You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@nifi.apache.org by kh...@freedomconsultinggroup.com on 2016/06/21 17:21:49 UTC
Secure site-to-site error
I'm running NiFi 0.6.1 with 2-way SSL and having trouble setting up a secure site-to-site with a cluster. The Remote Process Group on the cluster shows the error "Not authorized." and I see entries like this in my logs (names have been changed to protect the innocent).
Attempting request for (<CN=xxxx, OU=yyyy, O=zzzz>) GET https://my.nifi.server/nifi-api/controller (source ip: 1.2.3.4)
Rejecting access to web api: Unable to verify access for CN=xxxx, OU=yyyy, O=zzzz.
An account request should be generated but it's not. As a test I created a Remote Process Group to the local server and it successfully generated an account request. I've also inspected the remote certificate and it looks fine. What could be causing this?
- Kenny
Re: Secure site-to-site error
Posted by Michael Moser <mo...@gmail.com>.
Kenny,
Also please check your nifi/conf/authority-providers.xml on the NCM and
Nodes in your cluster. I have seen site-to-site authorization problems
when this isn't setup correctly. The NCM knows about all clients that are
expected in site-to-site communication via Remote Process Group, but the
individual nodes do not. This is why the NCM authority-providers.xml
should use ClusterManagerAuthorizationProvider and the Nodes
authority-providers.xml should use NodeAuthorizationProvider. The
NodeAuthorizationProvider basically delegates authorization decisions to
the ClusterManagerAuthorizationProvider.
You can take a look at the "Controlling Levels of Access" section of the
Admin Guide for a description of this.
-- Mike
On Tue, Jun 21, 2016 at 8:32 PM, Andy LoPresto <al...@apache.org> wrote:
> Hi Kenny,
>
> Do you have access to the logs/nifi-app.log file on “my.nifi.server”? You
> can partially debug this by identifying if it is a TLS issue or a NiFi
> issue:
>
> From the “client” machine, run this terminal command (here are
> documentation [1] and further instructions [2] on debugging using the
> s_client command):
>
> $ openssl s_client -connect my.nifi.server:<port> -state -debug -cert
> <path/to/client/certificate.pem> -key <path/to/client/key.pem> -CAfile
> <path/to/CA/certificate.pem>
>
> where:
>
> * <port> = the cluster port (found in the “server”/NCM nifi.properties
> file)
> * <path/to/client/certificate.pem> = the path to the client certificate
> PEM file
> * <path/to/client/key.pem> = the path to the client private key PEM file
> * <path/to/CA/certificate.pem> = the path to the trusted CA certificate
> PEM file used to sign the server certificate
>
> If the command succeeds (verify return code: 0 at the very bottom of the
> output), you will know that the TLS negotiation and certificate
> authentication is successful. In that case, we can drill further into NiFi
> logs to try and identify the issue. If this fails, it means that the TLS
> negotiation is not configured correctly — either one or both of the
> certificates are not being presented properly or verified correctly, or
> another issue is occurring with TLS.
>
> If you need any further assistance, please let us know.
>
> [1] https://www.openssl.org/docs/manmaster/apps/s_client.html
> [2]
> https://www.feistyduck.com/library/openssl-cookbook/online/ch-testing-with-openssl.html
>
> Andy LoPresto
> alopresto@apache.org
> *alopresto.apache@gmail.com <al...@gmail.com>*
> PGP Fingerprint: 70EC B3E5 98A6 5A3F D3C4 BACE 3C6E F65B 2F7D EF69
>
> On Jun 21, 2016, at 10:21 AM, khoran@freedomconsultinggroup.com wrote:
>
> I'm running NiFi 0.6.1 with 2-way SSL and having trouble setting up a
> secure site-to-site with a cluster. The Remote Process Group on the
> cluster shows the error "Not authorized." and I see entries like this in my
> logs (names have been changed to protect the innocent).
>
> Attempting request for (<CN=xxxx, OU=yyyy, O=zzzz>) GET
> https://my.nifi.server/nifi-api/controller (source ip: 1.2.3.4)
> Rejecting access to web api: Unable to verify access for CN=xxxx, OU=yyyy,
> O=zzzz.
>
> An account request should be generated but it's not. As a test I created
> a Remote Process Group to the local server and it successfully generated an
> account request. I've also inspected the remote certificate and it looks
> fine. What could be causing this?
>
> - Kenny
>
>
>
Re: Secure site-to-site error
Posted by Andy LoPresto <al...@apache.org>.
Hi Kenny,
Do you have access to the logs/nifi-app.log file on “my.nifi.server”? You can partially debug this by identifying if it is a TLS issue or a NiFi issue:
From the “client” machine, run this terminal command (here are documentation [1] and further instructions [2] on debugging using the s_client command):
$ openssl s_client -connect my.nifi.server:<port> -state -debug -cert <path/to/client/certificate.pem> -key <path/to/client/key.pem> -CAfile <path/to/CA/certificate.pem>
where:
* <port> = the cluster port (found in the “server”/NCM nifi.properties file)
* <path/to/client/certificate.pem> = the path to the client certificate PEM file
* <path/to/client/key.pem> = the path to the client private key PEM file
* <path/to/CA/certificate.pem> = the path to the trusted CA certificate PEM file used to sign the server certificate
If the command succeeds (verify return code: 0 at the very bottom of the output), you will know that the TLS negotiation and certificate authentication is successful. In that case, we can drill further into NiFi logs to try and identify the issue. If this fails, it means that the TLS negotiation is not configured correctly — either one or both of the certificates are not being presented properly or verified correctly, or another issue is occurring with TLS.
If you need any further assistance, please let us know.
[1] https://www.openssl.org/docs/manmaster/apps/s_client.html <https://www.openssl.org/docs/manmaster/apps/s_client.html>
[2] https://www.feistyduck.com/library/openssl-cookbook/online/ch-testing-with-openssl.html <https://www.feistyduck.com/library/openssl-cookbook/online/ch-testing-with-openssl.html>
Andy LoPresto
alopresto@apache.org
alopresto.apache@gmail.com
PGP Fingerprint: 70EC B3E5 98A6 5A3F D3C4 BACE 3C6E F65B 2F7D EF69
> On Jun 21, 2016, at 10:21 AM, khoran@freedomconsultinggroup.com wrote:
>
> I'm running NiFi 0.6.1 with 2-way SSL and having trouble setting up a secure site-to-site with a cluster. The Remote Process Group on the cluster shows the error "Not authorized." and I see entries like this in my logs (names have been changed to protect the innocent).
>
> Attempting request for (<CN=xxxx, OU=yyyy, O=zzzz>) GET https://my.nifi.server/nifi-api/controller (source ip: 1.2.3.4)
> Rejecting access to web api: Unable to verify access for CN=xxxx, OU=yyyy, O=zzzz.
>
> An account request should be generated but it's not. As a test I created a Remote Process Group to the local server and it successfully generated an account request. I've also inspected the remote certificate and it looks fine. What could be causing this?
>
> - Kenny
>