[jira] [Commented] (NIFI-14183) NiFi cluster UI fails to proxy user requests with OIDC Authentication due to missing node authorization

["David Handermann (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/NIFI-14183?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17915788#comment-17915788 ] 

David Handermann commented on NIFI-14183:
-----------------------------------------

Thanks for summarizing the use case and current issues [~lintermans].

As you noted, the core issue revolves around the static nature of the Authorizer implementation and associated files.

One option to consider is the LDAP Authorizer, but that is less than ideal for dynamic scaling.

A different approach in a new Authorizer, supporting dynamic reloading, is probably required.

> NiFi cluster UI fails to proxy user requests with OIDC Authentication due to missing node authorization
> -------------------------------------------------------------------------------------------------------
>
>                 Key: NIFI-14183
>                 URL: https://issues.apache.org/jira/browse/NIFI-14183
>             Project: Apache NiFi
>          Issue Type: Improvement
>          Components: Configuration, Core UI, Docker
>    Affects Versions: 2.1.0
>            Reporter: christofe lintermans
>            Priority: Major
>
> The official NiFi Docker image (e.g., {{{}apache/nifi:2.1.0{}}}) does not provide a way to dynamically configure users with the {{proxy}} policy when using {{AUTH=oidc, tls,...}} and setting {{{}INITIAL_ADMIN_IDENTITY{}}}.
> While I understand that requests to the NiFi UI are proxied by the receiving node to the cluster coordinator, which replicates the request across all nodes, configuring dynamic clusters remains a challenge.
> To authorize new nodes, I must manually add the Common Name (CN) of each node to the {{authorizers.xml or }}{{users.xml}} and {{{}authorizations.xml{}}}. Even when adding the node's CN to {{{}authorizers.xml{}}}, deleting {{{}{}}}{{{}users.xml{}}} and {{authorizations.xml, restarting nifi nodes }}the required {{proxy}} policy is missing. This requires additional manual edits to {{users.xml}} and {{{}authorizations.xml{}}}, which makes the process impractical for dynamic, scalable environments such as Kubernetes.
> *Impact:*
>  * Prevents automated scaling of NiFi clusters in environments like Kubernetes.
>  * Requires manual intervention to authorize new nodes, breaking automation workflows and dynamic scaling capabilities.
> *Proposed Solution:*
>  # Add support for defining node proxy user policies through environment variables.
>  # Document best practices for dynamic user and node authorization in the official Docker image.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)