You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@nifi.apache.org by "nandorsoma (via GitHub)" <gi...@apache.org> on 2023/02/22 16:31:34 UTC
[GitHub] [nifi] nandorsoma opened a new pull request, #6984: NIFI-11206 Make KerberosKeyTabUserService respect NIFI_ALLOW_EXPLICIT_KEYTAB env variable
nandorsoma opened a new pull request, #6984:
URL: https://github.com/apache/nifi/pull/6984
<!-- Licensed to the Apache Software Foundation (ASF) under one or more -->
<!-- contributor license agreements. See the NOTICE file distributed with -->
<!-- this work for additional information regarding copyright ownership. -->
<!-- The ASF licenses this file to You under the Apache License, Version 2.0 -->
<!-- (the "License"); you may not use this file except in compliance with -->
<!-- the License. You may obtain a copy of the License at -->
<!-- http://www.apache.org/licenses/LICENSE-2.0 -->
<!-- Unless required by applicable law or agreed to in writing, software -->
<!-- distributed under the License is distributed on an "AS IS" BASIS, -->
<!-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -->
<!-- See the License for the specific language governing permissions and -->
<!-- limitations under the License. -->
# Summary
[NIFI-11206](https://issues.apache.org/jira/browse/NIFI-11206)
# Tracking
Please complete the following tracking steps prior to pull request creation.
### Issue Tracking
- [x] [Apache NiFi Jira](https://issues.apache.org/jira/browse/NIFI) issue created
### Pull Request Tracking
- [x] Pull Request title starts with Apache NiFi Jira issue number, such as `NIFI-00000`
- [x] Pull Request commit message starts with Apache NiFi Jira issue number, as such `NIFI-00000`
### Pull Request Formatting
- [x] Pull Request based on current revision of the `main` branch
- [x] Pull Request refers to a feature branch with one commit containing changes
# Verification
Please indicate the verification steps performed prior to pull request creation.
### Build
- [x] Build completed using `mvn clean install -P contrib-check`
- [x] JDK 11
- [ ] JDK 17
### Licensing
- [ ] New dependencies are compatible with the [Apache License 2.0](https://apache.org/licenses/LICENSE-2.0) according to the [License Policy](https://www.apache.org/legal/resolved.html)
- [ ] New dependencies are documented in applicable `LICENSE` and `NOTICE` files
### Documentation
- [ ] Documentation formatting appears as expected in rendered files
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@nifi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [nifi] bbende commented on pull request #6984: NIFI-11206 Make KerberosKeyTabUserService respect NIFI_ALLOW_EXPLICIT_KEYTAB env variable
Posted by "bbende (via GitHub)" <gi...@apache.org>.
bbende commented on PR #6984:
URL: https://github.com/apache/nifi/pull/6984#issuecomment-1440395671
Also one more reference point is the description of the env var from nifi-env.sh
```
# Set to false to force the use of Keytab controller service in processors
# that use Kerberos. If true, these processors will allow configuration of keytab
# and principal directly within the processor. If false, these processors will be
# invalid if attempting to configure these properties. This may be advantageous in
# a multi-tenant environment where management of keytabs should be performed only by
# a user with elevated permissions (i.e., users that have been granted the 'ACCESS_KEYTAB'
# restriction).
```
So the idea is if you set `NIFI_ALLOW_EXPLICIT_KEYTAB=false`, then you are forced to use a `KerberosCredentialsService` or `KerberosUserService`, so we can't make those invalid.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@nifi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [nifi] nandorsoma closed pull request #6984: NIFI-11206 Make KerberosKeyTabUserService respect NIFI_ALLOW_EXPLICIT_KEYTAB env variable
Posted by "nandorsoma (via GitHub)" <gi...@apache.org>.
nandorsoma closed pull request #6984: NIFI-11206 Make KerberosKeyTabUserService respect NIFI_ALLOW_EXPLICIT_KEYTAB env variable
URL: https://github.com/apache/nifi/pull/6984
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@nifi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [nifi] bbende commented on pull request #6984: NIFI-11206 Make KerberosKeyTabUserService respect NIFI_ALLOW_EXPLICIT_KEYTAB env variable
Posted by "bbende (via GitHub)" <gi...@apache.org>.
bbende commented on PR #6984:
URL: https://github.com/apache/nifi/pull/6984#issuecomment-1440386873
Hi @nandorsoma , I don't think this is correct to add this to the `KerberosKeytabUserService` because the service is protected by restricted permissions, so if someone wants to protect access to the keytab they can decide who gets access to the service through the restricted permissions. You can see that the original `KeytabCredentialsService` also does not check for `NIFI_ALLOW_EXPLICIT_KEYTAB`.
The case where we need to check the explicit usage of keytabs is when it is directly in a processor property because then there is no separation between the processor and the keytab.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@nifi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [nifi] nandorsoma commented on pull request #6984: NIFI-11206 Make KerberosKeyTabUserService respect NIFI_ALLOW_EXPLICIT_KEYTAB env variable
Posted by "nandorsoma (via GitHub)" <gi...@apache.org>.
nandorsoma commented on PR #6984:
URL: https://github.com/apache/nifi/pull/6984#issuecomment-1440426647
Thank you for the clarification @bbende! Then I will close this PR, and hopefully, we can circle back to removing NIFI_ALLOW_EXPLICIT_KEYTAB soon when we can remove the redundant properties for all processors.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@nifi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org