You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@nifi.apache.org by bb...@apache.org on 2018/06/19 17:28:07 UTC
nifi git commit: NIFI-5193 Added logic to handle complex user filter
expressions. Added unit tests. Added unit test resources. Fixed comments.
Refactored XmlSlurper instantiation to keep ignorable whitespace. Added logic
to handle LIP complex user search
Repository: nifi
Updated Branches:
refs/heads/master aa3398919 -> 8996b7f6d
NIFI-5193 Added logic to handle complex user filter expressions.
Added unit tests.
Added unit test resources.
Fixed comments.
Refactored XmlSlurper instantiation to keep ignorable whitespace.
Added logic to handle LIP complex user search filter.
Added unit tests.
Added unit test resources.
Removed unnecessary substitution/repopulation logic from encrypt|decryptAuthorizers.
All unit tests pass.
Removed unnecessary substitution/repopulation logic from CET.
Removed unnecessary unit tests.
Removed unnecessary commons-text dependency from pom.xml.
This closes #2797.
Signed-off-by: Bryan Bende <bb...@apache.org>
Project: http://git-wip-us.apache.org/repos/asf/nifi/repo
Commit: http://git-wip-us.apache.org/repos/asf/nifi/commit/8996b7f6
Tree: http://git-wip-us.apache.org/repos/asf/nifi/tree/8996b7f6
Diff: http://git-wip-us.apache.org/repos/asf/nifi/diff/8996b7f6
Branch: refs/heads/master
Commit: 8996b7f6d6f9aeead067681fe69cba5a7e1f0482
Parents: aa33989
Author: Andy LoPresto <al...@apache.org>
Authored: Thu Jun 14 20:38:11 2018 -0700
Committer: Bryan Bende <bb...@apache.org>
Committed: Tue Jun 19 13:27:47 2018 -0400
----------------------------------------------------------------------
.../nifi-toolkit-encrypt-config/pom.xml | 12 +
.../nifi/properties/ConfigEncryptionTool.groovy | 103 ++++---
.../properties/ConfigEncryptionToolTest.groovy | 156 +++++++++-
.../authorizers-populated-complex-filter.xml | 309 +++++++++++++++++++
...ntity-providers-populated-complex-filter.xml | 105 +++++++
5 files changed, 644 insertions(+), 41 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/nifi/blob/8996b7f6/nifi-toolkit/nifi-toolkit-encrypt-config/pom.xml
----------------------------------------------------------------------
diff --git a/nifi-toolkit/nifi-toolkit-encrypt-config/pom.xml b/nifi-toolkit/nifi-toolkit-encrypt-config/pom.xml
index 8acf23a..2969e4e 100644
--- a/nifi-toolkit/nifi-toolkit-encrypt-config/pom.xml
+++ b/nifi-toolkit/nifi-toolkit-encrypt-config/pom.xml
@@ -97,6 +97,18 @@
<version>2.2.2</version>
<scope>test</scope>
</dependency>
+ <dependency>
+ <groupId>org.xmlunit</groupId>
+ <artifactId>xmlunit-core</artifactId>
+ <version>2.6.0</version>
+ <scope>test</scope>
+ </dependency>
+ <dependency>
+ <groupId>org.xmlunit</groupId>
+ <artifactId>xmlunit-matchers</artifactId>
+ <version>2.6.0</version>
+ <scope>test</scope>
+ </dependency>
</dependencies>
<build>
http://git-wip-us.apache.org/repos/asf/nifi/blob/8996b7f6/nifi-toolkit/nifi-toolkit-encrypt-config/src/main/groovy/org/apache/nifi/properties/ConfigEncryptionTool.groovy
----------------------------------------------------------------------
diff --git a/nifi-toolkit/nifi-toolkit-encrypt-config/src/main/groovy/org/apache/nifi/properties/ConfigEncryptionTool.groovy b/nifi-toolkit/nifi-toolkit-encrypt-config/src/main/groovy/org/apache/nifi/properties/ConfigEncryptionTool.groovy
index 6ebcd0a..327735b 100644
--- a/nifi-toolkit/nifi-toolkit-encrypt-config/src/main/groovy/org/apache/nifi/properties/ConfigEncryptionTool.groovy
+++ b/nifi-toolkit/nifi-toolkit-encrypt-config/src/main/groovy/org/apache/nifi/properties/ConfigEncryptionTool.groovy
@@ -17,6 +17,7 @@
package org.apache.nifi.properties
import groovy.io.GroovyPrintWriter
+import groovy.util.slurpersupport.GPathResult
import groovy.xml.XmlUtil
import org.apache.commons.cli.CommandLine
import org.apache.commons.cli.CommandLineParser
@@ -47,6 +48,7 @@ import java.nio.charset.StandardCharsets
import java.security.KeyException
import java.security.SecureRandom
import java.security.Security
+import java.util.regex.Matcher
import java.util.zip.GZIPInputStream
import java.util.zip.GZIPOutputStream
@@ -187,12 +189,12 @@ class ConfigEncryptionTool {
private static final String DEFAULT_FLOW_ALGORITHM = "PBEWITHMD5AND256BITAES-CBC-OPENSSL"
private static final Map<String, String> PROPERTY_KEY_MAP = [
- "nifi.security.keystore": "keystore",
- "nifi.security.keystoreType": "keystoreType",
- "nifi.security.keystorePasswd": "keystorePasswd",
- "nifi.security.keyPasswd": "keyPasswd",
- "nifi.security.truststore": "truststore",
- "nifi.security.truststoreType": "truststoreType",
+ "nifi.security.keystore" : "keystore",
+ "nifi.security.keystoreType" : "keystoreType",
+ "nifi.security.keystorePasswd" : "keystorePasswd",
+ "nifi.security.keyPasswd" : "keyPasswd",
+ "nifi.security.truststore" : "truststore",
+ "nifi.security.truststoreType" : "truststoreType",
"nifi.security.truststorePasswd": "truststorePasswd",
]
@@ -251,11 +253,11 @@ class ConfigEncryptionTool {
return staticOptions
}
-/**
- * Prints the usage message and available arguments for this tool (along with a specific error message if provided).
- *
- * @param errorMessage the optional error message
- */
+ /**
+ * Prints the usage message and available arguments for this tool (along with a specific error message if provided).
+ *
+ * @param errorMessage the optional error message
+ */
void printUsage(String errorMessage) {
if (errorMessage) {
System.out.println(errorMessage)
@@ -491,15 +493,15 @@ class ConfigEncryptionTool {
}
}
-/**
- * The method returns the provided, derived, or securely-entered key in hex format. The reason the parameters must be provided instead of read from the fields is because this is used for the regular key/password and the migration key/password.
- *
- * @param device
- * @param keyHex
- * @param password
- * @param usingPassword
- * @return
- */
+ /**
+ * The method returns the provided, derived, or securely-entered key in hex format. The reason the parameters must be provided instead of read from the fields is because this is used for the regular key/password and the migration key/password.
+ *
+ * @param device
+ * @param keyHex
+ * @param password
+ * @param usingPassword
+ * @return
+ */
private String getKeyInternal(TextDevice device = TextDevices.defaultTextDevice(), String keyHex, String password, boolean usingPassword) {
if (usingPassword) {
if (!password) {
@@ -527,7 +529,7 @@ class ConfigEncryptionTool {
}
private String getMigrationKey() {
- return getKeyInternal(TextDevices.defaultTextDevice(), migrationKeyHex, migrationPassword, usingPasswordMigration)
+ return getKeyInternal(TextDevices.defaultTextDevice(), migrationKeyHex, migrationPassword, usingPasswordMigration)
}
private static String getFlowPassword(TextDevice textDevice = TextDevices.defaultTextDevice()) {
@@ -874,7 +876,7 @@ class ConfigEncryptionTool {
AESSensitivePropertyProvider sensitivePropertyProvider = new AESSensitivePropertyProvider(existingKeyHex)
try {
- def doc = new XmlSlurper().parseText(encryptedXml)
+ def doc = getXmlSlurper().parseText(encryptedXml)
// Find the provider element by class even if it has been renamed
def passwords = doc.provider.find { it.'class' as String == LDAP_PROVIDER_CLASS }.property.findAll {
it.@name =~ "Password" && it.@encryption =~ "aes/gcm/\\d{3}"
@@ -910,7 +912,8 @@ class ConfigEncryptionTool {
AESSensitivePropertyProvider sensitivePropertyProvider = new AESSensitivePropertyProvider(existingKeyHex)
try {
- def doc = new XmlSlurper().parseText(encryptedXml)
+ def filename = "authorizers.xml"
+ def doc = getXmlSlurper().parseText(encryptedXml)
// Find the provider element by class even if it has been renamed
def passwords = doc.userGroupProvider.find {
it.'class' as String == LDAP_USER_GROUP_PROVIDER_CLASS
@@ -920,7 +923,7 @@ class ConfigEncryptionTool {
if (passwords.isEmpty()) {
if (isVerbose) {
- logger.info("No encrypted password property elements found in authorizers.xml")
+ logger.info("No encrypted password property elements found in ${filename}")
}
return encryptedXml
}
@@ -938,7 +941,9 @@ class ConfigEncryptionTool {
// Does not preserve whitespace formatting or comments
String updatedXml = XmlUtil.serialize(doc)
- logger.info("Updated XML content: ${updatedXml}")
+ if (isVerbose) {
+ logger.info("Updated XML content: ${updatedXml}")
+ }
updatedXml
} catch (Exception e) {
printUsageAndThrow("Cannot decrypt authorizers XML content", ExitCode.SERVICE_ERROR)
@@ -950,7 +955,7 @@ class ConfigEncryptionTool {
// TODO: Switch to XmlParser & XmlNodePrinter to maintain "empty" element structure
try {
- def doc = new XmlSlurper().parseText(plainXml)
+ def doc = getXmlSlurper().parseText(plainXml)
// Find the provider element by class even if it has been renamed
def passwords = doc.provider.find { it.'class' as String == LDAP_PROVIDER_CLASS }
.property.findAll {
@@ -992,7 +997,8 @@ class ConfigEncryptionTool {
// TODO: Switch to XmlParser & XmlNodePrinter to maintain "empty" element structure
try {
- def doc = new XmlSlurper().parseText(plainXml)
+ def filename = "authorizers.xml"
+ def doc = getXmlSlurper().parseText(plainXml)
// Find the provider element by class even if it has been renamed
def passwords = doc.userGroupProvider.find { it.'class' as String == LDAP_USER_GROUP_PROVIDER_CLASS }
.property.findAll {
@@ -1002,7 +1008,7 @@ class ConfigEncryptionTool {
if (passwords.isEmpty()) {
if (isVerbose) {
- logger.info("No unencrypted password property elements found in authorizers.xml")
+ logger.info("No unencrypted password property elements found in ${filename}")
}
return plainXml
}
@@ -1019,7 +1025,9 @@ class ConfigEncryptionTool {
// Does not preserve whitespace formatting or comments
String updatedXml = XmlUtil.serialize(doc)
- logger.info("Updated XML content: ${updatedXml}")
+ if (isVerbose) {
+ logger.info("Updated XML content: ${updatedXml}")
+ }
updatedXml
} catch (Exception e) {
if (isVerbose) {
@@ -1089,6 +1097,16 @@ class ConfigEncryptionTool {
}
/**
+ * Returns the XML fragment serialized from the {@code GPathResult} without the leading XML declaration.
+ *
+ * @param gPathResult the XML node
+ * @return serialized XML without an inserted header declaration
+ */
+ static String serializeXMLFragment(GPathResult gPathResult) {
+ XmlUtil.serialize(gPathResult).replaceFirst(XML_DECLARATION_REGEX, '')
+ }
+
+ /**
* Reads the existing {@code bootstrap.conf} file, updates it to contain the master key, and persists it back to the same location.
*
* @throw IOException if there is a problem reading or writing the bootstrap.conf file
@@ -1298,13 +1316,11 @@ class ConfigEncryptionTool {
// Find the provider element of the new XML in the file contents
String fileContents = originalLoginIdentityProvidersFile.text
try {
- def parsedXml = new XmlSlurper().parseText(xmlContent)
+ def parsedXml = getXmlSlurper().parseText(xmlContent)
def provider = parsedXml.provider.find { it.'class' as String == LDAP_PROVIDER_CLASS }
if (provider) {
- def serializedProvider = new XmlUtil().serialize(provider)
- // Remove XML declaration from top
- serializedProvider = serializedProvider.replaceFirst(XML_DECLARATION_REGEX, "")
- fileContents = fileContents.replaceFirst(LDAP_PROVIDER_REGEX, serializedProvider)
+ def serializedProvider = serializeXMLFragment(provider)
+ fileContents = fileContents.replaceFirst(LDAP_PROVIDER_REGEX, Matcher.quoteReplacement(serializedProvider))
return fileContents.split("\n")
} else {
throw new SAXException("No ldap-provider element found")
@@ -1320,13 +1336,11 @@ class ConfigEncryptionTool {
// Find the provider element of the new XML in the file contents
String fileContents = originalAuthorizersFile.text
try {
- def parsedXml = new XmlSlurper().parseText(xmlContent)
+ def parsedXml = getXmlSlurper().parseText(xmlContent)
def provider = parsedXml.userGroupProvider.find { it.'class' as String == LDAP_USER_GROUP_PROVIDER_CLASS }
if (provider) {
- def serializedProvider = new XmlUtil().serialize(provider)
- // Remove XML declaration from top
- serializedProvider = serializedProvider.replaceFirst(XML_DECLARATION_REGEX, "")
- fileContents = fileContents.replaceFirst(LDAP_USER_GROUP_PROVIDER_REGEX, serializedProvider)
+ def serializedProvider = serializeXMLFragment(provider)
+ fileContents = fileContents.replaceFirst(LDAP_USER_GROUP_PROVIDER_REGEX, Matcher.quoteReplacement(serializedProvider))
return fileContents.split("\n")
} else {
throw new SAXException("No ldap-user-group-provider element found")
@@ -1404,6 +1418,17 @@ class ConfigEncryptionTool {
}
/**
+ * Returns an {@link XmlSlurper} which is configured to maintain ignorable whitespace.
+ *
+ * @return a configured XmlSlurper
+ */
+ static XmlSlurper getXmlSlurper() {
+ XmlSlurper xs = new XmlSlurper()
+ xs.setKeepIgnorableWhitespace(true)
+ xs
+ }
+
+ /**
* Runs main tool logic (parsing arguments, reading files, protecting properties, and writing key and properties out to destination files).
*
* @param args the command-line arguments
http://git-wip-us.apache.org/repos/asf/nifi/blob/8996b7f6/nifi-toolkit/nifi-toolkit-encrypt-config/src/test/groovy/org/apache/nifi/properties/ConfigEncryptionToolTest.groovy
----------------------------------------------------------------------
diff --git a/nifi-toolkit/nifi-toolkit-encrypt-config/src/test/groovy/org/apache/nifi/properties/ConfigEncryptionToolTest.groovy b/nifi-toolkit/nifi-toolkit-encrypt-config/src/test/groovy/org/apache/nifi/properties/ConfigEncryptionToolTest.groovy
index b6bc722..e2d1ec1 100644
--- a/nifi-toolkit/nifi-toolkit-encrypt-config/src/test/groovy/org/apache/nifi/properties/ConfigEncryptionToolTest.groovy
+++ b/nifi-toolkit/nifi-toolkit-encrypt-config/src/test/groovy/org/apache/nifi/properties/ConfigEncryptionToolTest.groovy
@@ -43,6 +43,10 @@ import org.junit.runner.RunWith
import org.junit.runners.JUnit4
import org.slf4j.Logger
import org.slf4j.LoggerFactory
+import org.xmlunit.builder.DiffBuilder
+import org.xmlunit.diff.DefaultNodeMatcher
+import org.xmlunit.diff.Diff
+import org.xmlunit.diff.ElementSelectors
import javax.crypto.Cipher
import javax.crypto.SecretKey
@@ -644,8 +648,8 @@ class ConfigEncryptionToolTest extends GroovyTestCase {
// Arrange
Map<String, String> keyValues = [
(KEY_HEX) : KEY_HEX,
- " ${KEY_HEX} " : KEY_HEX,
- "xxx${KEY_HEX}zzz" : KEY_HEX,
+ (" ${KEY_HEX} " as String) : KEY_HEX,
+ ("xxx${KEY_HEX}zzz" as String) : KEY_HEX,
((["0123", "4567"] * 4).join("-")): "01234567" * 4,
((["89ab", "cdef"] * 4).join(" ")): "89ABCDEF" * 4,
(KEY_HEX.toLowerCase()) : KEY_HEX,
@@ -2455,6 +2459,33 @@ class ConfigEncryptionToolTest extends GroovyTestCase {
}
@Test
+ void testSerializeLoginIdentityProvidersAndPreserveFormatShouldHandleComplexProperty() {
+ // Arrange
+ String providersPath = "src/test/resources/login-identity-providers-populated-complex-filter.xml"
+ File providersFile = new File(providersPath)
+
+ File tmpDir = setupTmpDir()
+
+ File workingFile = new File("target/tmp/tmp-providers.xml")
+ workingFile.delete()
+ Files.copy(providersFile.toPath(), workingFile.toPath())
+ ConfigEncryptionTool tool = new ConfigEncryptionTool()
+ tool.isVerbose = true
+
+ tool.keyHex = KEY_HEX
+
+ def lines = workingFile.readLines()
+ logger.info("Read lines: \n${lines.join("\n")}")
+
+ // Act
+ def serializedLines = ConfigEncryptionTool.serializeLoginIdentityProvidersAndPreserveFormat(lines.join("\n"), workingFile)
+ logger.info("Serialized lines: \n${serializedLines.join("\n")}")
+
+ // Assert
+ assert compareXMLFragments(lines.join("\n"), serializedLines.join("\n"))
+ }
+
+ @Test
void testWriteLoginIdentityProvidersShouldHandleUnreadableFile() {
// Arrange
String providersPath = "src/test/resources/login-identity-providers-populated.xml"
@@ -3200,6 +3231,33 @@ class ConfigEncryptionToolTest extends GroovyTestCase {
}
@Test
+ void testSerializeAuthorizersAndPreserveFormatShouldHandleComplexProperty() {
+ // Arrange
+ String authorizersPath = "src/test/resources/authorizers-populated-complex-filter.xml"
+ File authorizersFile = new File(authorizersPath)
+
+ File tmpDir = setupTmpDir()
+
+ File workingFile = new File("target/tmp/tmp-authorizers.xml")
+ workingFile.delete()
+ Files.copy(authorizersFile.toPath(), workingFile.toPath())
+ ConfigEncryptionTool tool = new ConfigEncryptionTool()
+ tool.isVerbose = true
+
+ tool.keyHex = KEY_HEX
+
+ def lines = workingFile.readLines()
+ logger.info("Read lines: \n${lines.join("\n")}")
+
+ // Act
+ def serializedLines = ConfigEncryptionTool.serializeAuthorizersAndPreserveFormat(lines.join("\n"), workingFile)
+ logger.info("Serialized lines: \n${serializedLines.join("\n")}")
+
+ // Assert
+ assert compareXMLFragments(lines.join("\n"), serializedLines.join("\n"))
+ }
+
+ @Test
void testShouldPerformFullOperationForAuthorizers() {
// Arrange
exit.expectSystemExitWithStatus(0)
@@ -3362,6 +3420,87 @@ class ConfigEncryptionToolTest extends GroovyTestCase {
}
@Test
+ void testShouldPerformFullOperationForAuthorizersWithComplexUserSearchFilter() {
+ // Arrange
+ exit.expectSystemExitWithStatus(0)
+
+ File tmpDir = setupTmpDir()
+
+ File emptyKeyFile = new File("src/test/resources/bootstrap_with_empty_master_key.conf")
+ File bootstrapFile = new File("target/tmp/tmp_bootstrap.conf")
+ bootstrapFile.delete()
+
+ Files.copy(emptyKeyFile.toPath(), bootstrapFile.toPath())
+ final List<String> originalBootstrapLines = bootstrapFile.readLines()
+ String originalKeyLine = originalBootstrapLines.find {
+ it.startsWith(ConfigEncryptionTool.BOOTSTRAP_KEY_PREFIX)
+ }
+ logger.info("Original key line from bootstrap.conf: ${originalKeyLine}")
+ assert originalKeyLine == ConfigEncryptionTool.BOOTSTRAP_KEY_PREFIX
+
+ final String EXPECTED_KEY_LINE = ConfigEncryptionTool.BOOTSTRAP_KEY_PREFIX + KEY_HEX
+
+ File inputAuthorizersFile = new File("src/test/resources/authorizers-populated-complex-filter.xml")
+ File outputAuthorizersFile = new File("target/tmp/tmp-authorizers.xml")
+ outputAuthorizersFile.delete()
+
+ String originalXmlContent = inputAuthorizersFile.text
+ logger.info("Original XML content: ${originalXmlContent}")
+
+ String[] args = ["-a", inputAuthorizersFile.path, "-b", bootstrapFile.path, "-u", outputAuthorizersFile.path, "-k", KEY_HEX, "-v"]
+
+ AESSensitivePropertyProvider spp = new AESSensitivePropertyProvider(KEY_HEX)
+
+ exit.checkAssertionAfterwards(new Assertion() {
+ void checkAssertion() {
+ final String updatedXmlContent = outputAuthorizersFile.text
+ logger.info("Updated XML content: ${updatedXmlContent}")
+
+ // Check that the output values for sensitive properties are not the same as the original (i.e. it was encrypted)
+ def originalParsedXml = new XmlSlurper().parseText(originalXmlContent)
+ def updatedParsedXml = new XmlSlurper().parseText(updatedXmlContent)
+ assert originalParsedXml != updatedParsedXml
+ assert originalParsedXml.'**'.findAll { it.@encryption } != updatedParsedXml.'**'.findAll {
+ it.@encryption
+ }
+
+ def encryptedValues = updatedParsedXml.userGroupProvider.find {
+ it.identifier == 'ldap-user-group-provider'
+ }.property.findAll {
+ it.@name =~ "Password" && it.@encryption =~ "aes/gcm/\\d{3}"
+ }
+
+ encryptedValues.each {
+ assert spp.unprotect(it.text()) == PASSWORD
+ }
+
+ // Check that the key was persisted to the bootstrap.conf
+ final List<String> updatedBootstrapLines = bootstrapFile.readLines()
+ String updatedKeyLine = updatedBootstrapLines.find {
+ it.startsWith(ConfigEncryptionTool.BOOTSTRAP_KEY_PREFIX)
+ }
+ logger.info("Updated key line: ${updatedKeyLine}")
+
+ assert updatedKeyLine == EXPECTED_KEY_LINE
+ assert originalBootstrapLines.size() == updatedBootstrapLines.size()
+
+ // Clean up
+ outputAuthorizersFile.deleteOnExit()
+ bootstrapFile.deleteOnExit()
+ tmpDir.deleteOnExit()
+ }
+ })
+
+ // Act
+ ConfigEncryptionTool.main(args)
+ logger.info("Invoked #main with ${args.join(" ")}")
+
+ // Assert
+
+ // Assertions defined above
+ }
+
+ @Test
void testShouldPerformFullOperationForNiFiPropertiesAndLoginIdentityProvidersAndAuthorizers() {
// Arrange
exit.expectSystemExitWithStatus(0)
@@ -4920,6 +5059,19 @@ class ConfigEncryptionToolTest extends GroovyTestCase {
}
}
+ static boolean compareXMLFragments(String expectedXML, String actualXML) {
+ Diff diffSimilar = DiffBuilder.compare(expectedXML).withTest(actualXML)
+ .withNodeMatcher(new DefaultNodeMatcher(ElementSelectors.byName))
+ .ignoreWhitespace().checkForSimilar().build()
+ def allDifferences = diffSimilar.getDifferences()
+ if (diffSimilar.hasDifferences()) {
+ allDifferences.each { diff ->
+ logger.info("Difference: ${diff.toString()}")
+ }
+ }
+ !diffSimilar.hasDifferences()
+ }
+
// TODO: Test with 128/256-bit available
}
http://git-wip-us.apache.org/repos/asf/nifi/blob/8996b7f6/nifi-toolkit/nifi-toolkit-encrypt-config/src/test/resources/authorizers-populated-complex-filter.xml
----------------------------------------------------------------------
diff --git a/nifi-toolkit/nifi-toolkit-encrypt-config/src/test/resources/authorizers-populated-complex-filter.xml b/nifi-toolkit/nifi-toolkit-encrypt-config/src/test/resources/authorizers-populated-complex-filter.xml
new file mode 100644
index 0000000..79e7eaf
--- /dev/null
+++ b/nifi-toolkit/nifi-toolkit-encrypt-config/src/test/resources/authorizers-populated-complex-filter.xml
@@ -0,0 +1,309 @@
+<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one or more
+ contributor license agreements. See the NOTICE file distributed with
+ this work for additional information regarding copyright ownership.
+ The ASF licenses this file to You under the Apache License, Version 2.0
+ (the "License"); you may not use this file except in compliance with
+ the License. You may obtain a copy of the License at
+ http://www.apache.org/licenses/LICENSE-2.0
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+-->
+<!--
+ This file lists the userGroupProviders, accessPolicyProviders, and authorizers to use when running securely. In order
+ to use a specific authorizer it must be configured here and it's identifier must be specified in the nifi.properties file.
+ If the authorizer is a managedAuthorizer, it may need to be configured with an accessPolicyProvider and an userGroupProvider.
+ This file allows for configuration of them, but they must be configured in order:
+
+ ...
+ all userGroupProviders
+ all accessPolicyProviders
+ all Authorizers
+ ...
+-->
+<authorizers>
+
+ <!--
+ The FileUserGroupProvider will provide support for managing users and groups which is backed by a file
+ on the local file system.
+
+ - Users File - The file where the FileUserGroupProvider will store users and groups.
+
+ - Legacy Authorized Users File - The full path to an existing authorized-users.xml that will be automatically
+ be used to load the users and groups into the Users File.
+
+ - Initial User Identity [unique key] - The identity of a users and systems to seed the Users File. The name of
+ each property must be unique, for example: "Initial User Identity A", "Initial User Identity B",
+ "Initial User Identity C" or "Initial User Identity 1", "Initial User Identity 2", "Initial User Identity 3"
+
+ NOTE: Any identity mapping rules specified in nifi.properties will also be applied to the user identities,
+ so the values should be the unmapped identities (i.e. full DN from a certificate).
+ -->
+ <!--
+ <userGroupProvider>
+ <identifier>file-user-group-provider</identifier>
+ <class>org.apache.nifi.authorization.FileUserGroupProvider</class>
+ <property name="Users File">./conf/users.xml</property>
+ <property name="Legacy Authorized Users File"></property>
+
+ <property name="Initial User Identity 1"></property>
+ </userGroupProvider>
+ -->
+
+ <!--
+ The LdapUserGroupProvider will retrieve users and groups from an LDAP server. The users and groups
+ are not configurable.
+
+ 'Authentication Strategy' - How the connection to the LDAP server is authenticated. Possible
+ values are ANONYMOUS, SIMPLE, LDAPS, or START_TLS.
+
+ 'Manager DN' - The DN of the manager that is used to bind to the LDAP server to search for users.
+ 'Manager Password' - The password of the manager that is used to bind to the LDAP server to
+ search for users.
+
+ 'TLS - Keystore' - Path to the Keystore that is used when connecting to LDAP using LDAPS or START_TLS.
+ 'TLS - Keystore Password' - Password for the Keystore that is used when connecting to LDAP
+ using LDAPS or START_TLS.
+ 'TLS - Keystore Type' - Type of the Keystore that is used when connecting to LDAP using
+ LDAPS or START_TLS (i.e. JKS or PKCS12).
+ 'TLS - Truststore' - Path to the Truststore that is used when connecting to LDAP using LDAPS or START_TLS.
+ 'TLS - Truststore Password' - Password for the Truststore that is used when connecting to
+ LDAP using LDAPS or START_TLS.
+ 'TLS - Truststore Type' - Type of the Truststore that is used when connecting to LDAP using
+ LDAPS or START_TLS (i.e. JKS or PKCS12).
+ 'TLS - Client Auth' - Client authentication policy when connecting to LDAP using LDAPS or START_TLS.
+ Possible values are REQUIRED, WANT, NONE.
+ 'TLS - Protocol' - Protocol to use when connecting to LDAP using LDAPS or START_TLS. (i.e. TLS,
+ TLSv1.1, TLSv1.2, etc).
+ 'TLS - Shutdown Gracefully' - Specifies whether the TLS should be shut down gracefully
+ before the target context is closed. Defaults to false.
+
+ 'Referral Strategy' - Strategy for handling referrals. Possible values are FOLLOW, IGNORE, THROW.
+ 'Connect Timeout' - Duration of connect timeout. (i.e. 10 secs).
+ 'Read Timeout' - Duration of read timeout. (i.e. 10 secs).
+
+ 'Url' - Space-separated list of URLs of the LDAP servers (i.e. ldap://<hostname>:<port>).
+ 'Page Size' - Sets the page size when retrieving users and groups. If not specified, no paging is performed.
+ 'Sync Interval' - Duration of time between syncing users and groups (i.e. 30 mins). Minimum allowable value is 10 secs.
+
+ 'User Search Base' - Base DN for searching for users (i.e. ou=users,o=nifi). Required to search users.
+ 'User Object Class' - Object class for identifying users (i.e. person). Required if searching users.
+ 'User Search Scope' - Search scope for searching users (ONE_LEVEL, OBJECT, or SUBTREE). Required if searching users.
+ 'User Search Filter' - Filter for searching for users against the 'User Search Base' (i.e. (memberof=cn=team1,ou=groups,o=nifi) ). Optional.
+ 'User Identity Attribute' - Attribute to use to extract user identity (i.e. cn). Optional. If not set, the entire DN is used.
+ 'User Group Name Attribute' - Attribute to use to define group membership (i.e. memberof). Optional. If not set
+ group membership will not be calculated through the users. Will rely on group membership being defined
+ through 'Group Member Attribute' if set. The value of this property is the name of the attribute in the user ldap entry that
+ associates them with a group. The value of that user attribute could be a dn or group name for instance. What value is expected
+ is configured in the 'User Group Name Attribute - Referenced Group Attribute'.
+ 'User Group Name Attribute - Referenced Group Attribute' - If blank, the value of the attribute defined in 'User Group Name Attribute'
+ is expected to be the full dn of the group. If not blank, this property will define the attribute of the group ldap entry that
+ the value of the attribute defined in 'User Group Name Attribute' is referencing (i.e. name). Use of this property requires that
+ 'Group Search Base' is also configured.
+
+ 'Group Search Base' - Base DN for searching for groups (i.e. ou=groups,o=nifi). Required to search groups.
+ 'Group Object Class' - Object class for identifying groups (i.e. groupOfNames). Required if searching groups.
+ 'Group Search Scope' - Search scope for searching groups (ONE_LEVEL, OBJECT, or SUBTREE). Required if searching groups.
+ 'Group Search Filter' - Filter for searching for groups against the 'Group Search Base'. Optional.
+ 'Group Name Attribute' - Attribute to use to extract group name (i.e. cn). Optional. If not set, the entire DN is used.
+ 'Group Member Attribute' - Attribute to use to define group membership (i.e. member). Optional. If not set
+ group membership will not be calculated through the groups. Will rely on group membership being defined
+ through 'User Group Name Attribute' if set. The value of this property is the name of the attribute in the group ldap entry that
+ associates them with a user. The value of that group attribute could be a dn or memberUid for instance. What value is expected
+ is configured in the 'Group Member Attribute - Referenced User Attribute'. (i.e. member: cn=User 1,ou=users,o=nifi vs. memberUid: user1)
+ 'Group Member Attribute - Referenced User Attribute' - If blank, the value of the attribute defined in 'Group Member Attribute'
+ is expected to be the full dn of the user. If not blank, this property will define the attribute of the user ldap entry that
+ the value of the attribute defined in 'Group Member Attribute' is referencing (i.e. uid). Use of this property requires that
+ 'User Search Base' is also configured. (i.e. member: cn=User 1,ou=users,o=nifi vs. memberUid: user1)
+
+ NOTE: Any identity mapping rules specified in nifi.properties will also be applied to the user identities.
+ Group names are not mapped.
+ -->
+ <userGroupProvider>
+ <identifier>ldap-user-group-provider</identifier>
+ <class>org.apache.nifi.ldap.tenants.LdapUserGroupProvider</class>
+ <property name="Authentication Strategy">START_TLS</property>
+
+ <property name="Manager DN">someuser</property>
+ <property name="Manager Password">thisIsABadPassword</property>
+
+ <property name="TLS - Keystore"></property>
+ <property name="TLS - Keystore Password">thisIsABadPassword</property>
+ <property name="TLS - Keystore Type"></property>
+ <property name="TLS - Truststore"></property>
+ <property name="TLS - Truststore Password">thisIsABadPassword</property>
+ <property name="TLS - Truststore Type"></property>
+ <property name="TLS - Client Auth"></property>
+ <property name="TLS - Protocol"></property>
+ <property name="TLS - Shutdown Gracefully"></property>
+
+ <property name="Referral Strategy">FOLLOW</property>
+ <property name="Connect Timeout">10 secs</property>
+ <property name="Read Timeout">10 secs</property>
+
+ <property name="Url"></property>
+ <property name="Page Size"></property>
+ <property name="Sync Interval">30 mins</property>
+
+ <property name="User Search Base"></property>
+ <property name="User Object Class">person</property>
+ <property name="User Search Scope">ONE_LEVEL</property>
+ <property name="User Search Filter">(& (objectCategory=Person)(sAMAccountName=*)(!(UserAccountControl:1.2.840.113556.1.4.803:=2))(!(sAMAccountName=$*)))</property>
+ <property name="User Identity Attribute"></property>
+ <property name="User Group Name Attribute"></property>
+ <property name="User Group Name Attribute - Referenced Group Attribute"></property>
+
+ <property name="Group Search Base"></property>
+ <property name="Group Object Class">group</property>
+ <property name="Group Search Scope">ONE_LEVEL</property>
+ <property name="Group Search Filter">(& (objectCategory=Person)(sAMAccountName=*)(!(UserAccountControl:1.2.840.113556.1.4.803:=2))(!(sAMAccountName=$*)))</property>
+ <property name="Group Name Attribute"></property>
+ <property name="Group Member Attribute"></property>
+ <property name="Group Member Attribute - Referenced User Attribute"></property>
+ </userGroupProvider>
+
+ <!--
+ The CompositeUserGroupProvider will provide support for retrieving users and groups from multiple sources.
+
+ - User Group Provider [unique key] - The identifier of user group providers to load from. The name of
+ each property must be unique, for example: "User Group Provider A", "User Group Provider B",
+ "User Group Provider C" or "User Group Provider 1", "User Group Provider 2", "User Group Provider 3"
+
+ NOTE: Any identity mapping rules specified in nifi.properties are not applied in this implementation. This behavior
+ would need to be applied by the base implementation.
+ -->
+ <!-- To enable the composite-user-group-provider remove 2 lines. This is 1 of 2.
+ <userGroupProvider>
+ <identifier>composite-user-group-provider</identifier>
+ <class>org.apache.nifi.authorization.CompositeUserGroupProvider</class>
+ <property name="User Group Provider 1"></property>
+ </userGroupProvider>
+ To enable the composite-user-group-provider remove 2 lines. This is 2 of 2. -->
+
+ <!--
+ The CompositeConfigurableUserGroupProvider will provide support for retrieving users and groups from multiple sources.
+ Additionally, a single configurable user group provider is required. Users from the configurable user group provider
+ are configurable, however users loaded from one of the User Group Provider [unique key] will not be.
+
+ - Configurable User Group Provider - A configurable user group provider.
+
+ - User Group Provider [unique key] - The identifier of user group providers to load from. The name of
+ each property must be unique, for example: "User Group Provider A", "User Group Provider B",
+ "User Group Provider C" or "User Group Provider 1", "User Group Provider 2", "User Group Provider 3"
+
+ NOTE: Any identity mapping rules specified in nifi.properties are not applied in this implementation. This behavior
+ would need to be applied by the base implementation.
+ -->
+ <!-- To enable the composite-configurable-user-group-provider remove 2 lines. This is 1 of 2.
+ <userGroupProvider>
+ <identifier>composite-configurable-user-group-provider</identifier>
+ <class>org.apache.nifi.authorization.CompositeConfigurableUserGroupProvider</class>
+ <property name="Configurable User Group Provider">file-user-group-provider</property>
+ <property name="User Group Provider 1"></property>
+ </userGroupProvider>
+ To enable the composite-configurable-user-group-provider remove 2 lines. This is 2 of 2. -->
+
+ <!--
+ The FileAccessPolicyProvider will provide support for managing access policies which is backed by a file
+ on the local file system.
+
+ - User Group Provider - The identifier for an User Group Provider defined above that will be used to access
+ users and groups for use in the managed access policies.
+
+ - Authorizations File - The file where the FileAccessPolicyProvider will store policies.
+
+ - Initial Admin Identity - The identity of an initial admin user that will be granted access to the UI and
+ given the ability to create additional users, groups, and policies. The value of this property could be
+ a DN when using certificates or LDAP, or a Kerberos principal. This property will only be used when there
+ are no other policies defined. If this property is specified then a Legacy Authorized Users File can not be specified.
+
+ NOTE: Any identity mapping rules specified in nifi.properties will also be applied to the initial admin identity,
+ so the value should be the unmapped identity. This identity must be found in the configured User Group Provider.
+
+ - Legacy Authorized Users File - The full path to an existing authorized-users.xml that will be automatically
+ converted to the new authorizations model. If this property is specified then an Initial Admin Identity can
+ not be specified, and this property will only be used when there are no other users, groups, and policies defined.
+
+ NOTE: Any users in the legacy users file must be found in the configured User Group Provider.
+
+ - Node Identity [unique key] - The identity of a NiFi cluster node. When clustered, a property for each node
+ should be defined, so that every node knows about every other node. If not clustered these properties can be ignored.
+ The name of each property must be unique, for example for a three node cluster:
+ "Node Identity A", "Node Identity B", "Node Identity C" or "Node Identity 1", "Node Identity 2", "Node Identity 3"
+
+ NOTE: Any identity mapping rules specified in nifi.properties will also be applied to the node identities,
+ so the values should be the unmapped identities (i.e. full DN from a certificate). This identity must be found
+ in the configured User Group Provider.
+ -->
+ <accessPolicyProvider>
+ <identifier>file-access-policy-provider</identifier>
+ <class>org.apache.nifi.authorization.FileAccessPolicyProvider</class>
+ <property name="User Group Provider">ldap-user-group-provider</property>
+ <property name="Authorizations File">./conf/authorizations.xml</property>
+ <property name="Initial Admin Identity"></property>
+ <property name="Legacy Authorized Users File"></property>
+
+ <property name="Node Identity 1"></property>
+ </accessPolicyProvider>
+
+ <!--
+ The StandardManagedAuthorizer. This authorizer implementation must be configured with the
+ Access Policy Provider which it will use to access and manage users, groups, and policies.
+ These users, groups, and policies will be used to make all access decisions during authorization
+ requests.
+
+ - Access Policy Provider - The identifier for an Access Policy Provider defined above.
+ -->
+ <authorizer>
+ <identifier>managed-authorizer</identifier>
+ <class>org.apache.nifi.authorization.StandardManagedAuthorizer</class>
+ <property name="Access Policy Provider">file-access-policy-provider</property>
+ </authorizer>
+
+ <!--
+ NOTE: This Authorizer has been replaced with the more granular approach configured above with the Standard
+ Managed Authorizer. However, it is still available for backwards compatibility reasons.
+
+ The FileAuthorizer is NiFi's provided authorizer and has the following properties:
+
+ - Authorizations File - The file where the FileAuthorizer will store policies.
+
+ - Users File - The file where the FileAuthorizer will store users and groups.
+
+ - Initial Admin Identity - The identity of an initial admin user that will be granted access to the UI and
+ given the ability to create additional users, groups, and policies. The value of this property could be
+ a DN when using certificates or LDAP, or a Kerberos principal. This property will only be used when there
+ are no other users, groups, and policies defined. If this property is specified then a Legacy Authorized
+ Users File can not be specified.
+
+ NOTE: Any identity mapping rules specified in nifi.properties will also be applied to the initial admin identity,
+ so the value should be the unmapped identity.
+
+ - Legacy Authorized Users File - The full path to an existing authorized-users.xml that will be automatically
+ converted to the new authorizations model. If this property is specified then an Initial Admin Identity can
+ not be specified, and this property will only be used when there are no other users, groups, and policies defined.
+
+ - Node Identity [unique key] - The identity of a NiFi cluster node. When clustered, a property for each node
+ should be defined, so that every node knows about every other node. If not clustered these properties can be ignored.
+ The name of each property must be unique, for example for a three node cluster:
+ "Node Identity A", "Node Identity B", "Node Identity C" or "Node Identity 1", "Node Identity 2", "Node Identity 3"
+
+ NOTE: Any identity mapping rules specified in nifi.properties will also be applied to the node identities,
+ so the values should be the unmapped identities (i.e. full DN from a certificate).
+ -->
+ <!-- <authorizer>
+ <identifier>file-provider</identifier>
+ <class>org.apache.nifi.authorization.FileAuthorizer</class>
+ <property name="Authorizations File">./conf/authorizations.xml</property>
+ <property name="Users File">./conf/users.xml</property>
+ <property name="Initial Admin Identity"></property>
+ <property name="Legacy Authorized Users File"></property>
+
+ <property name="Node Identity 1"></property>
+ </authorizer>
+ -->
+</authorizers>
\ No newline at end of file
http://git-wip-us.apache.org/repos/asf/nifi/blob/8996b7f6/nifi-toolkit/nifi-toolkit-encrypt-config/src/test/resources/login-identity-providers-populated-complex-filter.xml
----------------------------------------------------------------------
diff --git a/nifi-toolkit/nifi-toolkit-encrypt-config/src/test/resources/login-identity-providers-populated-complex-filter.xml b/nifi-toolkit/nifi-toolkit-encrypt-config/src/test/resources/login-identity-providers-populated-complex-filter.xml
new file mode 100644
index 0000000..b9ba74d
--- /dev/null
+++ b/nifi-toolkit/nifi-toolkit-encrypt-config/src/test/resources/login-identity-providers-populated-complex-filter.xml
@@ -0,0 +1,105 @@
+<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one or more
+ contributor license agreements. See the NOTICE file distributed with
+ this work for additional information regarding copyright ownership.
+ The ASF licenses this file to You under the Apache License, Version 2.0
+ (the "License"); you may not use this file except in compliance with
+ the License. You may obtain a copy of the License at
+ http://www.apache.org/licenses/LICENSE-2.0
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+-->
+<!--
+ This file lists the login identity providers to use when running securely. In order
+ to use a specific provider it must be configured here and it's identifier
+ must be specified in the nifi.properties file.
+-->
+<loginIdentityProviders>
+ <!--
+ Identity Provider for users logging in with username/password against an LDAP server.
+
+ 'Authentication Strategy' - How the connection to the LDAP server is authenticated. Possible
+ values are ANONYMOUS, SIMPLE, or START_TLS.
+
+ 'Manager DN' - The DN of the manager that is used to bind to the LDAP server to search for users.
+ 'Manager Password' - The password of the manager that is used to bind to the LDAP server to
+ search for users.
+
+ 'TLS - Keystore' - Path to the Keystore that is used when connecting to LDAP using START_TLS.
+ 'TLS - Keystore Password' - Password for the Keystore that is used when connecting to LDAP
+ using START_TLS.
+ 'TLS - Keystore Type' - Type of the Keystore that is used when connecting to LDAP using
+ START_TLS (i.e. JKS or PKCS12).
+ 'TLS - Truststore' - Path to the Truststore that is used when connecting to LDAP using START_TLS.
+ 'TLS - Truststore Password' - Password for the Truststore that is used when connecting to
+ LDAP using START_TLS.
+ 'TLS - Truststore Type' - Type of the Truststore that is used when connecting to LDAP using
+ START_TLS (i.e. JKS or PKCS12).
+ 'TLS - Client Auth' - Client authentication policy when connecting to LDAP using START_TLS.
+ Possible values are REQUIRED, WANT, NONE.
+ 'TLS - Protocol' - Protocol to use when connecting to LDAP using START_TLS. (i.e. TLS,
+ TLSv1.1, TLSv1.2, etc).
+ 'TLS - Shutdown Gracefully' - Specifies whether the TLS should be shut down gracefully
+ before the target context is closed. Defaults to false.
+
+ 'Referral Strategy' - Strategy for handling referrals. Possible values are FOLLOW, IGNORE, THROW.
+ 'Connect Timeout' - Duration of connect timeout. (i.e. 10 secs).
+ 'Read Timeout' - Duration of read timeout. (i.e. 10 secs).
+
+ 'Url' - Url of the LDAP servier (i.e. ldap://<hostname>:<port>).
+ 'User Search Base' - Base DN for searching for users (i.e. CN=Users,DC=example,DC=com).
+ 'User Search Filter' - Filter for searching for users against the 'User Search Base'.
+ (i.e. sAMAccountName={0}). The user specified name is inserted into '{0}'.
+
+ 'Authentication Expiration' - The duration of how long the user authentication is valid
+ for. If the user never logs out, they will be required to log back in following
+ this duration.
+ -->
+ <provider>
+ <identifier>ldap-provider</identifier>
+ <class>org.apache.nifi.ldap.LdapProvider</class>
+ <property name="Authentication Strategy">START_TLS</property>
+
+ <property name="Manager DN">someuser</property>
+ <property name="Manager Password">thisIsABadPassword</property>
+
+ <property name="TLS - Keystore"></property>
+ <property name="TLS - Keystore Password">thisIsABadPassword</property>
+ <property name="TLS - Keystore Type"></property>
+ <property name="TLS - Truststore"></property>
+ <property name="TLS - Truststore Password">thisIsABadPassword</property>
+ <property name="TLS - Truststore Type"></property>
+ <property name="TLS - Client Auth"></property>
+ <property name="TLS - Protocol"></property>
+ <property name="TLS - Shutdown Gracefully"></property>
+
+ <property name="Referral Strategy">FOLLOW</property>
+ <property name="Connect Timeout">10 secs</property>
+ <property name="Read Timeout">10 secs</property>
+
+ <property name="Url"></property>
+ <property name="User Search Base"></property>
+ <property name="User Search Filter">(& (objectCategory=Person)(sAMAccountName=*)(!(UserAccountControl:1.2.840.113556.1.4.803:=2))(!(sAMAccountName=$*)))</property>
+
+ <property name="Authentication Expiration">12 hours</property>
+ </provider>
+
+ <!--
+ Identity Provider for users logging in with username/password against a Kerberos KDC server.
+
+ 'Default Realm' - Default realm to provide when user enters incomplete user principal (i.e. NIFI.APACHE.ORG).
+ 'Authentication Expiration' - The duration of how long the user authentication is valid for. If the user never logs out, they will be required to log back in following this duration.
+ -->
+ <!-- To enable the kerberos-provider remove 2 lines. This is 1 of 2.
+ <provider>
+ <identifier>kerberos-provider</identifier>
+ <class>org.apache.nifi.kerberos.KerberosProvider</class>
+ <property name="Default Realm">NIFI.APACHE.ORG</property>
+ <property name="Authentication Expiration">12 hours</property>
+ </provider>
+ To enable the kerberos-provider remove 2 lines. This is 2 of 2. -->
+</loginIdentityProviders>
\ No newline at end of file