SAML Authentication

After you install NiFi, you can enable authentication through a Security Assertion Markup Language (SAML) identity provider.

With SAML authentication, when a user attempts to access NiFi, NiFi redirects the user to the corresponding identity provider to log in. After the user logs into the identity provider, the identity provider sends NiFi a response that contains the user's credentials. With knowledge of the user's identity, NiFi can now authenticate the user.

To enable authentication through a SAML identity provider, set the following SAML related properties in the nifi.properties file. Then, restart NiFi for the changes in the nifi.properties file to take effect. If NiFi is clustered, configuration files must be the same on all nodes.


Property	Description
`nifi.security.user.saml.idp.metadata.url`	The URL for obtaining the identity provider’s metadata. The metadata can be retrieved from the identity provider through `http://` or `https://`, or a local file can be referenced using `file://`.
`nifi.security.user.saml.sp.entity.id`	The entity ID of the service provider (i.e. NiFi). This value will be used as the `Issuer` for SAML authentication requests and should be a valid URI. In some cases the service provider entity ID must be registered ahead of time with the identity provider.
`nifi.security.user.saml.identity.attribute.name`	The name of a SAML assertion attribute containing the user's identity. This property is optional and if not specified, or if the attribute is not found, then the NameID of the Subject will be used.
`nifi.security.user.saml.group.attribute.name`	The name of a SAML assertion attribute containing group names the user belongs to. This property is optional, but if populated the groups will be passed along to the authorization process.
`nifi.security.user.saml.metadata.signing.enabled`	Enables signing of the generated service provider metadata.
`nifi.security.user.saml.request.signing.enabled`	Controls the value of `AuthnRequestsSigned` in the generated service provider metadata from `nifi-api/access/saml/metadata`. This indicates that the service provider (i.e. NiFi) should not sign authentication requests sent to the identity provider, but the requests may still need to be signed if the identity provider indicates `WantAuthnRequestSigned=true`.
`nifi.security.user.saml.want.assertions.signed`	Controls the value of `WantAssertionsSigned` in the generated service provider metadata from `nifi-api/access/saml/metadata`. This indicates that the identity provider should sign assertions, but some identity providers may provide their own configuration for controlling whether assertions are signed.
`nifi.security.user.saml.signature.algorithm`	The algorithm to use when signing SAML messages. See the Open SAML Signature Constants for a list of valid values. If not specified, a default of SHA-256 will be used.
`nifi.security.user.saml.signature.digest.algorithm`	The digest algorithm to use when signing SAML messages. See the Open SAML Signature Constants for a list of valid values. If not specified, a default of SHA-256 will be used.
`nifi.security.user.saml.message.logging.enabled`	Enables logging of SAML messages for debugging purposes.
`nifi.security.user.saml.authentication.expiration`	The expiration of the NiFi JWT that will be produced from a successful SAML authentication response.
`nifi.security.user.saml.single.logout.enabled`	Enables SAML SingleLogout which causes a logout from NiFi to logout of the identity provider. By default, a logout of NiFi will only remove the NiFi JWT.
`nifi.security.user.saml.http.client.truststore.strategy`	The truststore strategy when the IDP metadata URL begins with `https`. A value of `JDK` indicates to use the JDK’s default truststore. A value of`NIFI`indicates to use the truststore specified by `nifi.security.truststore`.
`nifi.security.user.saml.http.client.connect.timeout`	The connection timeout when communicating with the SAML IDP.
`nifi.security.user.saml.http.client.read.timeout`	The read timeout when communicating with the SAML IDP.