You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@nifi.apache.org by ex...@apache.org on 2023/03/15 20:37:55 UTC
[nifi] branch main updated: NIFI-11252 Added OIDC Client Secret to sensitive Registry properties
This is an automated email from the ASF dual-hosted git repository.
exceptionfactory pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/nifi.git
The following commit(s) were added to refs/heads/main by this push:
new dfc031f0da NIFI-11252 Added OIDC Client Secret to sensitive Registry properties
dfc031f0da is described below
commit dfc031f0da5898d4c5c552fc0ba2b5af6583b458
Author: Ryan Van Den Bos <ry...@naimuri.com>
AuthorDate: Tue Mar 14 22:36:07 2023 +0000
NIFI-11252 Added OIDC Client Secret to sensitive Registry properties
This closes #7044
Signed-off-by: David Handermann <ex...@apache.org>
---
.../registry/properties/ProtectedNiFiRegistryProperties.java | 3 ++-
.../properties/NiFiRegistryPropertiesLoaderGroovyTest.groovy | 2 ++
.../ProtectedNiFiRegistryPropertiesGroovyTest.groovy | 10 ++++++++--
.../src/test/resources/conf/nifi-registry.properties | 8 ++++++++
.../nifi-registry.with_additional_sensitive_keys.properties | 8 ++++++++
...try.with_sensitive_props_fully_protected_aes_128.properties | 9 +++++++++
...-registry.with_sensitive_props_protected_aes_128.properties | 9 +++++++++
....with_sensitive_props_protected_aes_128_password.properties | 9 +++++++++
...-registry.with_sensitive_props_protected_aes_256.properties | 9 +++++++++
...sensitive_props_protected_aes_multiple_malformed.properties | 9 +++++++++
...h_sensitive_props_protected_aes_single_malformed.properties | 9 +++++++++
...-registry.with_sensitive_props_protected_unknown.properties | 9 +++++++++
.../nifi-registry.with_sensitive_props_unprotected.properties | 8 ++++++++
...stry.with_sensitive_props_unprotected_extra_line.properties | 8 ++++++++
14 files changed, 107 insertions(+), 3 deletions(-)
diff --git a/nifi-registry/nifi-registry-core/nifi-registry-properties-loader/src/main/java/org/apache/nifi/registry/properties/ProtectedNiFiRegistryProperties.java b/nifi-registry/nifi-registry-core/nifi-registry-properties-loader/src/main/java/org/apache/nifi/registry/properties/ProtectedNiFiRegistryProperties.java
index 234e724311..cefcdfc130 100644
--- a/nifi-registry/nifi-registry-core/nifi-registry-properties-loader/src/main/java/org/apache/nifi/registry/properties/ProtectedNiFiRegistryProperties.java
+++ b/nifi-registry/nifi-registry-core/nifi-registry-properties-loader/src/main/java/org/apache/nifi/registry/properties/ProtectedNiFiRegistryProperties.java
@@ -54,7 +54,8 @@ class ProtectedNiFiRegistryProperties extends NiFiRegistryProperties implements
public static final List<String> DEFAULT_SENSITIVE_PROPERTIES = new ArrayList<>(asList(
NiFiRegistryProperties.SECURITY_KEY_PASSWD,
NiFiRegistryProperties.SECURITY_KEYSTORE_PASSWD,
- NiFiRegistryProperties.SECURITY_TRUSTSTORE_PASSWD));
+ NiFiRegistryProperties.SECURITY_TRUSTSTORE_PASSWD,
+ NiFiRegistryProperties.SECURITY_USER_OIDC_CLIENT_SECRET));
public ProtectedNiFiRegistryProperties() {
this(new NiFiRegistryProperties());
diff --git a/nifi-registry/nifi-registry-core/nifi-registry-properties-loader/src/test/java/org/apache/nifi/registry/properties/NiFiRegistryPropertiesLoaderGroovyTest.groovy b/nifi-registry/nifi-registry-core/nifi-registry-properties-loader/src/test/java/org/apache/nifi/registry/properties/NiFiRegistryPropertiesLoaderGroovyTest.groovy
index 5fe7eed017..bd2ef75633 100644
--- a/nifi-registry/nifi-registry-core/nifi-registry-properties-loader/src/test/java/org/apache/nifi/registry/properties/NiFiRegistryPropertiesLoaderGroovyTest.groovy
+++ b/nifi-registry/nifi-registry-core/nifi-registry-properties-loader/src/test/java/org/apache/nifi/registry/properties/NiFiRegistryPropertiesLoaderGroovyTest.groovy
@@ -37,6 +37,7 @@ class NiFiRegistryPropertiesLoaderGroovyTest extends GroovyTestCase {
private static final String KEYSTORE_PASSWORD_KEY = NiFiRegistryProperties.SECURITY_KEYSTORE_PASSWD
private static final String KEY_PASSWORD_KEY = NiFiRegistryProperties.SECURITY_KEY_PASSWD
private static final String TRUSTSTORE_PASSWORD_KEY = NiFiRegistryProperties.SECURITY_TRUSTSTORE_PASSWD
+ private static final String OIDC_CLIENT_SECRET = NiFiRegistryProperties.SECURITY_USER_OIDC_CLIENT_SECRET
private static final String KEY_HEX_128 = "0123456789ABCDEFFEDCBA9876543210"
private static final String KEY_HEX_256 = KEY_HEX_128 * 2
@@ -170,6 +171,7 @@ class NiFiRegistryPropertiesLoaderGroovyTest extends GroovyTestCase {
final def EXPECTED_PLAIN_VALUES = [
(KEYSTORE_PASSWORD_KEY): "thisIsABadPassword",
(KEY_PASSWORD_KEY): "thisIsABadPassword",
+ (OIDC_CLIENT_SECRET): "thisIsABadPassword",
]
// This method is covered in tests above, so safe to use here to retrieve protected properties
diff --git a/nifi-registry/nifi-registry-core/nifi-registry-properties-loader/src/test/java/org/apache/nifi/registry/properties/ProtectedNiFiRegistryPropertiesGroovyTest.groovy b/nifi-registry/nifi-registry-core/nifi-registry-properties-loader/src/test/java/org/apache/nifi/registry/properties/ProtectedNiFiRegistryPropertiesGroovyTest.groovy
index 18869d53e4..f6b44e8eb4 100644
--- a/nifi-registry/nifi-registry-core/nifi-registry-properties-loader/src/test/java/org/apache/nifi/registry/properties/ProtectedNiFiRegistryPropertiesGroovyTest.groovy
+++ b/nifi-registry/nifi-registry-core/nifi-registry-properties-loader/src/test/java/org/apache/nifi/registry/properties/ProtectedNiFiRegistryPropertiesGroovyTest.groovy
@@ -32,11 +32,13 @@ class ProtectedNiFiRegistryPropertiesGroovyTest extends GroovyTestCase {
private static final String KEYSTORE_PASSWORD_KEY = NiFiRegistryProperties.SECURITY_KEYSTORE_PASSWD
private static final String KEY_PASSWORD_KEY = NiFiRegistryProperties.SECURITY_KEY_PASSWD
private static final String TRUSTSTORE_PASSWORD_KEY = NiFiRegistryProperties.SECURITY_TRUSTSTORE_PASSWD
+ private static final String OIDC_CLIENT_SECRET = NiFiRegistryProperties.SECURITY_USER_OIDC_CLIENT_SECRET
private static final def DEFAULT_SENSITIVE_PROPERTIES = [
KEYSTORE_PASSWORD_KEY,
KEY_PASSWORD_KEY,
- TRUSTSTORE_PASSWORD_KEY
+ TRUSTSTORE_PASSWORD_KEY,
+ OIDC_CLIENT_SECRET
]
private static final String KEY_HEX_128 = "0123456789ABCDEFFEDCBA9876543210"
@@ -302,7 +304,7 @@ class ProtectedNiFiRegistryPropertiesGroovyTest extends GroovyTestCase {
loadFromResourceFile("/conf/nifi-registry.with_sensitive_props_protected_aes_128.properties", KEY_HEX_128)
double percentProtected = getPercentOfSensitivePropertiesProtected(properties)
- assert percentProtected == 67.0D
+ assert percentProtected == 75.0D
}
@Test
@@ -400,6 +402,10 @@ class ProtectedNiFiRegistryPropertiesGroovyTest extends GroovyTestCase {
!unprotectedNiFiProperties.getProperty(it).endsWith(ApplicationPropertiesProtector.PROTECTED_KEY_SUFFIX)
}
assert unprotectedNiFiProperties.hashCode() != hashCode
+
+ assert unprotectedNiFiProperties.getProperty(OIDC_CLIENT_SECRET) == "thisIsABadOidcSecret"
+ assert unprotectedNiFiProperties.getProperty(KEY_PASSWORD_KEY) == "thisIsABadKeyPassword"
+ assert unprotectedNiFiProperties.getProperty(KEYSTORE_PASSWORD_KEY) == "thisIsABadKeystorePassword"
}
@Test
diff --git a/nifi-registry/nifi-registry-core/nifi-registry-properties-loader/src/test/resources/conf/nifi-registry.properties b/nifi-registry/nifi-registry-core/nifi-registry-properties-loader/src/test/resources/conf/nifi-registry.properties
index a7efedbeed..6b5ab0cbb8 100644
--- a/nifi-registry/nifi-registry-core/nifi-registry-properties-loader/src/test/resources/conf/nifi-registry.properties
+++ b/nifi-registry/nifi-registry-core/nifi-registry-properties-loader/src/test/resources/conf/nifi-registry.properties
@@ -38,6 +38,14 @@ nifi.registry.security.authorizer=
nifi.registry.security.identity.providers.configuration.file=
nifi.registry.security.identity.provider=
+# OpenId Connect SSO Properties #
+nifi.registry.security.user.oidc.discovery.url=
+nifi.registry.security.user.oidc.connect.timeout=
+nifi.registry.security.user.oidc.read.timeout=
+nifi.registry.security.user.oidc.client.id=
+nifi.registry.security.user.oidc.client.secret=
+nifi.registry.security.user.oidc.preferred.jwsalgorithm=
+
# kerberos properties
nifi.registry.kerberos.krb5.file=/path/to/krb5.conf
nifi.registry.kerberos.spnego.authentication.expiration=12 hours
diff --git a/nifi-registry/nifi-registry-core/nifi-registry-properties-loader/src/test/resources/conf/nifi-registry.with_additional_sensitive_keys.properties b/nifi-registry/nifi-registry-core/nifi-registry-properties-loader/src/test/resources/conf/nifi-registry.with_additional_sensitive_keys.properties
index 5afb3dd234..150dc68ef8 100644
--- a/nifi-registry/nifi-registry-core/nifi-registry-properties-loader/src/test/resources/conf/nifi-registry.with_additional_sensitive_keys.properties
+++ b/nifi-registry/nifi-registry-core/nifi-registry-properties-loader/src/test/resources/conf/nifi-registry.with_additional_sensitive_keys.properties
@@ -38,6 +38,14 @@ nifi.registry.security.authorizer=
nifi.registry.security.identity.providers.configuration.file=
nifi.registry.security.identity.provider=
+# OpenId Connect SSO Properties #
+nifi.registry.security.user.oidc.discovery.url=
+nifi.registry.security.user.oidc.connect.timeout=
+nifi.registry.security.user.oidc.read.timeout=
+nifi.registry.security.user.oidc.client.id=
+nifi.registry.security.user.oidc.client.secret=
+nifi.registry.security.user.oidc.preferred.jwsalgorithm=
+
# providers properties #
nifi.registry.providers.configuration.file=
diff --git a/nifi-registry/nifi-registry-core/nifi-registry-properties-loader/src/test/resources/conf/nifi-registry.with_sensitive_props_fully_protected_aes_128.properties b/nifi-registry/nifi-registry-core/nifi-registry-properties-loader/src/test/resources/conf/nifi-registry.with_sensitive_props_fully_protected_aes_128.properties
index 90eb64fc40..be9da3d927 100644
--- a/nifi-registry/nifi-registry-core/nifi-registry-properties-loader/src/test/resources/conf/nifi-registry.with_sensitive_props_fully_protected_aes_128.properties
+++ b/nifi-registry/nifi-registry-core/nifi-registry-properties-loader/src/test/resources/conf/nifi-registry.with_sensitive_props_fully_protected_aes_128.properties
@@ -40,4 +40,13 @@ nifi.registry.security.authorizer=
nifi.registry.security.identity.providers.configuration.file=
nifi.registry.security.identity.provider=
+# OpenId Connect SSO Properties #
+nifi.registry.security.user.oidc.discovery.url=
+nifi.registry.security.user.oidc.connect.timeout=
+nifi.registry.security.user.oidc.read.timeout=
+nifi.registry.security.user.oidc.client.id=
+nifi.registry.security.user.oidc.client.secret=6WUpex+VZiN05LXu||joWJMuoSzYniEC7IAoingTimlG7+RGk8I2irl/WTlIuMcg
+nifi.registry.security.user.oidc.client.secret.protected=aes/gcm/128
+nifi.registry.security.user.oidc.preferred.jwsalgorithm=
+
nifi.registry.sensitive.props.additional.keys=
diff --git a/nifi-registry/nifi-registry-core/nifi-registry-properties-loader/src/test/resources/conf/nifi-registry.with_sensitive_props_protected_aes_128.properties b/nifi-registry/nifi-registry-core/nifi-registry-properties-loader/src/test/resources/conf/nifi-registry.with_sensitive_props_protected_aes_128.properties
index 6ecd281922..951a08af04 100644
--- a/nifi-registry/nifi-registry-core/nifi-registry-properties-loader/src/test/resources/conf/nifi-registry.with_sensitive_props_protected_aes_128.properties
+++ b/nifi-registry/nifi-registry-core/nifi-registry-properties-loader/src/test/resources/conf/nifi-registry.with_sensitive_props_protected_aes_128.properties
@@ -40,4 +40,13 @@ nifi.registry.security.authorizer=
nifi.registry.security.identity.providers.configuration.file=
nifi.registry.security.identity.provider=
+# OpenId Connect SSO Properties #
+nifi.registry.security.user.oidc.discovery.url=
+nifi.registry.security.user.oidc.connect.timeout=
+nifi.registry.security.user.oidc.read.timeout=
+nifi.registry.security.user.oidc.client.id=
+nifi.registry.security.user.oidc.client.secret=6WUpex+VZiN05LXu||joWJMuoSzYniEC7IAoingTimlG7+RGk8I2irl/WTlIuMcg
+nifi.registry.security.user.oidc.client.secret.protected=aes/gcm/128
+nifi.registry.security.user.oidc.preferred.jwsalgorithm=
+
nifi.registry.sensitive.props.additional.keys=nifi.registry.web.http.port
diff --git a/nifi-registry/nifi-registry-core/nifi-registry-properties-loader/src/test/resources/conf/nifi-registry.with_sensitive_props_protected_aes_128_password.properties b/nifi-registry/nifi-registry-core/nifi-registry-properties-loader/src/test/resources/conf/nifi-registry.with_sensitive_props_protected_aes_128_password.properties
index a3b272d99c..f3e1a4fe38 100644
--- a/nifi-registry/nifi-registry-core/nifi-registry-properties-loader/src/test/resources/conf/nifi-registry.with_sensitive_props_protected_aes_128_password.properties
+++ b/nifi-registry/nifi-registry-core/nifi-registry-properties-loader/src/test/resources/conf/nifi-registry.with_sensitive_props_protected_aes_128_password.properties
@@ -40,4 +40,13 @@ nifi.registry.security.authorizer=
nifi.registry.security.identity.providers.configuration.file=
nifi.registry.security.identity.provider=
+# OpenId Connect SSO Properties #
+nifi.registry.security.user.oidc.discovery.url=
+nifi.registry.security.user.oidc.connect.timeout=
+nifi.registry.security.user.oidc.read.timeout=
+nifi.registry.security.user.oidc.client.id=
+nifi.registry.security.user.oidc.client.secret=oa6Aaz5tlFprPuKt||IlVgftF2VqvBIambkP5HVDbRoyKzZl8wwKSw4O9tjHTALA
+nifi.registry.security.user.oidc.client.secret.protected=aes/gcm/128
+nifi.registry.security.user.oidc.preferred.jwsalgorithm=
+
nifi.registry.sensitive.props.additional.keys=nifi.registry.web.http.port
diff --git a/nifi-registry/nifi-registry-core/nifi-registry-properties-loader/src/test/resources/conf/nifi-registry.with_sensitive_props_protected_aes_256.properties b/nifi-registry/nifi-registry-core/nifi-registry-properties-loader/src/test/resources/conf/nifi-registry.with_sensitive_props_protected_aes_256.properties
index 97aaba0139..fe096199fd 100644
--- a/nifi-registry/nifi-registry-core/nifi-registry-properties-loader/src/test/resources/conf/nifi-registry.with_sensitive_props_protected_aes_256.properties
+++ b/nifi-registry/nifi-registry-core/nifi-registry-properties-loader/src/test/resources/conf/nifi-registry.with_sensitive_props_protected_aes_256.properties
@@ -40,4 +40,13 @@ nifi.registry.security.authorizer=
nifi.registry.security.identity.providers.configuration.file=
nifi.registry.security.identity.provider=
+# OpenId Connect SSO Properties #
+nifi.registry.security.user.oidc.discovery.url=
+nifi.registry.security.user.oidc.connect.timeout=
+nifi.registry.security.user.oidc.read.timeout=
+nifi.registry.security.user.oidc.client.id=
+nifi.registry.security.user.oidc.client.secret=3EsY6PJqU2xrL4rB||HsLYTYE/UAUsnrOmMG0f7UZdmhSvL2qh4Iix7PDDw31OZpCO
+nifi.registry.security.user.oidc.client.secret.protected=aes/gcm/256
+nifi.registry.security.user.oidc.preferred.jwsalgorithm=
+
nifi.registry.sensitive.props.additional.keys=nifi.registry.web.http.port
diff --git a/nifi-registry/nifi-registry-core/nifi-registry-properties-loader/src/test/resources/conf/nifi-registry.with_sensitive_props_protected_aes_multiple_malformed.properties b/nifi-registry/nifi-registry-core/nifi-registry-properties-loader/src/test/resources/conf/nifi-registry.with_sensitive_props_protected_aes_multiple_malformed.properties
index d408df06b9..ccfd519061 100644
--- a/nifi-registry/nifi-registry-core/nifi-registry-properties-loader/src/test/resources/conf/nifi-registry.with_sensitive_props_protected_aes_multiple_malformed.properties
+++ b/nifi-registry/nifi-registry-core/nifi-registry-properties-loader/src/test/resources/conf/nifi-registry.with_sensitive_props_protected_aes_multiple_malformed.properties
@@ -40,4 +40,13 @@ nifi.registry.security.authorizer=
nifi.registry.security.identity.providers.configuration.file=
nifi.registry.security.identity.provider=
+# OpenId Connect SSO Properties #
+nifi.registry.security.user.oidc.discovery.url=
+nifi.registry.security.user.oidc.connect.timeout=
+nifi.registry.security.user.oidc.read.timeout=
+nifi.registry.security.user.oidc.client.id=
+nifi.registry.security.user.oidc.client.secret=6WUpex+VZiN05LXu||thisIsAnIntentionallyMalformedCipherValue
+nifi.registry.security.user.oidc.client.secret.protected=aes/gcm/256
+nifi.registry.security.user.oidc.preferred.jwsalgorithm=
+
nifi.registry.sensitive.props.additional.keys=
diff --git a/nifi-registry/nifi-registry-core/nifi-registry-properties-loader/src/test/resources/conf/nifi-registry.with_sensitive_props_protected_aes_single_malformed.properties b/nifi-registry/nifi-registry-core/nifi-registry-properties-loader/src/test/resources/conf/nifi-registry.with_sensitive_props_protected_aes_single_malformed.properties
index 8552f9e2a4..1e679a4b30 100644
--- a/nifi-registry/nifi-registry-core/nifi-registry-properties-loader/src/test/resources/conf/nifi-registry.with_sensitive_props_protected_aes_single_malformed.properties
+++ b/nifi-registry/nifi-registry-core/nifi-registry-properties-loader/src/test/resources/conf/nifi-registry.with_sensitive_props_protected_aes_single_malformed.properties
@@ -40,4 +40,13 @@ nifi.registry.security.authorizer=
nifi.registry.security.identity.providers.configuration.file=
nifi.registry.security.identity.provider=
+# OpenId Connect SSO Properties #
+nifi.registry.security.user.oidc.discovery.url=
+nifi.registry.security.user.oidc.connect.timeout=
+nifi.registry.security.user.oidc.read.timeout=
+nifi.registry.security.user.oidc.client.id=
+nifi.registry.security.user.oidc.client.secret=6WUpex+VZiN05LXu||joWJMuoSzYniEC7IAoingTimlG7+RGk8I2irl/WTlIuMcg
+nifi.registry.security.user.oidc.client.secret.protected=aes/gcm/128
+nifi.registry.security.user.oidc.preferred.jwsalgorithm=
+
nifi.registry.sensitive.props.additional.keys=
diff --git a/nifi-registry/nifi-registry-core/nifi-registry-properties-loader/src/test/resources/conf/nifi-registry.with_sensitive_props_protected_unknown.properties b/nifi-registry/nifi-registry-core/nifi-registry-properties-loader/src/test/resources/conf/nifi-registry.with_sensitive_props_protected_unknown.properties
index 8bd6f4fbba..33b1e075bb 100644
--- a/nifi-registry/nifi-registry-core/nifi-registry-properties-loader/src/test/resources/conf/nifi-registry.with_sensitive_props_protected_unknown.properties
+++ b/nifi-registry/nifi-registry-core/nifi-registry-properties-loader/src/test/resources/conf/nifi-registry.with_sensitive_props_protected_unknown.properties
@@ -40,4 +40,13 @@ nifi.registry.security.authorizer=
nifi.registry.security.identity.providers.configuration.file=
nifi.registry.security.identity.provider=
+# OpenId Connect SSO Properties #
+nifi.registry.security.user.oidc.discovery.url=
+nifi.registry.security.user.oidc.connect.timeout=
+nifi.registry.security.user.oidc.read.timeout=
+nifi.registry.security.user.oidc.client.id=
+nifi.registry.security.user.oidc.client.secret=3EsY6PJqU2xrL4rB||HsLYTYE/UAUsnrOmMG0f7UZdmhSvL2qh4Iix7PDDw31OZpCO
+nifi.registry.security.user.oidc.client.secret.protected=unknown
+nifi.registry.security.user.oidc.preferred.jwsalgorithm=
+
nifi.registry.sensitive.props.additional.keys=nifi.registry.web.http.port, nifi.registry.web.http.host
diff --git a/nifi-registry/nifi-registry-core/nifi-registry-properties-loader/src/test/resources/conf/nifi-registry.with_sensitive_props_unprotected.properties b/nifi-registry/nifi-registry-core/nifi-registry-properties-loader/src/test/resources/conf/nifi-registry.with_sensitive_props_unprotected.properties
index b0f9f40418..3acd005e4c 100644
--- a/nifi-registry/nifi-registry-core/nifi-registry-properties-loader/src/test/resources/conf/nifi-registry.with_sensitive_props_unprotected.properties
+++ b/nifi-registry/nifi-registry-core/nifi-registry-properties-loader/src/test/resources/conf/nifi-registry.with_sensitive_props_unprotected.properties
@@ -38,4 +38,12 @@ nifi.registry.security.authorizer=
nifi.registry.security.identity.providers.configuration.file=
nifi.registry.security.identity.provider=
+# OpenId Connect SSO Properties #
+nifi.registry.security.user.oidc.discovery.url=
+nifi.registry.security.user.oidc.connect.timeout=
+nifi.registry.security.user.oidc.read.timeout=
+nifi.registry.security.user.oidc.client.id=
+nifi.registry.security.user.oidc.client.secret=thisIsABadOidcSecret
+nifi.registry.security.user.oidc.preferred.jwsalgorithm=
+
nifi.registry.sensitive.props.additional.keys=nifi.registry.web.http.port, nifi.registry.web.http.host
diff --git a/nifi-registry/nifi-registry-core/nifi-registry-properties-loader/src/test/resources/conf/nifi-registry.with_sensitive_props_unprotected_extra_line.properties b/nifi-registry/nifi-registry-core/nifi-registry-properties-loader/src/test/resources/conf/nifi-registry.with_sensitive_props_unprotected_extra_line.properties
index 34b80a3115..bec6fce380 100644
--- a/nifi-registry/nifi-registry-core/nifi-registry-properties-loader/src/test/resources/conf/nifi-registry.with_sensitive_props_unprotected_extra_line.properties
+++ b/nifi-registry/nifi-registry-core/nifi-registry-properties-loader/src/test/resources/conf/nifi-registry.with_sensitive_props_unprotected_extra_line.properties
@@ -39,4 +39,12 @@ nifi.registry.security.authorizer=
nifi.registry.security.identity.providers.configuration.file=
nifi.registry.security.identity.provider=
+# OpenId Connect SSO Properties #
+nifi.registry.security.user.oidc.discovery.url=
+nifi.registry.security.user.oidc.connect.timeout=
+nifi.registry.security.user.oidc.read.timeout=
+nifi.registry.security.user.oidc.client.id=
+nifi.registry.security.user.oidc.client.secret=thisIsABadOidcSecret
+nifi.registry.security.user.oidc.preferred.jwsalgorithm=
+
nifi.registry.sensitive.props.additional.keys=nifi.registry.web.http.port, nifi.registry.web.http.host