GitHub user kevdoran opened a pull request:
https://github.com/apache/nifi-registry/pull/14
NIFIREG-9: Initial Auth Implementation
This is a rather large PR, including:
- Authentication and authorization enforcement for web API, largely based
on NiFi.
- This adds interfaces, framework, and file-based authorizer providers
(file access policy provider, file user group provider).
- Authentication of identities is currently based on certificates in
two-way SSL (HTTPS). Alternative identity strategies (user&pass, JWT) will be
added later building upon the foundation in this commit.
For reviewers, a good place to start is *AuthorizationService.java*. That
is called be Resources (web api endpoints) for authorizing requests. It makes
use of authorizer providers (access policy provider and user group provider),
which are interfaces and implementations heavily based in NiFi.
To run this, see the instructions in included authorizers.xml file.
Configure that with your initial admin identity (must be certificate based) and
configure your properties file to use your configured authorizers.
This functionality has been verified through manual testing. Documentation
on proper configuration (aside what is in the provided in comment ins the
included authorizers.xml example file) is in progress. Automated tests cases
(unit, integration, etc.) are in progress and will likely be added to the PR
during the time it is reviewed, but opening it now to get initial feedback,
especially where it defines/modifies key interfaces.
As part of this feature, some changes were made to the RegistryService
interface and the providers it utilizes. @bbende please review these changes
when you get a change to make sure they are consistent with your design and
intentions for the service and provider layers. Thanks!
You can merge this pull request into a Git repository by running:
$ git pull https://github.com/kevdoran/nifi-registry NIFIREG-9
Alternatively you can review and apply these changes as the patch at:
https://github.com/apache/nifi-registry/pull/14.patch
To close this pull request, make a commit to your master/trunk branch
with (at least) the following in the commit message:
This closes #14
----
commit e79bb8a4735ba55ebfd7d665ee2acf3d998b3106
Author: Kevin Doran <[email protected]>
Date: 2017-10-03T02:40:26Z
NIFIREG-9: Initial Auth Implementation
Authentication and authorization enforcement for web API, largely based on
NiFi.
This commit adds interfaces, framework, and file-based authorizer providers
(file access policy provider, file user group provider).
Authentication of identities is currently based on certificates in two-way
SSL (HTTPS). Alternative identity strategies (user&pass, JWT) will
be added later building upon the foundation in this commit.
As part of this feature, some changes were made to the RegistryService
interface and the providers it utilizes.
----
---
