manager
+     *
+     * @param clientRegistrationId the identifier for the client's registration
+     * @param principal Principal Resource Owner to be loaded
+     * @param request HTTP Servlet Request not used
+     * @return Authorized Client or null when not found
+     * @param <T> Authorized Client Type
+     */
+    @SuppressWarnings("unchecked")
+    @Override
+    public <T extends OAuth2AuthorizedClient> T loadAuthorizedClient(
+            final String clientRegistrationId,
+            final Authentication principal,
+            final HttpServletRequest request
+    ) {
+        final OidcAuthorizedClient authorizedClient;
+
+        final String encoded = findEncoded(principal);
+        final String principalId = getPrincipalId(principal);
+        if (encoded == null) {
+            logger.debug("Identity [{}] OIDC Authorized Client not found", principalId);
+            authorizedClient = null;
+        } else {
+            authorizedClient = authorizedClientConverter.getDecoded(encoded);
+            if (authorizedClient == null) {
+                logger.warn("Identity [{}] Removing OIDC Authorized Client after decoding failed", principalId);
+                removeAuthorizedClient(principal);
+            }
+        }
+
+        return (T) authorizedClient;
+    }
+
+    /**
+     * Save Authorized Client in State Manager
+     *
+     * @param authorizedClient Authorized Client to be saved
+     * @param principal Principal Resource Owner to be saved
+     * @param request HTTP Servlet Request not used
+     * @param response HTTP Servlet Response not used
+     */
+    @Override
+    public void saveAuthorizedClient(
+            final OAuth2AuthorizedClient authorizedClient,
+            final Authentication principal,
+            final HttpServletRequest request,
+            final HttpServletResponse response
+    ) {
+        final OidcAuthorizedClient oidcAuthorizedClient = getOidcAuthorizedClient(authorizedClient, principal);
+        final String encoded = authorizedClientConverter.getEncoded(oidcAuthorizedClient);
+        final String principalId = getPrincipalId(principal);
+        updateState(principalId, stateMap -> stateMap.put(principalId, encoded));
+    }
+
+    /**
+     * Remove Authorized Client from State Manager
+     *
+     * @param clientRegistrationId Client Registration Identifier not used
+     * @param principal Principal Resource Owner to be removed
+     * @param request HTTP Servlet Request not used
+     * @param response HTTP Servlet Response not used
+     */
+    @Override
+    public void removeAuthorizedClient(
+            final String clientRegistrationId,
+            final Authentication principal,
+            final HttpServletRequest request,
+            final HttpServletResponse response
+    ) {
+        removeAuthorizedClient(principal);
+    }
+
+    /**
+     * Delete expired Authorized Clients from the configured Stated Manager

Review Comment:
   State Manager?



##########
nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-security/src/main/java/org/apache/nifi/web/security/oidc/client/web/TrackedAuthorizedClientRepository.java:
##########
@@ -0,0 +1,31 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.nifi.web.security.oidc.client.web;
+
+import java.util.List;
+
+/**
+ * Tracked abstraction for Authorized Client Repository supporting deletion of expired clients
+ */
+public interface TrackedAuthorizedClientRepository {
+    /**
+     * Deleted expired Authorized Clients

Review Comment:
   Delete?



##########
nifi-docs/src/main/asciidoc/administration-guide.adoc:
##########
@@ -326,14 +326,14 @@ The `nifi.login.identity.provider.configuration.file` property specifies the con
 The `nifi.security.user.login.identity.provider` property indicates which of the configured Login Identity Provider should be
 used. The default value of this property is `single-user-provider` supporting authentication with a generated username and password.
 
-During OpenId Connect authentication, NiFi will redirect users to login with the Provider before returning to NiFi. NiFi will then
-call the Provider to obtain the user identity.
+For Single sign-on authentication, NiFi will redirect users to the Identity Provider before returning to NiFi. NiFi will then
+process responses and convert attributes to application token information.
 
 During Apache Knox authentication, NiFi will redirect users to login with Apache Knox before returning to NiFi. NiFi will verify the Apache Knox
 token during authentication.
 
-NOTE: NiFi can only be configured for username/password, OpenId Connect, or Apache Knox at a given time. It does not support running each of
-these concurrently. NiFi will require client certificates for authenticating users over HTTPS if none of these are configured.
+NOTE: NiFi cannot be configured for multiple authentication strategies simultaneously.

Review Comment:
   Wording is much clearer!



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@nifi.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

[GitHub] [nifi] mtien-apache commented on a diff in pull request #7013: NIFI-4890 Refactor OIDC with support for Refresh Tokens

Posted by "mtien-apache (via GitHub)" <gi...@apache.org>.
mtien-apache commented on code in PR #7013:
URL: https://github.com/apache/nifi/pull/7013#discussion_r1147898961


##########
nifi-docs/src/main/asciidoc/administration-guide.adoc:
##########
@@ -490,31 +490,81 @@ See also <<kerberos_service>> to allow single sign-on access via client Kerberos
 NOTE: For changes to _nifi.properties_ and _login-identity-providers.xml_ to take effect, NiFi needs to be restarted. If NiFi is clustered, configuration files must be the same on all nodes.
 
 [[openid_connect]]
-=== OpenId Connect
-
-To enable authentication via OpenId Connect the following properties must be configured in _nifi.properties_.
+=== OpenID Connect
+
+OpenID Connect integration provides single sign-on using a specified Authorization Server.
+The implementation supports the Authorization Code Grant Type as described in
+link:https://www.rfc-editor.org/rfc/rfc6749#section-4.1[RFC 6749 Section 4.1^] and
+link:https://openid.net/specs/openid-connect-core-1_0.html#CodeFlowSteps[OpenID Connect Core Section 3.1.1^].
+
+After successful authentication with the Authorization Server, NiFi generates an application Bearer Token with an
+expiration based on the OAuth2 Access Token expiration. NiFi stores authorized tokens using the local State
+Provider and encrypts serialized information using the application Sensitive Properties Key.
+
+The implementation enables
+link:https://openid.net/specs/openid-connect-rpinitiated-1_0.html[OpenID Connect RP-Initiated Logout 1.0^] when the
+Authorization Server includes an `end_session_endpoint` element in the OpenID Discovery configuration.
+
+OpenID Connect integration supports using Refresh Tokens as described in
+link:https://openid.net/specs/openid-connect-core-1_0.html#RefreshTokens[OpenID Connect Core Section 12].
+NiFi tracks the expiration of the application Bearer Token and uses the stored Refresh Token to renew
+access prior to Bearer Token expiration, based on the configured token refresh window. NiFi does not require OpenID
+Connect Providers to support Refresh Tokens. When an OpenID Connect Provider does not return a Refresh Token, NiFi
+requires the user to initiate a new session when the application Bearer Token expires.
+
+The Refresh Token implementation allows the NiFi session to continue as long as the Refresh Token is valid and the
+user agent presents a valid Bearer Token. The default value for the token refresh window is 60 seconds. For an Access
+Token with an expiration of one hour, NiFi will attempt to renew access using the Refresh Token when receiving an HTTP
+request 59 minutes after authenticating the Access Token. Revoked Refresh Tokens or expired application Bearer Tokens
+result in standard session timeout behavior, requiring the user to initiate a new session.
+
+The OpenID Connect implementation supports OAuth 2.0 Token Revocation as defined in
+link:https://www.rfc-editor.org/rfc/rfc7009[RFC 7009^]. OpenID Connect Discovery configuration must include a
+`revocation_endpoint` element that supports RFC 7009 standards. The application sends revocation requests for Refresh
+Tokens when the authenticated Resource Owner initiates the logout process.
+
+The implementation includes a scheduled process for removing and revoking expired Refresh Tokens when the corresponding
+Access Token has expired, indicating that the Resource Owner has terminated the application session. Scheduled session
+termination occurs when the user closes the browser without initiating the logout process. The scheduled process avoids
+extended storage of Refresh Tokens for users who are no longer interacting with the application.
+
+OpenID Connect integration supports the following settings in _nifi.properties_.
 
 [options="header"]
 |==================================================================================================================================================
-| Property Name | Description
-|`nifi.security.user.oidc.discovery.url` | The discovery URL for the desired OpenId Connect Provider (link:http://openid.net/specs/openid-connect-discovery-1_0.html[http://openid.net/specs/openid-connect-discovery-1_0.html^]).
-|`nifi.security.user.oidc.connect.timeout` | Connect timeout when communicating with the OpenId Connect Provider. The default value is `5 secs`.
-|`nifi.security.user.oidc.read.timeout` | Read timeout when communicating with the OpenId Connect Provider. The default value is `5 secs`.
-|`nifi.security.user.oidc.client.id` | The client id for NiFi after registration with the OpenId Connect Provider.
-|`nifi.security.user.oidc.client.secret` | The client secret for NiFi after registration with the OpenId Connect Provider.
-|`nifi.security.user.oidc.preferred.jwsalgorithm` | The preferred algorithm for validating identity tokens. If this value is blank, it will default to `RS256` which is required to be supported
-by the OpenId Connect Provider according to the specification. If this value is `HS256`, `HS384`, or `HS512`, NiFi will attempt to validate HMAC protected tokens using the specified client secret.
+| Property Name                                             | Description
+|`nifi.security.user.oidc.discovery.url`                    | The link:http://openid.net/specs/openid-connect-discovery-1_0.html[Discovery Configuration URL^] for the OpenID Connect Provider
+|`nifi.security.user.oidc.connect.timeout`                  | Socket Connect timeout when communicating with the OpenID Connect Provider. The default value is `5 secs`
+|`nifi.security.user.oidc.read.timeout`                     | Socket Read timeout when communicating with the OpenID Connect Provider. The default value is `5 secs`
+|`nifi.security.user.oidc.client.id`                        | The Client ID for NiFi registered with the OpenID Connect Provider
+|`nifi.security.user.oidc.client.secret`                    | The Client Secret for NiFi registered with the OpenID Connect Provider
+|`nifi.security.user.oidc.preferred.jwsalgorithm`           | The preferred algorithm for validating identity tokens. If this value is blank, it will default to `RS256` which is required to be supported
+by the OpenID Connect Provider according to the specification. If this value is `HS256`, `HS384`, or `HS512`, NiFi will attempt to validate HMAC protected tokens using the specified client secret.
 If this value is `none`, NiFi will attempt to validate unsecured/plain tokens. Other values for this algorithm will attempt to parse as an RSA or EC algorithm to be used in conjunction with the
-JSON Web Key (JWK) provided through the jwks_uri in the metadata found at the discovery URL.
-|`nifi.security.user.oidc.additional.scopes` | Comma separated scopes that are sent to OpenId Connect Provider in addition to `openid` and `email`.
-|`nifi.security.user.oidc.claim.identifying.user` | Claim that identifies the user to be logged in; default is `email`. May need to be requested via the `nifi.security.user.oidc.additional.scopes` before usage.
-|`nifi.security.user.oidc.fallback.claims.identifying.user` | Comma separated possible fallback claims used to identify the user in case `nifi.security.user.oidc.claim.identifying.user` claim is not present for the login user.
-|`nifi.security.user.oidc.claim.groups` | Name of the ID token claim that contains an array of group names of which the
+JSON Web Key (JWK) provided through the jwks_uri in the metadata found at the discovery URL
+|`nifi.security.user.oidc.additional.scopes`                | Comma separated scopes that are sent to OpenID Connect Provider in addition to `openid` and `email`
+|`nifi.security.user.oidc.claim.identifying.user`           | Claim that identifies the authenticated user. The default value is `email`. Claim names may need to be requested using the `nifi.security.user.oidc.additional.scopes` property
+|`nifi.security.user.oidc.fallback.claims.identifying.user` | Comma-separated list of possible fallback claims used to identify the user when the `nifi.security.user.oidc.claim.identifying.user` claim is not found.
+|`nifi.security.user.oidc.claim.groups`                     | Name of the ID token claim that contains an array of group names of which the
 user is a member. Application groups must be supplied from a User Group Provider with matching names in order for the
 authorization process to use ID token claim groups. The default value is `groups`.
-|`nifi.security.user.oidc.truststore.strategy` | If value is `NIFI`, use the NiFi truststore when connecting to the OIDC service, otherwise if value is `JDK` use Java's default `cacerts` truststore. The default value is `JDK`.
+|`nifi.security.user.oidc.truststore.strategy`              | HTTPS Certificate Trust Store Strategy defines the source of certificate authorities that NiFi uses when communicating with the OpenID Connect Provider.
+The value of `JDK` uses the Java platform default configuration stored in `cacerts` under the Java Home directory.
+The value of `NIFI` enables using the trust store configured in the `nifi.security.truststore` property. The default value is `JDK`
+|`nifi.security.user.oidc.token.refresh.window`             | The Token Refresh Window specifies the amount of time before the NiFi authorization session expires when the application will attempt to renew access using a cached Refresh Token. The default is `60 secs`
 |==================================================================================================================================================
 
+==== OpenID Connect REST Resources
+
+OpenID Connect authentication enables the following REST resources for integration with an OpenID Connect 1.0 Authorization Server:
+
+[options="header"]
+|======================================
+| Resource Path                                  | Description
+| /nifi-api/access/oidc/callback/consumer        | Process OIDC 1.0 Login Authentication Responses from an Authentication Server.
+| /nifi/logout-complete                          | Path for redirect after successful OIDC RP-Initiated Logout 1.0 processing
+|======================================
+

Review Comment:
   Very helpful to have.



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@nifi.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

[GitHub] [nifi] mtien-apache commented on pull request #7013: NIFI-4890 Refactor OIDC with support for Refresh Tokens

Posted by "mtien-apache (via GitHub)" <gi...@apache.org>.
mtien-apache commented on PR #7013:
URL: https://github.com/apache/nifi/pull/7013#issuecomment-1482005667

   Reviewing.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@nifi.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

[GitHub] [nifi] exceptionfactory commented on pull request #7013: NIFI-4890 Refactor OIDC with support for Refresh Tokens

Posted by "exceptionfactory (via GitHub)" <gi...@apache.org>.
exceptionfactory commented on PR #7013:
URL: https://github.com/apache/nifi/pull/7013#issuecomment-1482106518

   > Tested happy path using [1]. Only behavioral difference I noticed was an update to the needed "Sign-out redirect URI" specified in the Okta configuration.
   > 
   > [1] https://exceptionfactory.com/posts/2022/12/21/integrating-apache-nifi-with-okta-oidc-authentication/
   
   Thanks for testing @greyp9. The updated OpenID Connect section of the Administrator's Guide notes the logout destination path, but it is worth calling out the change as a migration guide note when this is ready to go. The updated logout destination removes the relative path elements in favor for declaring the direct `/nifi/logout-complete` path.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@nifi.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org