Matt,
The problem is access policies on the input port on the main NiFi:
We are using LDAP on the main NiFi, and when I create Site to Site comms
between NiFi instances I have to create a user in NiFi based on the
owner name in the cert from the remote. Once I have that user, I have
to ADD that user to an access policy on the input port to allow that
port to receive data from the remote. In addition, I have to do a
similar thing for a policy to allow the RPG to be able to get the list
of remote ports.
The issue I am having with this is it is a very manual process right
now: for each remote, I would need to get the cert, get the owner name,
create a user in the main NiFi and associate the user with the policy
for the input ports.
My question was probably less about MiNiFi and more about how to
optimize the SSL relationships and if there was a shortcut I could use
to avoid having to do the user creation and custom policy mod for each
remote.
Dave
------ Original Message ------
From: "Matt Burgess" <[email protected]>
To: [email protected]
Sent: 4/17/2022 9:48:29 AM
Subject: Re: Minifi and ssl config on NiFi
MiNiFi is actually alive and well, we just moved it into the NiFi codebase.
We’re actively developing a Command-and-Control (C2) capability to remotely
update the flow on the agent for example.
You can configure MiNiFi agents for SSL over Site-to-Site in order to talk to
secure NiFi instances. Not sure about the need for a user but you would need to
present a certificate the same as you would for connecting to the NiFi UI. Some
security features still need to be implemented (like encrypted properties
maybe) but you should definitely be able to do what you’re trying to do with
MiNiFi, happy to help with any issues you may run into.
Regards,
Matt
On Apr 17, 2022, at 11:40 AM, Jorge Machado <[email protected]> wrote:
I did this on the pass and I end up switching to Nifi. I think you should do
the same. Minifi is kind of “Dead” not being developed anymore. I found better
to just switch to single instance of nifi
Regards
Jorge
On 17. Apr 2022, at 03:30, David Early <[email protected]> wrote:
We are considering using several dozen minifi instances to gather data at
remote locations and send it to a cloud based central NiFi.
The problem I am THINKING we will have is setting up ssl. The only way I know
of to set up ssl for site to site requires a user be configured for the
incoming data on the destination NiFi and permissions given to that user to be
able to send data.
Am I missing something? Will we have to manually set up a user in the cloud
NiFi for each minifi instances so we can use ssl transport?
Dave
