diff --git a/README.md b/README.md index 8f58d8d5..a29ce190 100644 --- a/README.md +++ b/README.md @@ -134,9 +134,11 @@ The following table lists the configurable parameters of the nifi chart and the | `properties.customLibPath` | Path of the custom libraries folder | `nil` | | `properties.webProxyHost` | Proxy to access to Nifi through the cluster ip address | `Port:30236` | **[Authentication](/doc/USERMANAGEMENT.md)** | -| **Single-user authentication** | Automatically disabled if OIDC or LDAP enabled +| **Single-user authentication** | Automatically disabled if Client Certificate, OIDC, or LDAP enabled | `auth.singleUser.username` | Single user identity | `username` | | `auth.singleUser.password` | Single user password | `changemechangeme` | +| **Client Certificate authentication** | +| `auth.clientAuth.enabled` | Enable User auth via Client Certificates | `false` | **Ldap authentication** | | `auth.admin` | Default admin identity | ` CN=admin, OU=NIFI` | | `auth.ldap.enabled` | Enable User auth via ldap | `false` | diff --git a/configs/nifi.properties b/configs/nifi.properties index 4d33a0ec..16f1395a 100644 --- a/configs/nifi.properties +++ b/configs/nifi.properties @@ -147,7 +147,17 @@ nifi.sensitive.props.algorithm={{ .Values.properties.algorithm }} nifi.sensitive.props.provider=BC nifi.sensitive.props.additional.keys= -{{if .Values.auth.ldap.enabled}} +{{if .Values.auth.clientAuth.enabled}} +nifi.security.keystore=/opt/nifi/nifi-current/config-data/certs/keystore.jks +nifi.security.keystoreType=jks +nifi.security.keystorePasswd={{.Values.auth.SSL.keystorePasswd}} +nifi.security.keyPasswd={{.Values.auth.SSL.keystorePasswd}} +nifi.security.truststore=/opt/nifi/nifi-current/config-data/certs/truststore.jks +nifi.security.truststoreType=jks +nifi.security.truststorePasswd={{.Values.auth.SSL.truststorePasswd}} +nifi.security.user.authorizer=managed-authorizer +nifi.security.user.login.identity.provider= +{{else if .Values.auth.ldap.enabled}} nifi.security.keystore=/opt/nifi/nifi-current/conf/{{.Release.Name}}-nifi-0.{{.Release.Name}}-nifi-headless.{{.Release.Namespace}}.svc.cluster.local/keystore.jks nifi.security.keystoreType=jks nifi.security.keystorePasswd={{.Values.auth.SSL.keystorePasswd}} diff --git a/doc/USERMANAGEMENT.md b/doc/USERMANAGEMENT.md index c7db68ea..a276f44e 100644 --- a/doc/USERMANAGEMENT.md +++ b/doc/USERMANAGEMENT.md @@ -1,12 +1,12 @@ User Authentication ============= -This helm chart provides three types of authentication: Single User, LDAP and OIDC. These three authtications can be managed essentialy from the `values.yaml` file. +This helm chart provides four types of authentication: Single User, Client Certificate, LDAP, and OIDC. These four authentication types can be managed essentialy from the `values.yaml` file. ## 1. Single User -The Single User authentication is the default authentication in this helm chart. To login like a single user, the values below must be setted in `values.yaml` file: +The Single User authentication is the default authentication in this helm chart. To login like a single user, the values below must be set in `values.yaml` file: ```` singleUser: @@ -14,11 +14,87 @@ singleUser: password: changemechangeme ```` -## 2. OIDC + +## 2. Client Certificate + +Client Certificate authentication assumes a central Certificate Authority (CA) will issue a Client PKI Certificate and Server Certificate for the Nifi server. + +Add keystore files to a Kubernetes secret: + +```` +kubectl create secret generic mysecrets \ +--from-file=keystore.jks=/path/to/keystore.jks \ +--from-file=truststore.jks=/path/to/truststore.jks +```` + +Make the Kubernetes secret available to the Nifi server. Update `values.yaml`: + +```` +secrets: +- name: mysecrets + keys: + - keystore.jks + - truststore.jks + mountPath: /opt/nifi/nifi-current/config-data/certs/ +```` + +Enable the Nifi server to prompt for client certificates: + +```` +properties: + needClientAuth: true +```` + +Indicate Client Authentication mode configurations should be applied and set SSL values: + +```` +auth: + SSL: + keystorePasswd: + truststorePasswd: + clientAuth: + enabled: true +```` + +For cluster deployments, the example below illustrates how to create a 3 replica cluster with unique keystores. + +Create the secret: + +```` +kubectl create secret generic mysecrets \ +--from-file=.jks=/path/to/.jks \ +--from-file=.jks=/path/to/.jks \ +--from-file=.jks=/path/to/.jks \ +--from-file=truststore.jks=/path/to/truststore.jks +```` + +Make the secret available to the replicas: + +```` +secrets: +- name: mysecrets + keys: + - .jks + - .jks + - .jks + - truststore.jks + mountPath: /opt/nifi/nifi-current/config-data/certs/ +```` + +Add a safetyValve entry to align the container with the associated keystore: + +```` +properties: + safetyValve: + nifi.security.keystore: ${NIFI_HOME}/config-data/certs/${FQDN}.jks +```` + + +## 3. OIDC OpenID Connect (OIDC) is an open authentication protocol that profiles and extends OAuth 2.0 to add an identity layer. It can be used by an external identity provider to make authentication. -To enable OIDC user authentication, the values below must be setted in `values.yaml` file: +To enable OIDC user authentication, the values below must be set in `values.yaml` file: ```` oidc: @@ -33,7 +109,7 @@ oidc: There are a lot of ID providers that can be used to perform an OIDC authentication. In our case, we have tested that with Keycloak. You will find an example of Keycloak config on this [page](https://github.com/cetic/helm-nifi/tree/feature/nifi_1.14.0/doc/KEYCLOAK.md). -## 3. LDAP +## 4. LDAP Like OIDC, LDAP (Lightweight Directory Access Protocol) provide an external authentication. If you have your own LDAP, you can use it. If not, set `openldap.enabled` to `true` in `values.yaml` file to deploy a local instance of OpenLDAP. diff --git a/templates/statefulset.yaml b/templates/statefulset.yaml index e3f4c3e6..f19fda56 100644 --- a/templates/statefulset.yaml +++ b/templates/statefulset.yaml @@ -159,6 +159,9 @@ spec: "${NIFI_HOME}/conf/authorizers.xml" xmlstarlet ed --inplace --update "//authorizers/accessPolicyProvider/property[@name='Initial Admin Identity']" -v {{ .Values.auth.oidc.admin | quote }} "${NIFI_HOME}/conf/authorizers.xml" xmlstarlet ed --inplace --update "//authorizers/accessPolicyProvider/property[@name='Authorizations File']" -v './auth-conf/authorizations.xml' "${NIFI_HOME}/conf/authorizers.xml" +{{- else if .Values.auth.clientAuth.enabled }} + cat "${NIFI_HOME}/conf/authorizers.temp" > "${NIFI_HOME}/conf/authorizers.xml" + xmlstarlet ed --inplace --delete "//authorizers/authorizer[identifier='single-user-authorizer']" "${NIFI_HOME}/conf/authorizers.xml" {{- else if .Values.auth.singleUser.username }} bin/nifi.sh set-single-user-credentials {{ .Values.auth.singleUser.username }} {{ .Values.auth.singleUser.password }} {{- end }} diff --git a/values.yaml b/values.yaml index 29210496..1c08e4d4 100644 --- a/values.yaml +++ b/values.yaml @@ -123,6 +123,9 @@ auth: username: username password: changemechangeme # Must to have at least 12 characters + clientAuth: + enabled: false + ldap: enabled: false host: #ldap://: