File-Based Authorization

When Ranger is not selected as a dependency during installation, NiFi or NiFi Registry’s internal file-based authorizer will be used for authorization.

When Ranger is not selected, the NiFi and NiFi Registry CSD scripts will perform the following steps:
  • By default, during start-up, NiFi and NiFi Registry will create the following files in /var/lib/nifi and /var/lib/nifiregistry:
    • users.xml
    • authorizations.xml

    These files will include the users and policies for the Initial Admin Identity, Initial Admin Groups, and proxy group.

  • Create policies for the following Initial Admin Identity and Initial Admin Groups:
    • For NiFi: nifi.initial.admin.identity and nifi.initial.admin.groups
    • For NiFi Registry: nifi.registry.initial.admin.identity and nifi.registry.initial.admin.groups
  • Create policies for proxies specified by nifi.proxy.group or nifi.registry.proxy.group.

Each authorizers.xml file produced in NiFi and NiFi Registry when using file-based authorization contains the following logical configuration:

  • CompositeConfigurableUserGroupProvider
    • FileUserGroupProvider
    • CMUserGroupProvider
  • FileAccessPolicyProvider
    • Configured with the CompositeConfigurableUserGroupProvider
  • StandardManagedAuthorizer
    • Configured with FileAccessPolicyProvider