From 0fce806950b78d320441c3756026e62a6c706430 Mon Sep 17 00:00:00 2001 From: Marcelo Vinicius de Sousa Campos Date: Thu, 5 Oct 2023 13:56:16 -0300 Subject: [PATCH] NIFI-12173 Added OpenID Connect documentation for Registry This closes #7842 Co-authored-by: David Handermann Signed-off-by: David Handermann --- .../main/asciidoc/administration-guide.adoc | 61 +++++++++++++++++++ 1 file changed, 61 insertions(+) diff --git a/nifi-registry/nifi-registry-core/nifi-registry-docs/src/main/asciidoc/administration-guide.adoc b/nifi-registry/nifi-registry-core/nifi-registry-docs/src/main/asciidoc/administration-guide.adoc index bf5f494766..139ca26572 100644 --- a/nifi-registry/nifi-registry-core/nifi-registry-docs/src/main/asciidoc/administration-guide.adoc +++ b/nifi-registry/nifi-registry-core/nifi-registry-docs/src/main/asciidoc/administration-guide.adoc @@ -253,6 +253,37 @@ The `kerberos-identity-provider` has the following properties: See also <> to allow single sign-on access via client Kerberos tickets. +[[openid_connect]] +=== OpenID Connect + +OpenID Connect integration provides single sign-on using a specified Authorization Server. +The implementation supports the Authorization Code Grant Type as described in +link:https://www.rfc-editor.org/rfc/rfc6749#section-4.1[RFC 6749 Section 4.1^] and +link:https://openid.net/specs/openid-connect-core-1_0.html#CodeFlowSteps[OpenID Connect Core Section 3.1.1^]. + +The implementation enables +link:https://openid.net/specs/openid-connect-rpinitiated-1_0.html[OpenID Connect RP-Initiated Logout 1.0^] when the +Authorization Server includes an `end_session_endpoint` element in the OpenID Discovery configuration. + + +OpenID Connect integration supports the following settings in _nifi-registry.properties_. + +[options="header"] +|================================================================================================================================================== +| Property Name | Description +|`nifi.registry.security.user.oidc.discovery.url` | The link:http://openid.net/specs/openid-connect-discovery-1_0.html[Discovery Configuration URL^] for the OpenID Connect Provider +|`nifi.registry.security.user.oidc.connect.timeout` | Socket Connect timeout when communicating with the OpenID Connect Provider. The default value is `5 secs` +|`nifi.registry.security.user.oidc.read.timeout` | Socket Read timeout when communicating with the OpenID Connect Provider. The default value is `5 secs` +|`nifi.registry.security.user.oidc.client.id` | The Client ID for NiFi Registry registered with the OpenID Connect Provider +|`nifi.registry.security.user.oidc.client.secret` | The Client Secret for NiFi Registry registered with the OpenID Connect Provider +|`nifi.registry.security.user.oidc.preferred.jwsalgorithm` | The preferred algorithm for validating identity tokens. If this value is blank, it will default to `RS256` which is required to be supported +by the OpenID Connect Provider according to the specification. If this value is `HS256`, `HS384`, or `HS512`, NiFi Registry will attempt to validate HMAC protected tokens using the specified client secret. +If this value is `none`, NiFi will attempt to validate unsecured/plain tokens. Other values for this algorithm will attempt to parse as an RSA or EC algorithm to be used in conjunction with the +JSON Web Key (JWK) provided through the jwks_uri in the metadata found at the discovery URL +|`nifi.registry.security.user.oidc.additional.scopes` | Comma separated scopes that are sent to OpenID Connect Provider in addition to `openid` and `email`. +|`nifi.registry.security.user.oidc.claim.identifying.user` | Claim that identifies the authenticated user. The default value is `email`. Claim names may need to be requested using the `nifi.registry.security.user.oidc.additional.scopes` property +|================================================================================================================================================== + [[authorization]] == Authorization @@ -435,6 +466,36 @@ Here is an example certificate DN entry using the name John Smith: ---- +===== File-based (OIDC Authentication) +Here is an example as Initial User Identity called `admin` : + +---- + + + file-user-group-provider + org.apache.nifi.registry.security.authorization.file.FileUserGroupProvider + ./conf/users.xml + admin + + + + file-access-policy-provider + org.apache.nifi.registry.security.authorization.file.FileAccessPolicyProvider + file-user-group-provider + ./conf/authorizations.xml + admin + + + + + managed-authorizer + org.apache.nifi.registry.security.authorization.StandardManagedAuthorizer + file-access-policy-provider + + + +---- + ===== File-based (Kerberos Authentication) Here is an example Kerberos entry using the name John Smith and realm `NIFI.APACHE.ORG`: