You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@nifi.apache.org by "exceptionfactory (via GitHub)" <gi...@apache.org> on 2024/07/07 00:29:56 UTC
[PR] NIFI-13510 Remove KerberosCredentialsService and implementations [nifi]
exceptionfactory opened a new pull request, #9058:
URL: https://github.com/apache/nifi/pull/9058
# Summary
[NIFI-13510](https://issues.apache.org/jira/browse/NIFI-13510) Removes the `KerberosCredentialsService` Controller Service interface and associated implementations in favor of the `KerberosUserService` interface introduced in NiFi 1.15.0.
Additional removals include individual component properties for Kerberos Principal and Password values.
# Tracking
Please complete the following tracking steps prior to pull request creation.
### Issue Tracking
- [X] [Apache NiFi Jira](https://issues.apache.org/jira/browse/NIFI) issue created
### Pull Request Tracking
- [X] Pull Request title starts with Apache NiFi Jira issue number, such as `NIFI-00000`
- [X] Pull Request commit message starts with Apache NiFi Jira issue number, as such `NIFI-00000`
### Pull Request Formatting
- [X] Pull Request based on current revision of the `main` branch
- [X] Pull Request refers to a feature branch with one commit containing changes
# Verification
Please indicate the verification steps performed prior to pull request creation.
### Build
- [X] Build completed using `mvn clean install -P contrib-check`
- [X] JDK 21
### Licensing
- [ ] New dependencies are compatible with the [Apache License 2.0](https://apache.org/licenses/LICENSE-2.0) according to the [License Policy](https://www.apache.org/legal/resolved.html)
- [ ] New dependencies are documented in applicable `LICENSE` and `NOTICE` files
### Documentation
- [ ] Documentation formatting appears as expected in rendered files
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@nifi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] NIFI-13510 Remove KerberosCredentialsService and implementations [nifi]
Posted by "exceptionfactory (via GitHub)" <gi...@apache.org>.
exceptionfactory commented on PR #9058:
URL: https://github.com/apache/nifi/pull/9058#issuecomment-2214179828
> @exceptionfactory Thanks for cleaning up the Kerberos config in these components! I think it would also be useful to add migration code for helping the move from the old controller service (or processor level properties) to `KerberosUserService`. Similar to the [proxy propery migraton](https://github.com/apache/nifi/blob/f5476ca3b4eea6be10ba9130456c274e98093710/nifi-extension-bundles/nifi-extension-utils/nifi-migration-utils/src/main/java/org/apache/nifi/migration/ProxyServiceMigration.java#L47-L68). Do you have plans to do it in this jira or in a separate one?
Thanks for asking @turcsanyip. I added the `migrateProperties()` methods to remove existing references to the legacy properties as an incremental step forward. I wasn't planning to include a full migration in this pull request, but I think it could be considered a follow-on effort. With these components supporting both direct properties and the `KerberosCredentialsService`, a complete solution would have to consider each scenario, and there may be some opportunity for reuse in some components. As mentioned in the pull request, the `KerberosUserService` has been around since NiFi 1.15.0, so the migration seems less necessary than others, but if you are inclined to add it, it seems like a good scope for a subsequent Jira issue.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@nifi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] NIFI-13510 Remove KerberosCredentialsService and implementations [nifi]
Posted by "asfgit (via GitHub)" <gi...@apache.org>.
asfgit closed pull request #9058: NIFI-13510 Remove KerberosCredentialsService and implementations
URL: https://github.com/apache/nifi/pull/9058
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@nifi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] NIFI-13510 Remove KerberosCredentialsService and implementations [nifi]
Posted by "joewitt (via GitHub)" <gi...@apache.org>.
joewitt commented on PR #9058:
URL: https://github.com/apache/nifi/pull/9058#issuecomment-2214498605
Ok thanks for adding the removal/cleanup related to the old workaround/hack thing we had with environment variables. Thrilled to get this out.
Also sounds good that the migrate mechanism can be added to should there be challenges for existing configs.
+1 merging
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@nifi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] NIFI-13510 Remove KerberosCredentialsService and implementations [nifi]
Posted by "joewitt (via GitHub)" <gi...@apache.org>.
joewitt commented on PR #9058:
URL: https://github.com/apache/nifi/pull/9058#issuecomment-2212296332
I believe the env variable trick we came up with many moons ago can be removed/deleted now
Searching for 'ALLOW_EXPLICIT_KEYTAB' shows this is in nifi-env.sh and nifi-stateless-env.sh. I believe all such references can be removed from those files now.
I also see various kerberos related values in the nifi.properties. With the removal of the spnego bits and this update are those entries still necessary/desirable? krb5.conf and so on? I was wondering if maybe components that dont let us specify much context would still need it.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@nifi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] NIFI-13510 Remove KerberosCredentialsService and implementations [nifi]
Posted by "exceptionfactory (via GitHub)" <gi...@apache.org>.
exceptionfactory commented on PR #9058:
URL: https://github.com/apache/nifi/pull/9058#issuecomment-2212307442
> I believe the env variable trick we came up with many moons ago can be removed/deleted now
>
> Searching for 'ALLOW_EXPLICIT_KEYTAB' shows this is in nifi-env.sh and nifi-stateless-env.sh. I believe all such references can be removed from those files now.
>
> I also see various kerberos related values in the nifi.properties. With the removal of the spnego bits and this update are those entries still necessary/desirable? krb5.conf and so on? I was wondering if maybe components that dont let us specify much context would still need it.
Thanks for the pointer on the environment variable, I pushed a change to remove it from the default `nifi-env.sh`.
I also removed some unnecessary references to NiFi Properties from the test classes.
The Kerberos properties still have some references when creating the ZooKeeper client and when configuring Controller Services that could request Kerberos properties. However, those `KerberosContext` methods are limited to scripted components. That could be worth evaluating for removal in a separate issue, since it is public in `nifi-api` as opposed to extension components targeted in this pull request.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@nifi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] NIFI-13510 Remove KerberosCredentialsService and implementations [nifi]
Posted by "turcsanyip (via GitHub)" <gi...@apache.org>.
turcsanyip commented on PR #9058:
URL: https://github.com/apache/nifi/pull/9058#issuecomment-2214163495
@exceptionfactory Thanks for cleaning up the Kerberos config in these components!
I think it would also be useful to add migration code for helping the move from the old controller service (or processor level properties) to `KerberosUserService`. Similar to the [proxy propery migraton](https://github.com/apache/nifi/blob/f5476ca3b4eea6be10ba9130456c274e98093710/nifi-extension-bundles/nifi-extension-utils/nifi-migration-utils/src/main/java/org/apache/nifi/migration/ProxyServiceMigration.java#L47-L68). Do you have plans to do it in this jira or in a separate one?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@nifi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org