You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@nifi.apache.org by GitBox <gi...@apache.org> on 2022/11/11 03:10:05 UTC
[GitHub] [nifi] jrittenh opened a new pull request, #6651: NIFI-10799 Add OIDC to Docker images for NiFi and NiFi Registry
jrittenh opened a new pull request, #6651:
URL: https://github.com/apache/nifi/pull/6651
NIFI-10799
<!-- Licensed to the Apache Software Foundation (ASF) under one or more -->
<!-- contributor license agreements. See the NOTICE file distributed with -->
<!-- this work for additional information regarding copyright ownership. -->
<!-- The ASF licenses this file to You under the Apache License, Version 2.0 -->
<!-- (the "License"); you may not use this file except in compliance with -->
<!-- the License. You may obtain a copy of the License at -->
<!-- http://www.apache.org/licenses/LICENSE-2.0 -->
<!-- Unless required by applicable law or agreed to in writing, software -->
<!-- distributed under the License is distributed on an "AS IS" BASIS, -->
<!-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -->
<!-- See the License for the specific language governing permissions and -->
<!-- limitations under the License. -->
# Summary
[NIFI-10799](https://issues.apache.org/jira/browse/NIFI-10799)
# Tracking
Please complete the following tracking steps prior to pull request creation.
### Issue Tracking
- [x] [Apache NiFi Jira](https://issues.apache.org/jira/browse/NIFI) issue created
### Pull Request Tracking
- [x] Pull Request title starts with Apache NiFi Jira issue number, such as `NIFI-00000`
- [x] Pull Request commit message starts with Apache NiFi Jira issue number, as such `NIFI-00000`
### Pull Request Formatting
- [x] Pull Request based on current revision of the `main` branch
- [x] Pull Request refers to a feature branch with one commit containing changes
# Verification
Please indicate the verification steps performed prior to pull request creation.
### Build
- [ ] Build completed using `mvn clean install -P contrib-check`
- [ ] JDK 8
- [ ] JDK 11
- [ ] JDK 17
### Licensing
- [ ] New dependencies are compatible with the [Apache License 2.0](https://apache.org/licenses/LICENSE-2.0) according to the [License Policy](https://www.apache.org/legal/resolved.html)
- [ ] New dependencies are documented in applicable `LICENSE` and `NOTICE` files
### Documentation
- [ ] Documentation formatting appears as expected in rendered files
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@nifi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [nifi] kevdoran commented on pull request #6651: NIFI-10799 Add OIDC to Docker images for NiFi and NiFi Registry
Posted by GitBox <gi...@apache.org>.
kevdoran commented on PR #6651:
URL: https://github.com/apache/nifi/pull/6651#issuecomment-1334746225
Apologies for the delay. I should hopefully be able to look into this soon
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@nifi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [nifi] exceptionfactory closed pull request #6651: NIFI-10799 Add OIDC to Docker images for NiFi and NiFi Registry
Posted by GitBox <gi...@apache.org>.
exceptionfactory closed pull request #6651: NIFI-10799 Add OIDC to Docker images for NiFi and NiFi Registry
URL: https://github.com/apache/nifi/pull/6651
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@nifi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [nifi] kevdoran commented on pull request #6651: NIFI-10799 Add OIDC to Docker images for NiFi and NiFi Registry
Posted by GitBox <gi...@apache.org>.
kevdoran commented on PR #6651:
URL: https://github.com/apache/nifi/pull/6651#issuecomment-1315864592
Thank you for the contribution @jrittenh. Will review
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@nifi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [nifi] exceptionfactory commented on a diff in pull request #6651: NIFI-10799 Add OIDC to Docker images for NiFi and NiFi Registry
Posted by GitBox <gi...@apache.org>.
exceptionfactory commented on code in PR #6651:
URL: https://github.com/apache/nifi/pull/6651#discussion_r1052566235
##########
nifi-registry/nifi-registry-docker-maven/dockermaven/sh/update_oidc_properties.sh:
##########
@@ -0,0 +1,27 @@
+#!/bin/sh -e
+
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+prop_replace 'nifi.security.user.oidc.discovery.url' "${NIFI_SECURITY_USER_OIDC_DISCOVERY_URL}"
Review Comment:
```suggestion
prop_replace 'nifi.registry.security.user.oidc.discovery.url' "${NIFI_REGISTRY_SECURITY_USER_OIDC_DISCOVERY_URL}"
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@nifi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [nifi] arun-prakash-fokus commented on pull request #6651: NIFI-10799 Add OIDC to Docker images for NiFi and NiFi Registry
Posted by GitBox <gi...@apache.org>.
arun-prakash-fokus commented on PR #6651:
URL: https://github.com/apache/nifi/pull/6651#issuecomment-1350855023
Please correct me if I am wrong, but as of v1.19.1 (of `nifi` and `nifi-registry`), the correct properties for OIDC as written in the `nifi.properties` and `nifi-registry.properties` are slightly different:
`nifi.properties`
```yml
# OpenId Connect SSO Properties #
nifi.security.user.oidc.discovery.url=
nifi.security.user.oidc.connect.timeout=5 secs
nifi.security.user.oidc.read.timeout=5 secs
nifi.security.user.oidc.client.id=
nifi.security.user.oidc.client.secret=
nifi.security.user.oidc.preferred.jwsalgorithm=
nifi.security.user.oidc.additional.scopes=
nifi.security.user.oidc.claim.identifying.user=
nifi.security.user.oidc.fallback.claims.identifying.user=
nifi.security.user.oidc.truststore.strategy=JDK
```
`nifi-registry.properties`
```yml
# OIDC #
nifi.registry.security.user.oidc.discovery.url=
nifi.registry.security.user.oidc.connect.timeout=
nifi.registry.security.user.oidc.read.timeout=
nifi.registry.security.user.oidc.client.id=
nifi.registry.security.user.oidc.client.secret=
nifi.registry.security.user.oidc.preferred.jwsalgorithm=
```
notice the difference - in `nifi.properties`, the properties are prefixed: `nifi.security.user.oidc.*`while in `nifi-registry.properties`, they are prefixed with `nifi.registry.security.user.oidc`.
However, in your files you changed
for `nifi` - [nifi-docker/dockerhub/sh/update_oidc_properties.sh](https://github.com/apache/nifi/pull/6651/files#diff-7150c03e6a81253db81e02cea689d43e5b1e83a1e3f63d467fb3938416068e4e), and
for `nifi-registry` - [nifi-registry/nifi-registry-core/nifi-registry-docker/dockerhub/sh/update_oidc_properties.sh](https://github.com/apache/nifi/pull/6651/files#diff-9fb32da6796428de41a2276e3e46be7eb23caeeac4e4546a1dd91cf9525a6a13)
the props that you intend to change are identical. This would likely fail.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@nifi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [nifi] kevdoran commented on pull request #6651: NIFI-10799 Add OIDC to Docker images for NiFi and NiFi Registry
Posted by GitBox <gi...@apache.org>.
kevdoran commented on PR #6651:
URL: https://github.com/apache/nifi/pull/6651#issuecomment-1382191556
Thanks for the contribution @arun-prakash-fokus and thanks for reviewing @exceptionfactory. Definitely a nice improvement.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@nifi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [nifi] arun-prakash-fokus commented on pull request #6651: NIFI-10799 Add OIDC to Docker images for NiFi and NiFi Registry
Posted by GitBox <gi...@apache.org>.
arun-prakash-fokus commented on PR #6651:
URL: https://github.com/apache/nifi/pull/6651#issuecomment-1350965158
Furthermore, I would like to suggest the following naming convention for the `environment` variables keeping in line with the naming conventions of the `TLS` and `LDAP` variables.
`nifi-docker/dockerhub/sh/update_oidc_properties.sh`
```yml
...
prop_replace 'nifi.security.user.oidc.discovery.url' "${OIDC_DISCOVERY_URL:-}"
prop_replace 'nifi.security.user.oidc.connect.timeout' "${OIDC_CONNECT_TIMEOUT:-'5 secs'}"
prop_replace 'nifi.security.user.oidc.read.timeout' "${OIDC_READ_TIMEOUT:-'5 secs'}"
prop_replace 'nifi.security.user.oidc.client.id' "${OIDC_CLIENT_ID:-}"
prop_replace 'nifi.security.user.oidc.client.secret' "${OIDC_CLIENT_SECRET:-}"
prop_replace 'nifi.security.user.oidc.preferred.jwsalgorithm' "${OIDC_PREFERRED_JWSALGORITHM:-}"
prop_replace 'nifi.security.user.oidc.additional.scopes' "${OIDC_ADDITIONAL_SCOPES:-}"
prop_replace 'nifi.security.user.oidc.claim.identifying.user' "${OIDC_CLAIM_IDENTIFYING_USER:-}"
prop_replace 'nifi.security.user.oidc.fallback.claims.identifying.user' "${OIDC_FALLBACK_CLAIMS_IDENTIFYING_USER:-}"
prop_replace 'nifi.security.user.oidc.truststore.strategy' "${OIDC_TRUSTSTORE_STRATEGY:-'JDK'}"
```
`nifi-docker/dockerhub/sh/update_oidc_properties.sh` and `nifi-registry/nifi-registry-docker-maven/dockermaven/sh/update_oidc_properties.sh`
```yml
...
prop_replace 'nifi.registry.security.user.oidc.discovery.url' "${OIDC_DISCOVERY_URL:-}"
prop_replace 'nifi.registry.security.user.oidc.connect.timeout' "${OIDC_CONNECT_TIMEOUT:-5 secs}"
prop_replace 'nifi.registry.security.user.oidc.read.timeout' "${OIDC_READ_TIMEOUT:-5 secs}"
prop_replace 'nifi.registry.security.user.oidc.client.id' "${OIDC_CLIENT_ID:-}"
prop_replace 'nifi.registry.security.user.oidc.client.secret' "${OIDC_CLIENT_SECRET:-}"
prop_replace 'nifi.registry.security.user.oidc.preferred.jwsalgorithm' "${OIDC_PREFERRED_JWSALGORITHM:-JDK}"
```
Thus, for instance, for the `nifi-registry` we would have:
```bash
docker run --name nifi-registry \
-v /path/to/tls/certs/localhost:/opt/certs \
-p 18443:18443 \
-e AUTH=oidc \
-e KEYSTORE_PATH=/opt/certs/keystore.jks \
-e KEYSTORE_TYPE=JKS \
-e KEYSTORE_PASSWORD=QKZv1hSWAFQYZ+WU1jjF5ank+l4igeOfQRp+OSbkkrs \
-e TRUSTSTORE_PATH=/opt/certs/truststore.jks \
-e TRUSTSTORE_PASSWORD=rHkWR1gDNW3R9hgbeRsT3OM3Ue0zwGtQqcFKJD2EXWE \
-e TRUSTSTORE_TYPE=JKS \
-e INITIAL_ADMIN_IDENTITY='registry-admin@gitlab.com' \
-e OIDC_DISCOVERY_URL=https://www.gitlab.com/.well-known/openid-configuration \
-e OIDC_CLIENT_ID=436cf9c691e9fb924b7b722b59a067d84fad802fa78804381b6be3d5bff44ae2 \
-e OIDC_CLIENT_SECRET=436cf9c661e9fb924a7b722b59a067d84fad802fa78804381b6be3d5bff44ae2 \
-d \
apache/nifi-registry:latest
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@nifi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org