[jira] [Commented] (NIFI-6152) Allow OIDC authentication for nifi running behind a proxy server with SSL config

["Peer Bech Hansen (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/NIFI-6152?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17363597#comment-17363597 ] 

Peer Bech Hansen commented on NIFI-6152:
----------------------------------------

Hi [~kdoran]
{quote}One use case I'm aware of where it might make sense allow alternative configuration is folks using a tool like Istio to secure transport between services
{quote}
The use case you are describing here, using Istio and Envoy-proxy for handling internal secure communication (mTLS), is what I'm trying to achieve running on a Kubernetes cluster. Do you have any ideas about doing such a setup? I'm sure that use case has been increasing adopted the last couple of years,

The project I'm working on has, until recently, while under initial implementation, not been using HTTPS. My task is now to make the application secure and add authentication and authorization.

We have changed our Kubernetes ingress gateway from using HTTP to HTTPS. It changes the behavior of NiFi drastically. We are now unable to do certain things and NiFi says ‘You are accessing with limited authority. Log in or request an account to access with additional authority granted to you by an administrator.’ 
 However when selecting the login link, NiFi says ‘User authentication/authorization is only supported when running over HTTPS’.
{quote}While it does take additional initial setup, it is possible to setup NiFi with OIDC authentication, SSL, and behind a reverse proxy.
{quote}
So how do we do such setup. I haven’t found much documentation.

[~nikgonzalez] did you manager to do such a setup?

 

Best
 Peer

 

> Allow OIDC authentication for nifi running behind a proxy server with SSL config
> --------------------------------------------------------------------------------
>
>                 Key: NIFI-6152
>                 URL: https://issues.apache.org/jira/browse/NIFI-6152
>             Project: Apache NiFi
>          Issue Type: Improvement
>            Reporter: nik gonzalez
>            Priority: Major
>
> org.apache.nifi.web.api.AccessResource.java first checks whether request.isSecure() before it proceeds with oidc authentication. This is a proposal to remove this restriction to allow oidc authentication when running nifi behind a reverse proxy (e.g., haproxy, nginx) configured with SSL.



--
This message was sent by Atlassian Jira
(v8.3.4#803005)