Security Configuration
NiFi provides several different configuration options for security purposes. The most important properties are those under the "security properties" heading in the nifi.properties file. In order to run securely, the following properties must be set:
Property Name | Description |
---|---|
|
Set to |
|
Filename of the Keystore that contains the server's private key. |
|
The type of Keystore. Must be either |
|
The password for the Keystore. |
|
The password for the certificate in the Keystore. If not set, the value of |
|
Filename of the Truststore that will be used to authorize those connecting to NiFi. A secured instance with no Truststore will refuse all incoming connections. |
|
The type of the Truststore. Must be either |
|
The password for the Truststore. |
Once the above properties have been configured, we can enable the User Interface to be accessed over HTTPS instead of HTTP. This is accomplished by setting the nifi.web.https.host
and nifi.web.https.port
properties. The nifi.web.https.host
property indicates which hostname the server should run on. If it is desired that the HTTPS interface be accessible from all network interfaces, a value of 0.0.0.0
should be used. To allow admins to configure the application to run only on specific network interfaces, nifi.web.http.network.interface*
or nifi.web.https.network.interface*
properties can be specified.
Note | |
---|---|
It is important when enabling HTTPS that the nifi.web.http.port property be unset. NiFi only supports running on HTTP or HTTPS, not both simultaneously. |
Similar to nifi.security.needClientAuth
, the web server can be configured
to require certificate based client authentication for users accessing the User Interface.
Either
of these options will configure the web server to WANT certificate based client
authentication. This will allow it to support users with certificates and those without
that may be logging in with their credentials or those accessing anonymously. If
username/password authentication and anonymous access are not configured, the web server
will REQUIRE certificate based client authentication.
Now that the User Interface has been secured, we can easily secure Site-to-Site connections and inner-cluster communications, as well. This is accomplished by setting the nifi.remote.input.secure
and nifi.cluster.protocol.is.secure
properties, respectively, to true
.