mirror of https://github.com/apache/nifi.git
9 Commits
| Author | SHA1 | Message | Date |
|---|---|---|---|
Bryan Rosander
|
fa4c6ab03c
|
NIFI-2193 - Added functionality to automate certificate generation, keystore and truststore generation, and nifi.properties keystore and truststore password population. Follow-on changes will be made under NIFI-2476.
This closes #695. Signed-off-by: Andy LoPresto <alopresto@apache.org> Defaulting to same keyStore, key password (+18 squashed commits) Squashed commits: [9d01ba0] NIFI-2193 - Fixing typo [55440bc] NIFI-2193 - Standalone can run as long as there are no conflicting files/folders [0ca34ed] NIFI-2193 - Fixing some filename, absolute path issues [9d4f65b] NIFI-2193 - Incorporating feedback [f7550b4] NIFI-2193 - Cleaning up imports [59a7637] NIFI-2193 - Updating umask to allow owner to execute [cf824e7] NIFI-2193 - Moving DN arg to CA service specific parent class [921ee13] NIFI-2193 - Making keystore getInstance more consistent [a283c4b] NIFI-2193 - Updating sample config files in assembly to reflect new structure [8d3a21d] NIFI-2193 - Making TlsHelper static, adding option to use same password for Key, KeyStore [b13d247] NIFI-2193 - Addressing PR feedback [46ef8ed] NIFI-2193 - Removing commons-logging, log4j from notice [d4cf41a] NIFI-2193 - Adding option to specify output file for CA certificate when using cli client [b74bf25] NIFI-2193 - Removing Bouncy Castle from notice [6e34f9a] NIFI-2193 - Adding CLI client for easier generation of client certificates [2924fca] NIFI-2193 - nifi-toolkit-ssl -> nifi-toolkit-tls, removing unused constants [886167e] NIFI-2193 - Adding slf4j to avoid runtime issue [082de46] NIFI-2193 - Command line SSL config utility as well as certificate authority client/server |
|
Mark Payne
|
83a23f90d4
|
NIFI-2466: Added option to provide separate key password to StandardSSLContextService.
Fixed NPE (+2 squashed commits) Squashed commits: [ |
|
Andy LoPresto
|
4b9df7d1e2 |
NIFI-2186 Refactored CertificateUtils to separate logic for DN extraction from server/client sockets. Added logic to detect server/client mode encapsulated in exposed method.
Added unit tests for DN extraction. Corrected typo in Javadoc. Switched server/client socket logic for certificate extraction -- when the local socket is in client/server mode, the peer is necessarily the inverse. Fixed unit tests. Moved lazy-loading authentication access out of isDebugEnabled() control branch. This closes #622 |
|
|
Andy LoPresto
|
8b0c5a4911 |
NIFI-1981 Resolved issue where cluster communication without client certificates would fail even if needClientAuth set to false.
Fixed IDE setting for import wildcarding on Groovy files. (+4 squashed commits) Squashed commits: [4c3b174] NIFI-1981 Lowered logging level of client auth setting on cluster connection receive. [b50f473] NIFI-1981 Finished logic to suppress exception on missing client certificates when clientAuth is set to WANT. Added unit tests for CertificateUtil methods. [ace35a2] NIFI-1981 Added test scope dependency on BouncyCastle and BC PKIX modules for CertificateUtils tests. [2c463d1] NIFI-1981 Added ClientAuth enum and CertificateUtil methods to extract this setting from an SSLSocket. Added logic to compare X509Certificate DNs regardless of RDN element order. Added logic to suppress peer certificate exceptions when client authentication is not required. Removed duplicate dependency in pom.xml. |
|
|
Andy LoPresto
|
378ccf53c2
|
NIFI-1753 Replaced usage of javax.security.cert.X509Certificate with java.security.cert.X509Certificate and resolved user-reported ClassCastException when handling client certificates during TLS mutual authentication.
Fixed nifi-utils pom.xml comment about additional dependencies. (+5 squashed commits) Squashed commits: [965b766] NIFI-1753 Removed temporary work-around of duplicate certificate conversion util method and added nifi-security-utils as dependency of nifi-utils. [cd35f9b] NIFI-1753 Replaced legacy X.509 certificate declarations with new declarations in SSLSocketChannel and EndpointConnectionPool. Temporary work-around of duplicate certificate conversion util method because nifi-utils cannot depend on nifi-security-utils. [6420897] NIFI-1753 Replaced legacy X.509 certificate declarations with new declarations in PostHTTP. [b9868ef] NIFI-1753 Added convenience method for extracting DN from peer certificate chain in SSL socket (canonical implementation to reduce code duplication and references to legacy certificate implementations). Refactored logic retrieving legacy X.509 certificates with reference to convenience method in NodeProtocolSenderImpl. Replaced logic retrieving legacy X.509 certificates with reference to convenience method in SocketProtocolListener. Cleaned up exception handling in SocketProtocolListener. Replaced legacy X.509 certificate declarations with new declarations in HandleHttpRequest (needs manual test). [e2d1c35] NIFI-1753 Added convenience methods for converting legacy X.509 certificates and abstract certificates to correct X.509 format. Added unit tests for certificate manipulation. Replaced logic retrieving legacy X.509 certificates with new logic in NodeProtocolSenderImpl. Added bcpkix (Bouncy Castle PKI implementation) dependency to nifi-standard-processors pom. This closes #346. Signed-off-by: Andy LoPresto <alopresto@apache.org> |
|
Andy LoPresto
|
498b5023ce |
NIFI-1257 NIFI-1259
Added utility method to return the maximum acceptable password length for PBE ciphers on JVM with limited strength crypto because BC implementation is undocumented (based on empirical evidence). Updated EncryptionMethod definitions to accurately reflect need for unlimited strength crypto according to algorithm key length. Added processor logic to invoke keyed cipher. Added EncryptContent processor property for raw hex key (always visible until NIFI-1121). Added validations for KDF (keyed and PBE) and hex key. Added utility method to return list of valid key lengths for algorithm. Added description to allowable values for KDF and encryption method in EncryptContent processor. Added IV read/write to KeyedCipherProvider and changed from interface to abstract class. Added salt read/write logic to NifiLegacy and OpenSSL cipher providers. Changed RandomIVPBECipherProvider from interface to abstract class. Updated strong KDF implementations. Renamed CipherFactory to CipherProviderFactory. Added unit test for registered KDF resolution from factory. Updated default iteration count for PBKDF2 cipher provider. Implemented Scrypt cipher provider. Added salt translator from mcrypt format to Java format. Added unit tests for salt formatting and validation. Added surefire block to groovy unit test profile to enforce 3072 MB heap for Scrypt test. Added local Java implementation of Scrypt KDF (and underlying PBKDF2 KDF) from Will Glozer. Defined interface for KeyedCipherProvider. Implemented AES implementation for KeyedCipherProvider. Added Ruby script to test/resources for external compatibility check. Added key length check to PBKDF2 cipher provider. Changed default PRF to SHA-512. Added salt and key length check to PBKDF2 cipher provider. Added utility method to check key length validity for cipher families. Added Bcrypt implementation. Implemented PBKDF2 cipher provider. Added default constructor with strong choices for PBKDF2 cipher provider. Implemented NiFiLegacyCipherProvider and added unit tests. Added key length parameter to PBKDF2 cipher provider. Added PRF resolution to PBKDF2 cipher provider. Added RandomIVPBECipherProvider to allow for non-deterministic IVs. Added new keyed encryption methods and added boolean field for compatibility with new KDFs. Added CipherFactory. Improved Javadoc in NiFi legacy cipher provider and OpenSSL cipher provider. Added KeyedCipherProvider interface. Added OpenSSL PKCS#5 v1.5 EVP_BytesToKey cipher provider and unit test. This closes #201. Signed-off-by: Aldrin Piri <aldrin@apache.org> |
|
|
Andy LoPresto
|
f83e6d33c5 |
NIFI-1242:
Added logic and test resources to debug JCE unlimited strength cryptography policy issues and incorporated into processor property validation.
Excluded test resources from RAT check
Added KeyDerivationFunction enum.
Added kdf property in EncryptContent processor and provided to PasswordBasedEncryptor.
Added logic in PasswordBasedEncryptor to handle variable KDF.
Added unit tests for EncryptContent processor.
Added test resources and excluded from RAT check.
plain.txt: This is a plaintext message.
0s @ 12:20:32 $ openssl enc -aes-256-cbc -e -in plain.txt -out salted_raw.enc -k thisIsABadPassword -p
salt=31DC301A6C7B8A0B
key=CB878A6E167A5B530B8F2BD175E6359E3092AFF7C83274A22A5B421D79E599AC
iv =0C614A72FC06B454B84E035B3FA8F877
0s @ 12:20:44 $ xxd salted_raw.enc
0000000: 5361 6c74 6564 5f5f 31dc 301a 6c7b 8a0b Salted__1.0.l{..
0000010: 616b c65d f767 504d c085 ba7a c517 d0cb ak.].gPM...z....
0000020: 7832 211e f573 b6f1 ded2 8f59 88e8 088f x2!..s.....Y....
0s @ 20:14:00 $ openssl enc -aes-256-cbc -e -in plain.txt -out unsalted_raw.enc -k thisIsABadPassword -p -nosalt
key=711E85689CE7AFF6F410AEA43ABC5446842F685B84879B2E00F977C22B9E9A7D
iv =0C90ABF8ECE84B92BAA2CD448EC760F0
0s @ 20:14:17 $ xxd unsalted_raw.enc
0000000: 70cd 2984 fdbb 0e7c c01b 7206 88b1 6b50 p.)....|..r...kP
0000010: 5eeb e4f3 4036 773b 00ce dd8e 85d8 f90a ^...@6w;........
This closes #140
Signed-off-by: Aldrin Piri <aldrin@apache.org>
|
|
Matt Gilman
|
aaf14c45c9 |
NIFI-655:
- Refactoring web security to use Spring Security Java Configuration. - Introducing security in Web UI in order to get JWT. NIFI-655: - Setting up the resources (js/css) for the login page. NIFI-655: - Adding support for configuring anonymous roles. - Addressing checkstyle violations. NIFI-655: - Moving to token api to web-api. - Creating an LoginProvider API for user/pass based authentication. - Creating a module for funneling access to the authorized useres. NIFI-655: - Moving away from usage of DN to identity throughout the application (from the user db to the authorization provider). - Updating the authorized users schema to support login users. - Creating an extension point for authentication of users based on username/password. NIFI-655: - Creating an endpoint for returning the identity of the current user. - Updating the LoginAuthenticationFilter. NIFI-655: - Moving NiFi registration to the login page. - Running the authentication filters in a different order to ensure we can disambiguate each case. - Starting to layout each case... Forbidden, Login, Create User, Create NiFi Account. NIFI-655: - Addressing checkstyle issues. NIFI-655: - Making nf-storage available in the login page. - Requiring use of local storage. - Ignoring security for GET requests when obtaining the login configuration. NIFI-655: - Adding a new endpoint to obtain the status of a user registration. - Updated the login page loading to ensure all possible states work. NIFI-655: - Ensuring we know the necessary state before we attempt to render the login page. - Building the proxy chain in the JWT authentication filter. - Only rendering the login when appropriate. NIFI-655: - Starting to style the login page. - Added simple 'login' support by identifying username/password. Issuing JWT token coming... - Added logout support - Rendering the username when appropriate. NIFI-655: - Extracting certificate validation into a utility class. - Fixing checkstyle issues. - Cleaning up the web security context. - Removing proxy chain checking where possible. NIFI-655: - Starting to add support for registration. - Creating registration form. NIFI-655: - Starting to implement the JWT service. - Parsing JWT on client side in order to render who the user currently is when logged in. NIFI-655: - Allowing the user to link back to the log in page from the new account page. - Renaming DN to identity where possible. NIFI-655: - Fixing checkstyle issues. NIFI-655: - Adding more/better support for logging out. NIFI-655: - Fixing checkstyle issues. NIFI-655: - Adding a few new exceptions for the login identity provider. NIFI-655: - Disabling log in by default initially. - Restoring authorization service unit test. NIFI-655: - Fixing checkstyle issues. NIFI-655: - Updating packages for log in filters. - Handling new registration exceptions. - Code clean up. NIFI-655: - Removing registration support. - Removing file based implementation. NIFI-655: - Removing file based implementation. NIFI-655: - Removing unused spring configuration files. NIFI-655: - Making the auto wiring more explicit. NIFI-655: - Removing unused dependencies. NIFI-655: - Removing unused filter. NIFI-655: - Updating the login API authenticate method to use a richer set of exceptions. - UI code clean. NIFI-655: - Ensuring the login identity provider is able to switch context classloaders via the standard NAR mechanisms. NIFI-655: - Initial commit of the LDAP based identity providers. - Fixed issue when attempting to log into a NiFi that does not support new account requests. NIFI-655: - Allowing the ldap provider to specify if client authentication is required/desired. NIFI-655: - Persisting keys to sign user tokens. - Allowing the identity provider to specify the token expiration. - Code clean up. NIFI-655: - Ensuring identities are unique in the key table. NIFI-655: - Adding support for specifying the user search base and user search filter in the active directory provider. NIFI-655: - Fixing checkstyle issues. NIFI-655: - Adding automatic client side token renewal. NIFI-655: - Ensuring the logout link is rendered when appropriate. NIFI-655: - Adding configuration options for referrals and connect/read timeouts NIFI-655: - Added an endpoint for access details including configuration, creating tokens, and checking status. - Updated DTOs and client side to utilize new endpoints. NIFI-655: - Refactoring certificate extraction and validation. - Refactoring how expiration is specified in the login identity providers. - Adding unit tests for the access endpoints. - Code clean up. NIFI-655: - Keeping token expiration between 1 minute and 12 hours. NIFI-655: - Using the user identity provided by the login identity provider. NIFI-655: - Fixed typo in error message for unrecognized authentication strategy. Signed-off-by: Matt Gilman <matt.c.gilman@gmail.com> NIFI-655. - Added logback-test.xml configuration resource for nifi-web-security. Signed-off-by: Matt Gilman <matt.c.gilman@gmail.com> NIFI-655. - Added issuer field to LoginAuthenticationToken. - Updated AccessResource to pass identity provider class name when creating LoginAuthenticationTokens. - Began refactoring JWT logic from request parsing logic in JwtService. - Added unit tests for JWT logic. Signed-off-by: Matt Gilman <matt.c.gilman@gmail.com> NIFI-655. - Changed issuer field to use FQ class name because some classes return an empty string for getSimpleName(). - Finished refactoring JWT logic from request parsing logic in JwtService. - Updated AccessResource and JwtAuthenticationFilter to call new JwtService methods decoupled from request header parsing. - Added extensive unit tests for JWT logic. Signed-off-by: Matt Gilman <matt.c.gilman@gmail.com> NIFI-655: - Refactoring key service to expose the key id. - Handling client side expiration better. - Removing specialized active directory provider and abstract ldap provider. NIFI-655. - Updated JwtService and JwtServiceTest to use Key POJO instead of raw String key from KeyService. Signed-off-by: Matt Gilman <matt.c.gilman@gmail.com> NIFI-655: - Fixing typo when loading the ldap connect timeout. - Providing a better experience for session expiration. - Using ellipsis for lengthly user name. - Adding an issuer to the authentication response so the LIP can specify the appropriate value. NIFI-655: - Showing a logging in notification during the log in process. NIFI-655: - Removing unnecessary class. NIFI-655: - Fixing checkstyle issues. - Showing the progress spinner while submitting account justification. NIFI-655: - Removing deprecated authentication strategy. - Renaming TLS to START_TLS. - Allowing the protocol to be configured. NIFI-655: - Fixing issue detecting the presence of DN column NIFI-655: - Pre-populating the login-identity-providers.xml file with necessary properties and documentation. - Renaming the Authentication Duration property name. NIFI-655: - Updating documentation for the failure response codes. NIFI-655: - Ensuring the user identity is not too long. NIFI-655: - Updating default authentication expiration to 12 hours. NIFI-655: - Remaining on the login form when there is any unsuccessful login attempt. - Fixing checkstyle issues. |
|
joewitt
|
aa99884782 | NIFI-850 removed nifi parent, updated nifi pom, moved all nifi subdirs up one level, fixed readme. |