不同虚拟机上的 Apache NIFI SSL 集群。自动化问题（我猜）答案

【问题标题】：Apache NIFI SSL cluster on separate VMs. Autorization issue(I guess)不同虚拟机上的 Apache NIFI SSL 集群。自动化问题（我猜）
【发布时间】：2020-03-17 00:07:02
【问题描述】：

我需要 Apache NIFI 集群配置方面的帮助。我配置了独立的 NIFI，没有 SSL 的集群，但是在使用 SSL 配置 NIFI 集群时我遇到了一些问题。

我猜证书生成和 authorizers.xml 文件之间存在问题。

./logs/nifi-user.log 中的错误：

2020-03-13 17:22:47,365 WARN [NiFi Web Server-22] o.a.n.w.s.NiFiAuthenticationFilter Rejecting access to web api: Untrusted proxy CN=myhost, OU=NIFI

网页界面错误：

Insufficient Permissions
Untrusted proxy CN=myhost, OU=NIFI

这是我的 authorizers.xml：

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<authorizers>

<userGroupProvider>
<identifier>ldap-user-group-provider</identifier>
<class>org.apache.nifi.ldap.tenants.LdapUserGroupProvider</class>
<property name="Authentication Strategy">ANONYMOUS</property>

<property name="Manager DN"></property>
<property name="Manager Password"></property>

<property name="TLS - Keystore"></property>
<property name="TLS - Keystore Password"></property>
<property name="TLS - Keystore Type"></property>
<property name="TLS - Truststore"></property>
<property name="TLS - Truststore Password"></property>
<property name="TLS - Truststore Type"></property>
<property name="TLS - Client Auth"></property>
<property name="TLS - Protocol"></property>
<property name="TLS - Shutdown Gracefully"></property>

<property name="Referral Strategy">FOLLOW</property>
<property name="Connect Timeout">10 secs</property>
<property name="Read Timeout">10 secs</property>

<property name="Url">ldap://myldap.org:389</property>
<property name="Page Size"></property>
<property name="Sync Interval">30 mins</property>

<property name="User Search Base">ou=People,dc=mydomain,dc=org</property>
<property name="User Object Class">person</property>
<property name="User Search Scope">ONE_LEVEL</property>
<property name="User Search Filter"></property>
<property name="User Identity Attribute">uid</property>
<property name="User Group Name Attribute"></property>
<property name="User Group Name Attribute - Referenced Group Attribute"></property>

<property name="Group Search Base">ou=Group,dc=mydomain,dc=org</property>
<property name="Group Object Class">posixGroup</property>
<property name="Group Search Scope">ONE_LEVEL</property>
<property name="Group Search Filter"></property>
<property name="Group Name Attribute">cn</property>
<property name="Group Member Attribute">memberUid</property>
<property name="Group Member Attribute - Referenced User Attribute"></property>
</userGroupProvider>

<accessPolicyProvider>
<identifier>file-access-policy-provider</identifier>
<class>org.apache.nifi.authorization.FileAccessPolicyProvider</class>
<property name="User Group Provider">ldap-user-group-provider</property>
<property name="Authorizations File">./conf/authorizations.xml</property>
<property name="Initial Admin Identity">iamadmin</property>
<property name="Legacy Authorized Users File"></property>
<property name="Node Identity 1"></property>
<property name="Node Group"></property>
</accessPolicyProvider>


<authorizer>
<identifier>managed-authorizer</identifier>
<class>org.apache.nifi.authorization.StandardManagedAuthorizer</class>
<property name="Access Policy Provider">file-access-policy-provider</property>
</authorizer>

我使用这个命令创建了证书：

./bin/tls-toolkit.sh standalone -n myhost1,myhost2,myhost3  --subjectAlternativeNames myhost1,myhost2,myhost3 -o ../standalonecerts/

任何帮助将不胜感激。

P.S.：没有人有容器中安全集群配置的示例吗？ Docker-compose 文件什么的。

UPD2：

我完全按照你说的做了，现在所有主机上的配置部分都是这样的：

   <accessPolicyProvider>
        <identifier>file-access-policy-provider</identifier>
        <class>org.apache.nifi.authorization.FileAccessPolicyProvider</class>
        <property name="User Group Provider">ldap-user-group-provider</property>
        <property name="Authorizations File">./conf/authorizations.xml</property>
        <property name="Initial Admin Identity">iamadmin</property>
        <property name="Legacy Authorized Users File"></property>
        <property name="Node Identity 1">myhost1</property>
        <property name="Node Identity 2">myhost2</property>
        <property name="Node Identity 3">myhost3</property>
        <property name="Node Group"></property>
    </accessPolicyProvider>

但现在 nifi 根本没有启动。

错误 myhost1：

Caused by: org.apache.nifi.authorization.exception.AuthorizerCreationException: org.apache.nifi.authorization.exception.AuthorizerCreationException: Unable to locate node CN=myhost1, OU=NIFI to seed policies.

错误 myhost2：

Caused by: org.apache.nifi.authorization.exception.AuthorizerCreationException: org.apache.nifi.authorization.exception.AuthorizerCreationException: Unable to locate node CN=myhost2, OU=NIFI to seed policies.

UPD3

好的，所以我去指导 NIFI Admin Guide

，这是我的新 autorizers.xml

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>

<authorizers>

    <userGroupProvider>
        <identifier>file-user-group-provider</identifier>
        <class>org.apache.nifi.authorization.FileUserGroupProvider</class>
        <property name="Users File">./conf/users.xml</property>
        <property name="Legacy Authorized Users File"></property>

        <property name="Initial User Identity 1">CN=myhost1, OU=NIFI</property>

        <property name="Initial User Identity 2">CN=myhost2, OU=NIFI</property>


    </userGroupProvider>



    <userGroupProvider>
        <identifier>ldap-user-group-provider</identifier>
        <class>org.apache.nifi.ldap.tenants.LdapUserGroupProvider</class>
        <property name="Authentication Strategy">ANONYMOUS</property>

        <property name="Manager DN"></property>
        <property name="Manager Password"></property>

        <property name="TLS - Keystore"></property>
        <property name="TLS - Keystore Password"></property>
        <property name="TLS - Keystore Type"></property>
        <property name="TLS - Truststore"></property>
        <property name="TLS - Truststore Password"></property>
        <property name="TLS - Truststore Type"></property>
        <property name="TLS - Client Auth"></property>
        <property name="TLS - Protocol"></property>
        <property name="TLS - Shutdown Gracefully"></property>

        <property name="Referral Strategy">FOLLOW</property>
        <property name="Connect Timeout">10 secs</property>
        <property name="Read Timeout">10 secs</property>

        <property name="Url">ldap://myldap:389</property>
        <property name="Page Size"></property>
        <property name="Sync Interval">30 mins</property>

        <property name="User Search Base">ou=People,dc=mydomain,dc=org</property>
        <property name="User Object Class">person</property>
        <property name="User Search Scope">ONE_LEVEL</property>
        <property name="User Search Filter"></property>
        <property name="User Identity Attribute">uid</property>
        <property name="User Group Name Attribute"></property>
        <property name="User Group Name Attribute - Referenced Group Attribute"></property>

        <property name="Group Search Base">ou=Group,dc=mydomain,dc=org</property>
        <property name="Group Object Class">posixGroup</property>
        <property name="Group Search Scope">ONE_LEVEL</property>
        <property name="Group Search Filter"></property>
        <property name="Group Name Attribute">cn</property>
        <property name="Group Member Attribute">memberUid</property>
        <property name="Group Member Attribute - Referenced User Attribute"></property>
    </userGroupProvider>


    <userGroupProvider>
        <identifier>composite-user-group-provider</identifier>
        <class>org.apache.nifi.authorization.CompositeUserGroupProvider</class>
        <property name="Configurable User Group Provider">file-user-group-provider</property>
        <property name="User Group Provider 1">ldap-user-group-provider</property>
    </userGroupProvider>


    <accessPolicyProvider>
        <identifier>file-access-policy-provider</identifier>
        <class>org.apache.nifi.authorization.FileAccessPolicyProvider</class>
        <property name="User Group Provider">composite-user-group-provider</property>
        <property name="Authorizations File">./conf/authorizations.xml</property>
        <property name="Initial Admin Identity">iamadmin</property>
        <property name="Legacy Authorized Users File"></property>
        <property name="Node Identity 1">CN=myhost1, OU=NIFI</property>
        <property name="Node Identity 2">CN=myhost2, OU=NIFI</property>
    </accessPolicyProvider>


    <authorizer>
        <identifier>managed-authorizer</identifier>
        <class>org.apache.nifi.authorization.StandardManagedAuthorizer</class>
        <property name="Access Policy Provider">file-access-policy-provider</property>
    </authorizer>

</authorizers>

但我还是有错误

Caused by: org.apache.nifi.authorization.exception.AuthorizerCreationException: org.apache.nifi.authorization.exception.AuthorizerCreationException: Unable to locate node CN=myhost2, OU=NIFI to seed policies.

拜托，你能告诉我我做错了什么吗？

【问题讨论】：

标签： apache-nifi

【解决方案1】：

您需要在 authorizers.xml 中指定节点身份，以便为每个节点创建正确的代理策略：

<property name="Node Identity 1"></property>

由于您已经启动了一次应用程序，您需要停止应用程序，删除 users.xml 和 authorizations.xml，然后编辑 authorizers.xml 以添加节点身份，然后启动。

【讨论】：

查看 UPD2 。更改后 NIFI 根本不启动
节点身份需要与证书中的 DN 匹配，因此“CN=myhost1, OU=NIFI”然后这些身份需要存在于 UserGroupProvider 中，因此您需要将它们添加到您的LDAP 就像他们是用户一样，或者您可以使用您可以在 NiFi 管理指南中阅读的 CompositeUserGroupProvider
它看起来是正确的，仔细检查空格和区分大小写的问题，还要确保在您更改 authorizers.xml 中的任何内容时删除 users.xml 和 authorizations.xml 以重新开始
是的...我不知道是什么问题，我只是试图从官方文档中复制 authorizers.xml 示例，但意外地成功了。感谢您的宝贵时间！