[ https://issues.apache.org/jira/browse/NIFIREG-33?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16240870#comment-16240870 ]
ASF GitHub Bot commented on NIFIREG-33: --------------------------------------- Github user bbende commented on the issue: https://github.com/apache/nifi-registry/pull/29 @kevdoran I looked into the issue with the app not shutting down cleanly... taking a thread dump showed: ``` " (ldap-user-group-provider) - background sync thread" #28 prio=5 os_prio=31 tid=0x00007f86f06f2000 nid=0x140b waiting on condition [0x0000700002cf5000] java.lang.Thread.State: TIMED_WAITING (parking) at sun.misc.Unsafe.park(Native Method) - parking to wait for <0x00000007a1560750> (a java.util.concurrent.locks.AbstractQueuedSynchronizer$ConditionObject) at java.util.concurrent.locks.LockSupport.parkNanos(LockSupport.java:215) at java.util.concurrent.locks.AbstractQueuedSynchronizer$ConditionObject.awaitNanos(AbstractQueuedSynchronizer.java:2078) at java.util.concurrent.ScheduledThreadPoolExecutor$DelayedWorkQueue.take(ScheduledThreadPoolExecutor.java:1093) at java.util.concurrent.ScheduledThreadPoolExecutor$DelayedWorkQueue.take(ScheduledThreadPoolExecutor.java:809) at java.util.concurrent.ThreadPoolExecutor.getTask(ThreadPoolExecutor.java:1074) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1134) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) at java.lang.Thread.run(Thread.java:748) ``` Digging in further, I realized we don't have a concept of shutting down extensions, even though the authorizer, user/group provider, and policy providers do have a preDestruction method which would have shutdown that thread if we called it. Tested a change where I made AuthorizerFactory extend DisposableBean and added: ``` @Override public void destroy() throws Exception { if (authorizers != null) { authorizers.entrySet().stream().forEach(e -> e.getValue().preDestruction()); } if (accessPolicyProviders != null) { accessPolicyProviders.entrySet().stream().forEach(e -> e.getValue().preDestruction()); } if (userGroupProviders != null) { userGroupProviders.entrySet().stream().forEach(e -> e.getValue().preDestruction()); } } ``` This appears to work, so if you can add that for AuthorizerFactory and LoginIdentityProviderFactory then we should be good for that one. > Add LDAP and JWT identity providers NiFi Registry security framework > -------------------------------------------------------------------- > > Key: NIFIREG-33 > URL: https://issues.apache.org/jira/browse/NIFIREG-33 > Project: NiFi Registry > Issue Type: Improvement > Reporter: Kevin Doran > Assignee: Kevin Doran > > The initial addition of a security model to the NiFi Registry framework only > included support for certificates as a means of establishing client identity > for authentication. > In order to support more flexible methods of client authentication, this > ticket is to provider two new identity providers: > * LDAPProvider - will verify username/password for authentication and allow > JWT token generation via the REST API > * JWTIdentityProvider - will authenticate tokens that were generated by the > registry on subsequent requests. -- This message was sent by Atlassian JIRA (v6.4.14#64029)