Lightweight Directory Access Protocol (LDAP)

Below is an example and description of configuring a Identity Provider that integrates with a Directory Server to authenticate users.

Set the following in nifi-registry.properties to enable LDAP username/password authentication:


nifi.registry.security.identity.provider=ldap-identity-provider

Modify identity-providers.xml to enable the ldap-identity-provider. Here is the sample provided in the file:


<provider>
    <identifier>ldap-identity-provider</identifier>
    <class>org.apache.nifi.registry.security.ldap.LdapIdentityProvider</class>
    <property name="Authentication Strategy">START_TLS</property>

    <property name="Manager DN"></property>
    <property name="Manager Password"></property>

    <property name="TLS - Keystore"></property>
    <property name="TLS - Keystore Password"></property>
    <property name="TLS - Keystore Type"></property>
    <property name="TLS - Truststore"></property>
    <property name="TLS - Truststore Password"></property>
    <property name="TLS - Truststore Type"></property>
    <property name="TLS - Client Auth"></property>
    <property name="TLS - Protocol"></property>
    <property name="TLS - Shutdown Gracefully"></property>

    <property name="Referral Strategy">FOLLOW</property>
    <property name="Connect Timeout">10 secs</property>
    <property name="Read Timeout">10 secs</property>

    <property name="Url"></property>
    <property name="User Search Base"></property>
    <property name="User Search Filter"></property>

    <property name="Identity Strategy">USE_DN</property>
    <property name="Authentication Expiration">12 hours</property>
</provider>

The ldap-identity-provider has the following properties:


Property Name	Description
`Authentication Expiration`	The duration of how long the user authentication is valid for. If the user never logs out, they will be required to log back in following this duration.
`Authentication Strategy`	How the connection to the LDAP server is authenticated. Possible values are `ANONYMOUS`, `SIMPLE`, `LDAPS`, or `START_TLS`.
`Manager DN`	The DN of the manager that is used to bind to the LDAP server to search for users.
`Manager Password`	The password of the manager that is used to bind to the LDAP server to search for users.
`TLS - Keystore`	Path to the Keystore that is used when connecting to LDAP using LDAPS or START_TLS.
`TLS - Keystore Password`	Password for the Keystore that is used when connecting to LDAP using LDAPS or START_TLS.
`TLS - Keystore Type`	Type of the Keystore that is used when connecting to LDAP using LDAPS or START_TLS (i.e. `JKS` or `PKCS12`).
`TLS - Truststore`	Path to the Truststore that is used when connecting to LDAP using LDAPS or START_TLS.
`TLS - Truststore Password`	Password for the Truststore that is used when connecting to LDAP using LDAPS or START_TLS.
`TLS - Truststore Type`	Type of the Truststore that is used when connecting to LDAP using LDAPS or START_TLS (i.e. `JKS` or `PKCS12`).
`TLS - Client Auth`	Client authentication policy when connecting to LDAP using LDAPS or START_TLS. Possible values are `REQUIRED`, `WANT`, `NONE`.
`TLS - Protocol`	Protocol to use when connecting to LDAP using LDAPS or START_TLS. (i.e. `TLS`, `TLSv1.1`, `TLSv1.2`, etc).
`TLS - Shutdown Gracefully`	Specifies whether the TLS should be shut down gracefully before the target context is closed. Defaults to `false`.
`Referral Strategy`	Strategy for handling referrals. Possible values are `FOLLOW`, `IGNORE`, `THROW`.
`Connect Timeout`	Duration of connect timeout. (i.e. `10 secs`).
`Read Timeout`	Duration of read timeout. (i.e. `10 secs`).
`Url`	Space-separated list of URLs of the LDAP servers (i.e. `ldap://<hostname>:<port>`).
`User Search Base`	Base DN for searching for users (i.e. `CN=Users,DC=example,DC=com`).
`User Search Filter`	Filter for searching for users against the `User Search Base`. (i.e. `sAMAccountName={0}`). The user specified name is inserted into '{0}'.
`Identity Strategy`	Strategy to identify users. Possible values are `USE_DN` and `USE_USERNAME`. The default functionality if this property is missing is `USE_DN` in order to retain backward compatibility. `USE_DN` will use the full DN of the user entry if possible. `USE_USERNAME` will use the username the user logged in with.