Versions Compared

Old Version 3

changes.mady.by.user Aldrin Piri

Saved on

compared with

New Version 4

changes.mady.by.user Matt Gilman

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Page properties
Target release
Epic
Document status
Status
titleDRAFT
Document owner

Aldrin Piri

DesignerMatt Gilman
DevelopersMatt Gilman
QA

Goals

  • Provide new authentication mechanisms inclusive of a foundational framework that allows specific authentication providers.  Best in class for this situation appears from a cursory standpoint to be JAAS
  • Build the needed extensions and configuration to allow for multiple providers along the likes of LDAPUsername/Password, Kerberos, OAuth/OpenID Connect, etc.
  • Extend Update the UI to provide a consistent user experience for interfacing with any of the various providers support supplying username/password when configured.

Background and strategic fit

Current security mechanisms are Spring based and heavily bound to exclusively a PKI powered system.  There has been wide community request for supporting of additional mechanisms as they look to provide integration of NiFi into existing enterprise facilities.  Work to this end would allow the assignment of roles within NiFi instancesUsing Spring Security allows for supporting any of these options.

Assumptions

Requirements

#TitleUser StoryImportanceNotes
1Provide a framework for implementing Implementing multiple authentication providersThere are wide and varying authentication mechanisms in place across various enterprises. Accordingly, it is important to provide a consistent interface for integration within various environments as well as providing a basis for custom implementations.JAAS seems to be best in class. Alternatives? 
2

LDAP Username/Password Provider

   
3Kerberos Provider   
4PKI Provider   
5OAuth2/OpenID Connect   

User interaction and design

...

QuestionOutcome
What best addresses the problem in terms of our needs and technology? Dispelling differences between SASL and JAAS and their applicability. By sticking with Spring Security we can offer support for both
What is a core set of providers that cover most needs? PKI, Username/Password, Keberos
How does this affect user model in terms of groups and access? How does it affect our compliance with SCIM?It does not affect it. This simply provides support for identifying a user. Access and groups are handled by the AuthorityProvier
How does this affect the authority provider?

It does not impact the AuthorityProvider

When using Username/Password how do we establish site to site communication? Do we support creating new users via the UI?Will likely not support creating new users via the UI and will require the admin to provide the credentials which will be input when configuring the Remote Process Group.
When using OpenId Connect how do we establish site to site communication? 

Not Doing