Chaffelson/nipyapi

Nipyapi login issue to NiFi with LDAP authentication

marcchanwork opened this issue · 5 comments

marcchanwork commented
  • Nipyapi version: 0.19.1
  • NiFi version: 1.19.1
  • NiFi-Registry version: 1.19.1
  • Python version: 3.9.18
  • Operating System: Linux/Redhat 9

Description

Our nifi currently is connected to LDAP for login authentication. This caused an error during login via nipyapi:
"ValueError: Username/Password login not supported by this NiFi."

Saw in some posts that we can use client certificates to generate access token for login. I was able to proceed with cli.sh from the nifi-toolkit. So now I plan to adjust my current nipyapi script to also apply certificates upon login/access token request.

What I Did

I tried to add ssl_context but I am bit confused as to what settings / certificates do I need to use.
I have the following certs:
client.cer
client.key
truststore.jks
keystore.jks

I tried to do the following functions:
set_service_ssl_context, nipypi.nifi_config

Urgency

Not urgent but any help is appreciated. Please let me know what information I can add to this.

marcchanwork commented

<Update 1>
@ottobackwards yes, I also supplemented the code from this similar issue: #319

nipyapi.config.default_ssl_context = {
    'ca_file':'/etc/nifi/truststore.pem',
    'client_cert_file': '/etc/nifi/machine.cer',
    'client_key_file': '/etc/nifi/machine..key',
}

nipyapi.utils.set_endpoint("https://server:8443/nifi-api", ssl=True, login=False, username=None, password=None)

which returns True

While running nipyapi.system.get_cluster() command, it returns
ValueError: Unable to view the controller. Contact the system administrator.

I have a login user "SCRIPT_USER", would it be possible to set as proxy user somewhere?

ottobackwards commented

I am sorry, I don't know. The secure demo works ( or did the last I tried ). I suggest you see if you can get the demo working without your stuff, and if you can, then you can examine the differences between your setups maybe?

Chaffelson commented

In the linked ticket, the user uses the set_ssl_context call, rather than updating the default context.
Possibly there is some mismatch between the behaviours of the default vs. explicit functions here - can you please try with the approach in the linked ticket?

I don't think you need a proxy user for plain NiFi usage - that was traditionally for when you wanted NiFi to take actions on Registry as a pass-through.

  • 👍1
Chaffelson commented

Closing as no further action requested, please reopen if this still needs addressing.