76f2d5702f
NIFI-1274 Cleaned up TODO statements. (+3 squashed commits) Squashed commits: [fd101cd] Removed logic to check for presence of services to determine if token support is enabled when username/password authentication is enabled (Kerberos also requires tokens). [c2ce29f] Reverted import changes to RulesResource.java. [c269d72] Added Kerberos authentication mechanism. Moved Kerberos service wiring from XML to Java to handle scenario where admin has not configured Kerberos (previously threw NullPointerException in FileSystemResource constructor). (+15 squashed commits) Squashed commits: [09fc694] Added Kerberos documentation to Admin Guide. [ecfb864] Cleaned up unused logic. [157efb3] Added logic to determine if client certificates are required for REST API (login, anonymous, and Kerberos service authentication all disabled). Cleaned up KerberosService by moving logic to NiFiProperties. [5438619] Added documentation for Kerberos login-identity-providers.xml. [3332d9f] Added NiFi properties for Kerberos SSO. [b14a557] Fixed canvas call to only attempt Kerberos login if JWT not present in local storage. Added logic to handle ticket validation failure in AccessResource. Changed wiring of Kerberos service beans to XML in nifi-web-security-context.xml for consistency. [c31ae3d] Kerberos SPNEGO works without additional filter (new entry endpoint accepts Kerberos ticket in Authorization header and returns JWT so the rest of the application functions the same as LDAP). [98460e7] Added check to only instantiate beans when Kerberos enabled to allow access control integration tests to pass. [6ed0724] Renamed Kerberos discovery method to be explicit about service vs. credential login. [ed67d2e] Removed temporary solution for Rules Resource access via Kerberos ticket. [c8b2b01] Added temporary solution for Rules Resource access via Kerberos ticket. [81ca80f] NIFI-1274 Added KerberosAuthenticationFilter to conduct SPNEGO authentication with local (client) Kerberos ticket. Added properties and accessors for service principal and keytab location for NiFi app server. Added KAF to NiFiWebApiSecurityConfiguration. Added AlternateKerberosUserDetailsService to provide user lookup without dependency on extension bundle (nifi-kerberos-iaa-provider). Added dependencies on spring-security-kerberos-core and -web modules to pom.xml. [0605ba8] Added working configuration files to test/resources in kerberos module to document necessary config. This version requires the user to enter their Kerberos username (without realm) and password into the NiFi login screen and will authenticate them against the running KDC. Also includes a sample keystore and root CA public key for configuring a secure instance. [49236c8] Added kerberos module dependencies to nifi/pom.xml and nifi-assembly/pom.xml. Added default properties to login-identity-providers.xml. [928c52b] Added nifi-kerberos-iaa-providers-bundle module to nifi/pom.xml. Added skeleton of Kerberos authenticator using Spring Security Kerberos plugin. This closes #284 Signed-off-by: Matt Gilman <matt.c.gilman@gmail.com> |
||
|---|---|---|
| .. | ||
| src/main/assembly | ||
| LICENSE | ||
| NOTICE | ||
| README.md | ||
| pom.xml | ||
README.md
Apache NiFi
Apache NiFi is an easy to use, powerful, and reliable system to process and distribute data.
Table of Contents
- Features
- Getting Started
- Getting Help
- Requirements
- License
- [Export Control] (#export-control)
Features
Apache NiFi was made for dataflow. It supports highly configurable directed graphs of data routing, transformation, and system mediation logic. Some of its key features include:
- Web-based user interface
- Seamless experience for design, control, and monitoring
- Highly configurable
- Loss tolerant vs guaranteed delivery
- Low latency vs high throughput
- Dynamic prioritization
- Flows can be modified at runtime
- Back pressure
- Data Provenance
- Track dataflow from beginning to end
- Designed for extension
- Build your own processors and more
- Enables rapid development and effective testing
- Secure
- SSL, SSH, HTTPS, encrypted content, etc...
- Pluggable role-based authentication/authorization
Getting Started
To start NiFi:
- [linux/osx] execute bin/nifi.sh start
- [windows] execute bin/start-nifi.bat
- Direct your browser to http://localhost:8080/nifi/
Getting Help
If you have questions, you can reach out to our mailing list: dev@nifi.apache.org (archive). We're also often available in IRC: #nifi on irc.freenode.net.
Requirements
- JDK 1.7 or higher
License
Except as otherwise noted this software is licensed under the Apache License, Version 2.0
Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
Export Control
This distribution includes cryptographic software. The country in which you currently reside may have restrictions on the import, possession, use, and/or re-export to another country, of encryption software. BEFORE using any encryption software, please check your country's laws, regulations and policies concerning the import, possession, or use, and re-export of encryption software, to see if this is permitted. See http://www.wassenaar.org/ for more information.
The U.S. Government Department of Commerce, Bureau of Industry and Security (BIS), has classified this software as Export Commodity Control Number (ECCN) 5D002.C.1, which includes information security software using or performing cryptographic functions with asymmetric algorithms. The form and manner of this Apache Software Foundation distribution makes it eligible for export under the License Exception ENC Technology Software Unrestricted (TSU) exception (see the BIS Export Administration Regulations, Section 740.13) for both object code and source code.
The following provides more details on the included cryptographic software:
Apache NiFi uses BouncyCastle, Jasypt, JCraft Inc., and the built-in java cryptography libraries for SSL, SSH, and the protection of sensitive configuration parameters. See http://bouncycastle.org/about.html http://www.jasypt.org/faq.html http://jcraft.com/c-info.html http://www.oracle.com/us/products/export/export-regulations-345813.html for more details on each of these libraries cryptography features.