[ https://issues.apache.org/jira/browse/NIFI-2119?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15361980#comment-15361980 ]
Andy LoPresto commented on NIFI-2119: ------------------------------------- Hi [~jskora], I have identified the issue -- the {{SSLSocket}} was being treated identically regardless of whether it was in {{client}} or {{server}} mode. I have refactored the logic and added a check for {{SSLSocket.getUseClientMode()}} to determine if it should check the incoming request's client certificates (in which case it respects the {{nifi.security.needClientAuth}} setting), or if it is trying to connect to a server socket (i.e. getting the NCM DN), in which case it now correctly ignores that setting. I have unit test coverage for all the changes as well as some regression tests. I will deploy it to a test cluster tomorrow morning and verify it works live, and then if all goes well, open a PR. Sorry I haven't been good about keeping the Jira updated. My code is here if you want to take a look (rebased against latest {{upstream/0.x}} but not yet squashed): [https://github.com/alopresto/nifi/tree/NIFI-2119] > Secure clustering returning bad request response > ------------------------------------------------ > > Key: NIFI-2119 > URL: https://issues.apache.org/jira/browse/NIFI-2119 > Project: Apache NiFi > Issue Type: Bug > Components: Core Framework > Reporter: Joseph Witt > Fix For: 0.7.0 > > > Cannot get a secured cluster working that worked well on 0.6.0. After > upgrading now seeing the following line. It either means I upgraded > incorrectly, or we're missing critical migration guidance, or we have > introduced a new bug. > 2016-06-25 14:19:12,017 INFO [NiFi Web Server-23] > o.a.n.w.a.c.IllegalArgumentExceptionMapper > java.lang.IllegalArgumentException: User account already created > CN=box1.testing.org, OU=NIFI, O=Apache-NiFi, L=Here, ST=There, C=EVERYWHERE. > Returning Bad Request response. > Speaking with [~mcgilman] about this he looked into it and says > "the socket used for cluster communications is configured with an sslContext > that has client auth set to none... which seems to be why the we're not > getting the NCM DN during connection > i think the issue is this part of this commit.... > https://github.com/apache/nifi/commit/7b5583f3a8c8e3f62e2985059a3466a5bb36f4e8#diff-a14f46a45c394fbd82a2b99730e04bcbR68" -- This message was sent by Atlassian JIRA (v6.3.4#6332)