Skip to content

NIFI-4542, add target.dir.created to indicate if the target directory created #3641

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
avseq1234 wants to merge 7 commits into from
Closed

NIFI-4542, add target.dir.created to indicate if the target directory created #3641

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
f0e4e98
NIFI-4542, add target.dir.created to indicate if the target directory…
avseq1234 Aug 9, 2019
aa741cc
NIFI-7332 Added method to log available claim names from the ID provi…
mtien-apache May 21, 2020
f493fc7
Merge pull request #1 from apache/master
avseq1234 Dec 31, 2020
45671fe
NIFI-4542, add target.dir.created to indicate if the target directory…
avseq1234 Aug 9, 2019
3ad3863
Merge branch 'NIFI-4542' of https://github.com/avseq1234/nifi into NI…
avseq1234 Sep 12, 2021
ee62349
NIFI-4542, add target.dir.created to indicate if the target directory…
avseq1234 Aug 9, 2019
7379cc3
Merge branch 'NIFI-4542' of https://github.com/avseq1234/nifi into NI…
avseq1234 Sep 12, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 2 additions & 3 deletions nifi-docs/src/main/asciidoc/administration-guide.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -367,10 +367,9 @@ To enable authentication via OpenId Connect the following properties must be con
|`nifi.security.user.oidc.read.timeout` | Read timeout when communicating with the OpenId Connect Provider.
|`nifi.security.user.oidc.client.id` | The client id for NiFi after registration with the OpenId Connect Provider.
|`nifi.security.user.oidc.client.secret` | The client secret for NiFi after registration with the OpenId Connect Provider.
|`nifi.security.user.oidc.preferred.jwsalgorithm` | The preferred algorithm for for validating identity tokens. If this value is blank, it will default to `RS256` which is required to be supported
|`nifi.security.user.oidc.preferred.jwsalgorithm` | The preferred algorithm for validating identity tokens. If this value is blank, it will default to `RS256` which is required to be supported
|`nifi.security.user.oidc.additional.scopes` | Comma separated scopes that are sent to OpenId Connect Provider in addition to `openid` and `email`.
|`nifi.security.user.oidc.claim.identifying.user` | Claim that identifies the user to be logged in; default is `email`. May need to be requested via the `nifi.security.user.oidc.additional.scopes` before usage.
by the OpenId Connect Provider according to the specification. If this value is `HS256`, `HS384`, or `HS512`, NiFi will attempt to validate HMAC protected tokens using the specified client secret.
|`nifi.security.user.oidc.claim.identifying.user` | Claim that identifies the user to be logged in; default is `email`. May need to be requested via the `nifi.security.user.oidc.additional.scopes` before usage by the OpenId Connect Provider according to the specification. If this value is `HS256`, `HS384`, or `HS512`, NiFi will attempt to validate HMAC protected tokens using the specified client secret.
If this value is `none`, NiFi will attempt to validate unsecured/plain tokens. Other values for this algorithm will attempt to parse as an RSA or EC algorithm to be used in conjunction with the
JSON Web Key (JWK) provided through the jwks_uri in the metadata found at the discovery URL.
|==================================================================================================================================================
Expand Down
2 changes: 2 additions & 0 deletions ...hadoop-utils/src/main/java/org/apache/nifi/processors/hadoop/AbstractHadoopProcessor.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -138,6 +138,8 @@ public abstract class AbstractHadoopProcessor extends AbstractProcessor {

public static final String ABSOLUTE_HDFS_PATH_ATTRIBUTE = "absolute.hdfs.path";

protected static final String TARGET_HDFS_DIR_CREATED_ATTRIBUTE = "target.dir.created";

private static final Object RESOURCES_LOCK = new Object();
private static final HdfsResources EMPTY_HDFS_RESOURCES = new HdfsResources(null, null, null, null);

Expand Down
6 changes: 5 additions & 1 deletion ...fi-web-security/src/main/java/org/apache/nifi/web/security/oidc/OidcIdentityProvider.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,14 +20,18 @@
import com.nimbusds.oauth2.sdk.AuthorizationGrant;
import com.nimbusds.oauth2.sdk.Scope;
import com.nimbusds.oauth2.sdk.id.ClientID;

import java.io.IOException;
import java.net.URI;

public interface OidcIdentityProvider {

String OPEN_ID_CONNECT_SUPPORT_IS_NOT_CONFIGURED = "OpenId Connect support is not configured";

/**
* Initializes the provider.
*/
void initializeProvider();

/**
* Returns whether OIDC support is enabled.
*
Expand Down
17 changes: 14 additions & 3 deletions ...fi-web/nifi-web-security/src/main/java/org/apache/nifi/web/security/oidc/OidcService.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,8 +21,6 @@
import com.nimbusds.oauth2.sdk.AuthorizationGrant;
import com.nimbusds.oauth2.sdk.Scope;
import com.nimbusds.oauth2.sdk.id.State;
import org.apache.nifi.web.security.util.CacheKey;

import java.io.IOException;
import java.math.BigInteger;
import java.net.URI;
Expand All @@ -31,6 +29,7 @@
import java.security.SecureRandom;
import java.util.concurrent.ExecutionException;
import java.util.concurrent.TimeUnit;
import org.apache.nifi.web.security.util.CacheKey;

import static org.apache.nifi.web.security.oidc.StandardOidcIdentityProvider.OPEN_ID_CONNECT_SUPPORT_IS_NOT_CONFIGURED;

Expand Down Expand Up @@ -66,6 +65,7 @@ public OidcService(final OidcIdentityProvider identityProvider, final int durati
throw new RuntimeException("The OidcIdentityProvider must be specified.");
}

identityProvider.initializeProvider();
this.identityProvider = identityProvider;
this.stateLookupForPendingRequests = CacheBuilder.newBuilder().expireAfterWrite(duration, units).build();
this.jwtLookupForCompletedRequests = CacheBuilder.newBuilder().expireAfterWrite(duration, units).build();
Expand Down Expand Up @@ -198,7 +198,7 @@ public void exchangeAuthorizationCode(final String oidcRequestIdentifier, final
}

final CacheKey oidcRequestIdentifierKey = new CacheKey(oidcRequestIdentifier);
final String nifiJwt = identityProvider.exchangeAuthorizationCode(authorizationGrant);
final String nifiJwt = retrieveNifiJwt(authorizationGrant);

try {
// cache the jwt for later retrieval
Expand All @@ -213,6 +213,17 @@ public void exchangeAuthorizationCode(final String oidcRequestIdentifier, final
}
}

/**
* Exchange the authorization code to retrieve a NiFi JWT.
*
* @param authorizationGrant authorization grant
* @return NiFi JWT
* @throws IOException exceptional case for communication error with the OpenId Connect provider
*/
public String retrieveNifiJwt(final AuthorizationGrant authorizationGrant) throws IOException {
return identityProvider.exchangeAuthorizationCode(authorizationGrant);
}

/**
* Returns the resulting JWT for the given request identifier. Will return null if the request
* identifier is not associated with a JWT or if the login sequence was not completed before
Expand Down
Loading