Re: SSL, Users, and NiFi 2.3.0

[Joe Obernberger <jo...@gmail.com>]

Hi All - I was able to get a browser to connect to a 3 node NiFi cluster 
and all was well for about 3 hours.  Then I started to get these errors 
in the nifi-user.log file.  Any ideas on what to look for?  Thank you!

2025-04-02 19:45:13,000 ERROR [NiFi Web Server-8452] 
o.a.nifi.web.api.config.ThrowableMapper An unexpected error has 
occurred: java.io.UncheckedIOException: Read Current User Entity failed. 
Returning Internal Server Error response.
java.io.UncheckedIOException: Read Current User Entity failed
         at 
org.apache.nifi.web.api.FlowResource.readReplicatedCurrentUserEntity(FlowResource.java:446)
         at 
org.apache.nifi.web.api.FlowResource.getCurrentUser(FlowResource.java:421)
         at 
java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:103)
         at java.base/java.lang.reflect.Method.invoke(Method.java:580)
         at 
org.glassfish.jersey.server.model.internal.ResourceMethodInvocationHandlerFactory.lambda$static$0(ResourceMethodInvocationHandlerFactory.java:52)
         at 
org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher$1.run(AbstractJavaResourceMethodDispatcher.java:146)
         at 
org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher.invoke(AbstractJavaResourceMethodDispatcher.java:189)
         at 
org.glassfish.jersey.server.model.internal.JavaResourceMethodDispatcherProvider$ResponseOutInvoker.doDispatch(JavaResourceMethodDispatcherProvider.java:176)
         at 
org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher.dispatch(AbstractJavaResourceMethodDispatcher.java:93)
         at 
org.glassfish.jersey.server.model.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:478)
         at 
org.glassfish.jersey.server.model.ResourceMethodInvoker.apply(ResourceMethodInvoker.java:400)
         at 
org.glassfish.jersey.server.model.ResourceMethodInvoker.apply(ResourceMethodInvoker.java:81)
         at 
org.glassfish.jersey.server.ServerRuntime$1.run(ServerRuntime.java:274)
         at org.glassfish.jersey.internal.Errors$1.call(Errors.java:248)
         at org.glassfish.jersey.internal.Errors$1.call(Errors.java:244)
         at org.glassfish.jersey.internal.Errors.process(Errors.java:292)
         at org.glassfish.jersey.internal.Errors.process(Errors.java:274)
         at org.glassfish.jersey.internal.Errors.process(Errors.java:244)
         at 
org.glassfish.jersey.process.internal.RequestScope.runInScope(RequestScope.java:266)
         at 
org.glassfish.jersey.server.ServerRuntime.process(ServerRuntime.java:253)
         at 
org.glassfish.jersey.server.ApplicationHandler.handle(ApplicationHandler.java:696)
         at 
org.glassfish.jersey.servlet.WebComponent.serviceImpl(WebComponent.java:397)
         at 
org.glassfish.jersey.servlet.WebComponent.service(WebComponent.java:349)
         at 
org.glassfish.jersey.servlet.ServletContainer.service(ServletContainer.java:358)
         at 
org.glassfish.jersey.servlet.ServletContainer.service(ServletContainer.java:312)
         at 
org.glassfish.jersey.servlet.ServletContainer.service(ServletContainer.java:205)
         at 
org.eclipse.jetty.ee10.servlet.ServletHolder$NotAsync.service(ServletHolder.java:1379)
         at 
org.eclipse.jetty.ee10.servlet.ServletHolder.handle(ServletHolder.java:736)
         at 
org.eclipse.jetty.ee10.servlet.ServletHandler$ChainEnd.doFilter(ServletHandler.java:1619)
         at 
org.springframework.security.web.FilterChainProxy.lambda$doFilterInternal$3(FilterChainProxy.java:231)
         at 
org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:365)
         at 
org.springframework.security.web.access.intercept.AuthorizationFilter.doFilter(AuthorizationFilter.java:101)
         at 
org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:374)
         at 
org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:126)
         at 
org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:120)
         at 
org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:374)
         at 
org.apache.nifi.web.security.log.AuthenticationUserFilter.doFilterInternal(AuthenticationUserFilter.java:57)
         at 
org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116)
         at 
org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:374)
         at 
org.springframework.security.web.authentication.AnonymousAuthenticationFilter.doFilter(AnonymousAuthenticationFilter.java:100)
         at 
org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:374)
         at 
org.springframework.security.oauth2.server.resource.web.authentication.BearerTokenAuthenticationFilter.doFilterInternal(BearerTokenAuthenticationFilter.java:128)
         at 
org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116)
         at 
org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:374)
         at 
org.apache.nifi.web.security.NiFiAuthenticationFilter.authenticate(NiFiAuthenticationFilter.java:94)
         at 
org.apache.nifi.web.security.NiFiAuthenticationFilter.doFilter(NiFiAuthenticationFilter.java:56)
         at 
org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:374)
         at 
org.apache.nifi.web.security.csrf.CsrfCookieFilter.doFilterInternal(CsrfCookieFilter.java:43)
         at 
org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116)
         at 
org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:374)
         at 
org.springframework.security.web.csrf.CsrfFilter.doFilterInternal(CsrfFilter.java:117)
         at 
org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116)
         at 
org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:374)
         at 
org.apache.nifi.web.security.csrf.SkipReplicatedCsrfFilter.doFilterInternal(SkipReplicatedCsrfFilter.java:59)
         at 
org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116)
         at 
org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:374)
         at 
org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:62)
         at 
org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116)
         at 
org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:374)
         at 
org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:233)
         at 
org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:191)
         at 
org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:362)
         at 
org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:278)
         at 
org.eclipse.jetty.ee10.servlet.FilterHolder.doFilter(FilterHolder.java:205)
         at 
org.eclipse.jetty.ee10.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1591)
         at 
org.apache.nifi.web.filter.ExceptionFilter.doFilter(ExceptionFilter.java:44)
         at 
org.eclipse.jetty.ee10.servlet.FilterHolder.doFilter(FilterHolder.java:208)
         at 
org.eclipse.jetty.ee10.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1591)
         at 
org.eclipse.jetty.ee10.servlets.DoSFilter.doFilterChain(DoSFilter.java:462)
         at 
org.apache.nifi.web.server.filter.DataTransferExcludedDoSFilter.doFilterChain(DataTransferExcludedDoSFilter.java:51)
         at 
org.eclipse.jetty.ee10.servlets.DoSFilter.doFilter(DoSFilter.java:317)
         at 
org.eclipse.jetty.ee10.servlets.DoSFilter.doFilter(DoSFilter.java:282)
         at 
org.eclipse.jetty.ee10.servlet.FilterHolder.doFilter(FilterHolder.java:205)
         at 
org.eclipse.jetty.ee10.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1591)
         at 
org.apache.nifi.web.server.log.RequestAuthenticationFilter.doFilterInternal(RequestAuthenticationFilter.java:59)
         at 
org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116)
         at 
org.eclipse.jetty.ee10.servlet.FilterHolder.doFilter(FilterHolder.java:205)
         at 
org.eclipse.jetty.ee10.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1591)
         at 
org.eclipse.jetty.ee10.servlet.ServletHandler$MappedServlet.handle(ServletHandler.java:1552)
         at 
org.eclipse.jetty.ee10.servlet.ServletChannel.dispatch(ServletChannel.java:819)
         at 
org.eclipse.jetty.ee10.servlet.ServletChannel.handle(ServletChannel.java:436)
         at 
org.eclipse.jetty.ee10.servlet.ServletHandler.handle(ServletHandler.java:469)
         at 
org.eclipse.jetty.security.SecurityHandler.handle(SecurityHandler.java:575)
         at 
org.eclipse.jetty.ee10.servlet.SessionHandler.handle(SessionHandler.java:717)
         at 
org.eclipse.jetty.server.handler.ContextHandler.handle(ContextHandler.java:1060)
         at 
org.eclipse.jetty.server.handler.ContextHandlerCollection.handle(ContextHandlerCollection.java:181)
         at 
org.eclipse.jetty.server.handler.ContextHandlerCollection.handle(ContextHandlerCollection.java:151)
         at 
org.eclipse.jetty.server.Handler$Sequence.handle(Handler.java:805)
         at org.eclipse.jetty.server.Server.handle(Server.java:182)
         at 
org.eclipse.jetty.server.internal.HttpChannelState$HandlerInvoker.run(HttpChannelState.java:662)
         at 
org.eclipse.jetty.util.thread.Invocable$ReadyTask.run(Invocable.java:175)
         at 
org.eclipse.jetty.http2.server.internal.HttpStreamOverHTTP2$1.run(HttpStreamOverHTTP2.java:135)
         at 
org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.runTask(AdaptiveExecutionStrategy.java:480)
         at 
org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.consumeTask(AdaptiveExecutionStrategy.java:443)
         at 
org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.tryProduce(AdaptiveExecutionStrategy.java:293)
         at 
org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.produce(AdaptiveExecutionStrategy.java:195)
         at 
org.eclipse.jetty.http2.HTTP2Connection.produce(HTTP2Connection.java:209)
         at 
org.eclipse.jetty.http2.HTTP2Connection.onFillable(HTTP2Connection.java:156)
         at 
org.eclipse.jetty.http2.HTTP2Connection$FillableCallback.succeeded(HTTP2Connection.java:442)
         at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:99)
         at 
org.eclipse.jetty.io.ssl.SslConnection$SslEndPoint.onFillable(SslConnection.java:575)
         at 
org.eclipse.jetty.io.ssl.SslConnection.onFillable(SslConnection.java:390)
         at 
org.eclipse.jetty.io.ssl.SslConnection$2.succeeded(SslConnection.java:150)
         at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:99)
         at 
org.eclipse.jetty.io.SelectableChannelEndPoint$1.run(SelectableChannelEndPoint.java:53)
         at 
org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.runTask(AdaptiveExecutionStrategy.java:480)
         at 
org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.consumeTask(AdaptiveExecutionStrategy.java:443)
         at 
org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.tryProduce(AdaptiveExecutionStrategy.java:293)
         at 
org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.run(AdaptiveExecutionStrategy.java:201)
         at 
org.eclipse.jetty.util.thread.ReservedThreadExecutor$ReservedThread.run(ReservedThreadExecutor.java:311)
         at 
org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:979)
         at 
org.eclipse.jetty.util.thread.QueuedThreadPool$Runner.doRunJob(QueuedThreadPool.java:1209)
         at 
org.eclipse.jetty.util.thread.QueuedThreadPool$Runner.run(QueuedThreadPool.java:1164)
         at java.base/java.lang.Thread.run(Thread.java:1583)
Caused by: com.fasterxml.jackson.core.JsonParseException: Unrecognized 
token 'Authentication': was expecting (JSON String, Number, Array, 
Object or token 'null', 'true' or 'false')
  at [Source: REDACTED (`StreamReadFeature.INCLUDE_SOURCE_IN_LOCATION` 
disabled); line: 1, column: 16]
         at 
com.fasterxml.jackson.core.JsonParser._constructError(JsonParser.java:2584)
         at 
com.fasterxml.jackson.core.JsonParser._constructReadException(JsonParser.java:2610)
         at 
com.fasterxml.jackson.core.JsonParser._constructReadException(JsonParser.java:2618)
         at 
com.fasterxml.jackson.core.base.ParserMinimalBase._reportError(ParserMinimalBase.java:825)
         at 
com.fasterxml.jackson.core.json.UTF8StreamJsonParser._reportInvalidToken(UTF8StreamJsonParser.java:3662)
         at 
com.fasterxml.jackson.core.json.UTF8StreamJsonParser._handleUnexpectedValue(UTF8StreamJsonParser.java:2749)
         at 
com.fasterxml.jackson.core.json.UTF8StreamJsonParser._nextTokenNotInObject(UTF8StreamJsonParser.java:867)
         at 
com.fasterxml.jackson.core.json.UTF8StreamJsonParser.nextToken(UTF8StreamJsonParser.java:753)
         at 
com.fasterxml.jackson.databind.ObjectMapper._initForReading(ObjectMapper.java:5018)
         at 
com.fasterxml.jackson.databind.ObjectMapper._readMapAndClose(ObjectMapper.java:4921)
         at 
com.fasterxml.jackson.databind.ObjectMapper.readValue(ObjectMapper.java:3929)
         at 
org.apache.nifi.web.api.FlowResource.readReplicatedCurrentUserEntity(FlowResource.java:444)
         ... 113 common frames omitted


-Joe

On 3/25/2025 1:41 PM, e-sociaux@gmx.fr wrote:
> Hi
>
> During the installation you have setup admin user. So the first connection could be done with this user.
>
>
>
> Envoyé à partir de l'app mail mobile
>
>   sur 25/03/2025 le 18:17, Joe Obernberger écrivit:
>
>> Hi folks - I'm having a heck-of-a-time getting SSL and users to work
>> with NiFi 2.3.0, Nifikop, Kubernetes, cert-manager, and whatever else is
>> in that group.  :)
>>
>> I have SSL finally working with a cert added to the browser, but now I'm
>> getting the screen "Insufficient Permissions - Unable to view the user
>> interface. Contact the system administrator."
>>
>> Not sure where to go from here / what to check?  Error in nifi-user.log:
>> 2025-03-25 17:00:19,653 INFO [NiFi Web Server-228]
>> o.a.n.w.a.c.AccessDeniedExceptionMapper
>> identity[josnifitst-1-node.josnifitst-headless.nifitst.svc.cluster.local],
>> groups[] does not have permission to access the requested resource.
>> Unable to view the user interface. Returning Forbidden response.
>>
>> I see that groups is empty - do I need to add to that?  I'm lost.  Thank
>> you!
>>
>> -Joe
>>
>>

-- 
This email has been checked for viruses by AVG antivirus software.
www.avg.com