AccessApi CreateDownloadToken deprecated

[Daniel Chaffelson <ch...@gmail.com>]

Hi folks,
A user has created an Issue ticket[1] on NiPyAPI after upgrading NiFi from
1.12 to 1.16.
It seems that sometime in this window the AccessApi has had the
CreateDownloadToken function deprecated. This function appears to have
issued a one-time auth token to download flowfile content, and I cannot see
a replacement for this particular functionality.
I can see that a user with the correct authz against Flowfile content would
be able to use the FlowfileQueuesApi to DownloadFlowFileContent once their
client had a bearer token, but this would be subtly different from a
one-time token indicated in this older function.

Can anyone advise on this deprecation and if the functionality moved
elsewhere?

[1] https://github.com/Chaffelson/nipyapi/issues/324

Re: AccessApi CreateDownloadToken deprecated

[Daniel Chaffelson <ch...@gmail.com>]

Thanks David, that makes good sense and I just couldn't find the relevant
Jira for myself earlier.

On Mon, Jan 23, 2023 at 2:24 PM David Handermann <
exceptionfactory@apache.org> wrote:

> Hi Dan,
>
> NiFi 1.15.0 included the removal of One-Time Password Authentication as
> described in NIFI-8931 [1].
>
> Depending on the authentication strategy configured, the Access Token REST
> API can be used to create a Bearer Token that can be used for a longer
> duration. Configuring and authorizing X.509 Client Certificates is another
> option for programmatic access, but there is no direct replacement for
> One-Time Password Authentication.
>
> Regards,
> David Handermann
>
> [1] https://issues.apache.org/jira/browse/NIFI-8931
>
> On Mon, Jan 23, 2023 at 3:37 AM Daniel Chaffelson <ch...@gmail.com>
> wrote:
>
> > Hi folks,
> > A user has created an Issue ticket[1] on NiPyAPI after upgrading NiFi
> from
> > 1.12 to 1.16.
> > It seems that sometime in this window the AccessApi has had the
> > CreateDownloadToken function deprecated. This function appears to have
> > issued a one-time auth token to download flowfile content, and I cannot
> see
> > a replacement for this particular functionality.
> > I can see that a user with the correct authz against Flowfile content
> would
> > be able to use the FlowfileQueuesApi to DownloadFlowFileContent once
> their
> > client had a bearer token, but this would be subtly different from a
> > one-time token indicated in this older function.
> >
> > Can anyone advise on this deprecation and if the functionality moved
> > elsewhere?
> >
> > [1] https://github.com/Chaffelson/nipyapi/issues/324
> >
>

Re: AccessApi CreateDownloadToken deprecated

[David Handermann <ex...@apache.org>]

Hi Dan,

NiFi 1.15.0 included the removal of One-Time Password Authentication as
described in NIFI-8931 [1].

Depending on the authentication strategy configured, the Access Token REST
API can be used to create a Bearer Token that can be used for a longer
duration. Configuring and authorizing X.509 Client Certificates is another
option for programmatic access, but there is no direct replacement for
One-Time Password Authentication.

Regards,
David Handermann

[1] https://issues.apache.org/jira/browse/NIFI-8931

On Mon, Jan 23, 2023 at 3:37 AM Daniel Chaffelson <ch...@gmail.com>
wrote:

> Hi folks,
> A user has created an Issue ticket[1] on NiPyAPI after upgrading NiFi from
> 1.12 to 1.16.
> It seems that sometime in this window the AccessApi has had the
> CreateDownloadToken function deprecated. This function appears to have
> issued a one-time auth token to download flowfile content, and I cannot see
> a replacement for this particular functionality.
> I can see that a user with the correct authz against Flowfile content would
> be able to use the FlowfileQueuesApi to DownloadFlowFileContent once their
> client had a bearer token, but this would be subtly different from a
> one-time token indicated in this older function.
>
> Can anyone advise on this deprecation and if the functionality moved
> elsewhere?
>
> [1] https://github.com/Chaffelson/nipyapi/issues/324
>