You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@nifi.apache.org by GitBox <gi...@apache.org> on 2021/03/12 19:01:57 UTC
[GitHub] [nifi] turcsanyip opened a new pull request #4893: NIFI-8312: Support PKCS12 and BCFKS truststores in Atlas reporting task
turcsanyip opened a new pull request #4893:
URL: https://github.com/apache/nifi/pull/4893
Generate ssl-client.xml on NiFi side in order to be able to configure non-JKS truststores.
Thank you for submitting a contribution to Apache NiFi.
Please provide a short description of the PR here:
#### Description of PR
_Enables X functionality; fixes bug NIFI-YYYY._
In order to streamline the review of the contribution we ask you
to ensure the following steps have been taken:
### For all changes:
- [ ] Is there a JIRA ticket associated with this PR? Is it referenced
in the commit message?
- [ ] Does your PR title start with **NIFI-XXXX** where XXXX is the JIRA number you are trying to resolve? Pay particular attention to the hyphen "-" character.
- [ ] Has your PR been rebased against the latest commit within the target branch (typically `main`)?
- [ ] Is your initial contribution a single, squashed commit? _Additional commits in response to PR reviewer feedback should be made on this branch and pushed to allow change tracking. Do not `squash` or use `--force` when pushing to allow for clean monitoring of changes._
### For code changes:
- [ ] Have you ensured that the full suite of tests is executed via `mvn -Pcontrib-check clean install` at the root `nifi` folder?
- [ ] Have you written or updated unit tests to verify your changes?
- [ ] Have you verified that the full build is successful on JDK 8?
- [ ] Have you verified that the full build is successful on JDK 11?
- [ ] If adding new dependencies to the code, are these dependencies licensed in a way that is compatible for inclusion under [ASF 2.0](http://www.apache.org/legal/resolved.html#category-a)?
- [ ] If applicable, have you updated the `LICENSE` file, including the main `LICENSE` file under `nifi-assembly`?
- [ ] If applicable, have you updated the `NOTICE` file, including the main `NOTICE` file found under `nifi-assembly`?
- [ ] If adding new Properties, have you added `.displayName` in addition to .name (programmatic access) for each of the new properties?
### For documentation related changes:
- [ ] Have you ensured that format looks appropriate for the output in which it is rendered?
### Note:
Please ensure that once the PR is submitted, you check GitHub Actions CI for build issues and submit an update to your PR as soon as possible.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [nifi] exceptionfactory commented on a change in pull request #4893: NIFI-8312: Support PKCS12 and BCFKS truststores in Atlas reporting task
Posted by GitBox <gi...@apache.org>.
exceptionfactory commented on a change in pull request #4893:
URL: https://github.com/apache/nifi/pull/4893#discussion_r596021422
##########
File path: nifi-nar-bundles/nifi-atlas-bundle/nifi-atlas-reporting-task/src/main/java/org/apache/nifi/atlas/reporting/ReportLineageToAtlas.java
##########
@@ -704,33 +699,47 @@ private void setAtlasSSLConfig(Properties atlasProperties, ConfigurationContext
boolean isAtlasApiSecure = urls.stream().anyMatch(url -> url.toLowerCase().startsWith("https"));
atlasProperties.put(ATLAS_PROPERTY_ENABLE_TLS, String.valueOf(isAtlasApiSecure));
- // ssl-client.xml must be deleted, Atlas will not regenerate it otherwise
- Path credStorePath = new File(confDir, CRED_STORE_FILENAME).toPath();
- Files.deleteIfExists(credStorePath);
Review comment:
Thanks for the confirmation.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [nifi] turcsanyip commented on a change in pull request #4893: NIFI-8312: Support PKCS12 and BCFKS truststores in Atlas reporting task
Posted by GitBox <gi...@apache.org>.
turcsanyip commented on a change in pull request #4893:
URL: https://github.com/apache/nifi/pull/4893#discussion_r594939362
##########
File path: nifi-nar-bundles/nifi-atlas-bundle/nifi-atlas-reporting-task/src/main/java/org/apache/nifi/atlas/reporting/ReportLineageToAtlas.java
##########
@@ -704,33 +699,47 @@ private void setAtlasSSLConfig(Properties atlasProperties, ConfigurationContext
boolean isAtlasApiSecure = urls.stream().anyMatch(url -> url.toLowerCase().startsWith("https"));
atlasProperties.put(ATLAS_PROPERTY_ENABLE_TLS, String.valueOf(isAtlasApiSecure));
- // ssl-client.xml must be deleted, Atlas will not regenerate it otherwise
- Path credStorePath = new File(confDir, CRED_STORE_FILENAME).toPath();
- Files.deleteIfExists(credStorePath);
Review comment:
Leaving the cred store file behind should not be a problem because we do not pass `cert.stores.credential.provider.path` property (pointing to the file) to Atlas any more so it will not use it.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [nifi] turcsanyip commented on pull request #4893: NIFI-8312: Support PKCS12 and BCFKS truststores in Atlas reporting task
Posted by GitBox <gi...@apache.org>.
turcsanyip commented on pull request #4893:
URL: https://github.com/apache/nifi/pull/4893#issuecomment-800049269
@exceptionfactory Thanks for the review. I modified the log statements according to your suggestions. Thanks for that.
Also replied to your question regarding the credential store.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [nifi] exceptionfactory commented on a change in pull request #4893: NIFI-8312: Support PKCS12 and BCFKS truststores in Atlas reporting task
Posted by GitBox <gi...@apache.org>.
exceptionfactory commented on a change in pull request #4893:
URL: https://github.com/apache/nifi/pull/4893#discussion_r594705897
##########
File path: nifi-nar-bundles/nifi-atlas-bundle/nifi-atlas-reporting-task/src/main/java/org/apache/nifi/atlas/reporting/ReportLineageToAtlas.java
##########
@@ -704,33 +699,47 @@ private void setAtlasSSLConfig(Properties atlasProperties, ConfigurationContext
boolean isAtlasApiSecure = urls.stream().anyMatch(url -> url.toLowerCase().startsWith("https"));
atlasProperties.put(ATLAS_PROPERTY_ENABLE_TLS, String.valueOf(isAtlasApiSecure));
- // ssl-client.xml must be deleted, Atlas will not regenerate it otherwise
- Path credStorePath = new File(confDir, CRED_STORE_FILENAME).toPath();
- Files.deleteIfExists(credStorePath);
- Path sslClientXmlPath = new File(confDir, SSL_CLIENT_XML_FILENAME).toPath();
- Files.deleteIfExists(sslClientXmlPath);
+ deleteSslClientXml(confDir);
if (isAtlasApiSecure) {
SSLContextService sslContextService = context.getProperty(SSL_CONTEXT_SERVICE).asControllerService(SSLContextService.class);
if (sslContextService == null) {
getLogger().warn("No SSLContextService configured, the system default truststore will be used.");
} else if (!sslContextService.isTrustStoreConfigured()) {
getLogger().warn("No truststore configured on SSLContextService, the system default truststore will be used.");
- } else if (!KeystoreType.JKS.getType().equalsIgnoreCase(sslContextService.getTrustStoreType())) {
- getLogger().warn("The configured truststore type is not supported by Atlas (not JKS), the system default truststore will be used.");
} else {
- atlasProperties.put(ATLAS_PROPERTY_TRUSTSTORE_FILE, sslContextService.getTrustStoreFile());
+ // create ssl-client.xml config file for Hadoop Security used by Atlas REST client,
+ // Atlas would generate this file with hardcoded JKS keystore type,
+ // in order to support other keystore types, we generate it ourselves
+ createSslClientXml(confDir, sslContextService);
+ }
+ }
+ }
+
+ private void deleteSslClientXml(File confDir) throws Exception {
+ Path path = new File(confDir, SSL_CLIENT_XML_FILENAME).toPath();
+ try {
+ Files.deleteIfExists(path);
+ } catch (Exception e) {
+ getLogger().error("Unable to delete " + path, e);
Review comment:
Recommend changing the message to use the placeholder syntax and indicating a little more detail about the file:
```suggestion
getLogger().error("Unable to delete SSL Client Configuration File {}", path, e);
```
##########
File path: nifi-nar-bundles/nifi-atlas-bundle/nifi-atlas-reporting-task/src/main/java/org/apache/nifi/atlas/reporting/ReportLineageToAtlas.java
##########
@@ -704,33 +699,47 @@ private void setAtlasSSLConfig(Properties atlasProperties, ConfigurationContext
boolean isAtlasApiSecure = urls.stream().anyMatch(url -> url.toLowerCase().startsWith("https"));
atlasProperties.put(ATLAS_PROPERTY_ENABLE_TLS, String.valueOf(isAtlasApiSecure));
- // ssl-client.xml must be deleted, Atlas will not regenerate it otherwise
- Path credStorePath = new File(confDir, CRED_STORE_FILENAME).toPath();
- Files.deleteIfExists(credStorePath);
Review comment:
Do you anticipate any problems if the Credentials Store file remains on the file system since it will no longer be deleted?
##########
File path: nifi-nar-bundles/nifi-atlas-bundle/nifi-atlas-reporting-task/src/main/java/org/apache/nifi/atlas/reporting/ReportLineageToAtlas.java
##########
@@ -704,33 +699,47 @@ private void setAtlasSSLConfig(Properties atlasProperties, ConfigurationContext
boolean isAtlasApiSecure = urls.stream().anyMatch(url -> url.toLowerCase().startsWith("https"));
atlasProperties.put(ATLAS_PROPERTY_ENABLE_TLS, String.valueOf(isAtlasApiSecure));
- // ssl-client.xml must be deleted, Atlas will not regenerate it otherwise
- Path credStorePath = new File(confDir, CRED_STORE_FILENAME).toPath();
- Files.deleteIfExists(credStorePath);
- Path sslClientXmlPath = new File(confDir, SSL_CLIENT_XML_FILENAME).toPath();
- Files.deleteIfExists(sslClientXmlPath);
+ deleteSslClientXml(confDir);
if (isAtlasApiSecure) {
SSLContextService sslContextService = context.getProperty(SSL_CONTEXT_SERVICE).asControllerService(SSLContextService.class);
if (sslContextService == null) {
getLogger().warn("No SSLContextService configured, the system default truststore will be used.");
} else if (!sslContextService.isTrustStoreConfigured()) {
getLogger().warn("No truststore configured on SSLContextService, the system default truststore will be used.");
- } else if (!KeystoreType.JKS.getType().equalsIgnoreCase(sslContextService.getTrustStoreType())) {
- getLogger().warn("The configured truststore type is not supported by Atlas (not JKS), the system default truststore will be used.");
} else {
- atlasProperties.put(ATLAS_PROPERTY_TRUSTSTORE_FILE, sslContextService.getTrustStoreFile());
+ // create ssl-client.xml config file for Hadoop Security used by Atlas REST client,
+ // Atlas would generate this file with hardcoded JKS keystore type,
+ // in order to support other keystore types, we generate it ourselves
+ createSslClientXml(confDir, sslContextService);
+ }
+ }
+ }
+
+ private void deleteSslClientXml(File confDir) throws Exception {
+ Path path = new File(confDir, SSL_CLIENT_XML_FILENAME).toPath();
+ try {
+ Files.deleteIfExists(path);
+ } catch (Exception e) {
+ getLogger().error("Unable to delete " + path, e);
+ throw e;
+ }
+ }
- String password = sslContextService.getTrustStorePassword();
- // Hadoop Credential Provider JCEKS URI format: localjceks://file/PATH/TO/JCEKS
- String credStoreUri = credStorePath.toUri().toString().replaceFirst("^file://", "localjceks://file");
+ private void createSslClientXml(File confDir, SSLContextService sslContextService) throws Exception {
+ File sslClientXmlFile = new File(confDir, SSL_CLIENT_XML_FILENAME);
- CredentialProvider credentialProvider = new LocalJavaKeyStoreProvider.Factory().createProvider(new URI(credStoreUri), new Configuration());
- credentialProvider.createCredentialEntry(TRUSTSTORE_PASSWORD_ALIAS, password.toCharArray());
- credentialProvider.flush();
+ Configuration configuration = new Configuration(false);
- atlasProperties.put(ATLAS_PROPERTY_CRED_STORE_PATH, credStoreUri);
- }
+ configuration.set(SSL_CLIENT_XML_TRUSTSTORE_LOCATION, sslContextService.getTrustStoreFile());
+ configuration.set(SSL_CLIENT_XML_TRUSTSTORE_PASSWORD, sslContextService.getTrustStorePassword());
+ configuration.set(SSL_CLIENT_XML_TRUSTSTORE_TYPE, sslContextService.getTrustStoreType());
+
+ try (FileWriter fileWriter = new FileWriter(sslClientXmlFile)) {
+ configuration.writeXml(fileWriter);
+ } catch (Exception e) {
+ getLogger().error("Unable to create SSL config file: " + sslClientXmlFile, e);
Review comment:
As mention in other comment for parameterized logging:
```suggestion
getLogger().error("Unable to create SSL Client Configuration File {}", sslClientXmlFile, e);
```
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [nifi] asfgit closed pull request #4893: NIFI-8312: Support PKCS12 and BCFKS truststores in Atlas reporting task
Posted by GitBox <gi...@apache.org>.
asfgit closed pull request #4893:
URL: https://github.com/apache/nifi/pull/4893
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org