NIFI-4890 Refactor OIDC with support for Refresh Tokens

[exceptionfactory]

Summary

NIFI-4890 Refactors the NiFi OpenID Connect integration using Spring Security 5 with support for extended application sessions using Refresh Tokens.

The new implementation replaces custom REST Resources with Spring Security filters to maintain existing support for the Authorization Code Grant Flow. The new implementation also maintains support for OpenID Connect RP-Initiated Logout 1.0 when the OpenID Connect Provider supports ending sessions.

As part of supporting session continuation with Refresh Tokens, the new implementation supports OAuth 2.0 Token Revocation. The updated Administrator's Guide documentation describes the Refresh Token handling. As noted in the documentation, application use of Refresh Tokens is conditional on the Authorization Server returning a Refresh Token during authentication. OIDC support follows the same pattern as other authentication strategies when the Authorization Server does not provide a Refresh Token.

The implementation introduces a new property named nifi.security.user.oidc.token.refresh.window to control the duration of time between when the application Bearer Token expires and when the application should attempt to renew access using the Refresh Token.

Tracking

Please complete the following tracking steps prior to pull request creation.

Issue Tracking

• Apache NiFi Jira issue created

Pull Request Tracking

• Pull Request title starts with Apache NiFi Jira issue number, such as NIFI-00000
• Pull Request commit message starts with Apache NiFi Jira issue number, as such NIFI-00000

Pull Request Formatting

• Pull Request based on current revision of the main branch
• Pull Request refers to a feature branch with one commit containing changes

Verification

Please indicate the verification steps performed prior to pull request creation.

Build

• Build completed using mvn clean install -P contrib-check
  • JDK 11
  • JDK 17

Licensing

• New dependencies are compatible with the Apache License 2.0 according to the License Policy
• New dependencies are documented in applicable LICENSE and NOTICE files

Documentation

• Documentation formatting appears as expected in rendered files

[emiliosetiadarma]

I was able to test with Keycloak and Google as the providers and it works as expected!

[mcgilman]

Reviewing...

[exceptionfactory]

Thanks for the testing @emiliosetiadarma!

After some discussion with @mcgilman, I pushed an update to change the source of initial application Bearer Token expiration.

The previous implementation derived the application Bearer Token expiration from the ID Token, but the update changes the approach to derive the expiration from the Access Token. This strategy aligns both initial expiration and refreshed expiration to derive from the Access Token expiration.

Some Identity Providers return the same expiration value for both the ID Token and the Access Token, so the end result will not change for those providers. Changing the source of the application Bearer Token expiration to the Access Token expiration provides a consistent approach, and the updated section of the Administrator's Guide reflects these changes. Some Identity Providers make the Access Token expiration configurable, so this also aligns with expected integration behavior.

I also rebased the pull request from the current main branch.

[greyp9]

Tested happy path using [1]. Only behavioral difference I noticed was an update to the needed "Sign-out redirect URI" specified in the Okta configuration.

[1] https://exceptionfactory.com/posts/2022/12/21/integrating-apache-nifi-with-okta-oidc-authentication/

[mtien-apache]

Reviewing.

[exceptionfactory]

Tested happy path using [1]. Only behavioral difference I noticed was an update to the needed "Sign-out redirect URI" specified in the Okta configuration.

[1] https://exceptionfactory.com/posts/2022/12/21/integrating-apache-nifi-with-okta-oidc-authentication/

Thanks for testing @greyp9. The updated OpenID Connect section of the Administrator's Guide notes the logout destination path, but it is worth calling out the change as a migration guide note when this is ready to go. The updated logout destination removes the relative path elements in favor for declaring the direct /nifi/logout-complete path.

[mtien-apache]

+1 Thanks for the PR, @exceptionfactory! 🙌🏼 Tested login and logout with Google, Okta, and Azure and they all work well. One thing to note is with Azure logout, I don't get re-directed back to NiFi or login even though I added a post logout redirect URI to my Azure ID Provider. I'm still able to log out completely. After you and I looked at this, it seems like it could be an issue on Azure's side. Thanks for also walking through the reasons why and how we are saving the ID/access/refresh tokens.

[mcgilman]

Thanks @exceptionfactory! Nice work and thanks for the update following our initial discussion.

[exceptionfactory]

Thanks for the feedback and testing @mtien-apache and @mcgilman! I pushed one more update correcting some spelling and naming issues.