Hi Dave, you could use a (custom) CA for your client certs, so only the CA-cert would need to be trusted. And for policies, you could use an LDAP group and base policies on that. Downside is that NiFi currently doesn't offer certificate revocation afaik, so it might not be applicable to you.
Best, Lars On 18 April 2022 17:31:14 CEST, David Early <[email protected]> wrote: >Matt, > >The problem is access policies on the input port on the main NiFi: > >We are using LDAP on the main NiFi, and when I create Site to Site comms >between NiFi instances I have to create a user in NiFi based on the >owner name in the cert from the remote. Once I have that user, I have >to ADD that user to an access policy on the input port to allow that >port to receive data from the remote. In addition, I have to do a >similar thing for a policy to allow the RPG to be able to get the list >of remote ports. > >The issue I am having with this is it is a very manual process right >now: for each remote, I would need to get the cert, get the owner name, >create a user in the main NiFi and associate the user with the policy >for the input ports. > >My question was probably less about MiNiFi and more about how to >optimize the SSL relationships and if there was a shortcut I could use >to avoid having to do the user creation and custom policy mod for each >remote. > >Dave > >------ Original Message ------ >From: "Matt Burgess" <[email protected]> >To: [email protected] >Sent: 4/17/2022 9:48:29 AM >Subject: Re: Minifi and ssl config on NiFi > >>MiNiFi is actually alive and well, we just moved it into the NiFi codebase. >>We’re actively developing a Command-and-Control (C2) capability to remotely >>update the flow on the agent for example. >> >>You can configure MiNiFi agents for SSL over Site-to-Site in order to talk to >>secure NiFi instances. Not sure about the need for a user but you would need >>to present a certificate the same as you would for connecting to the NiFi UI. >>Some security features still need to be implemented (like encrypted >>properties maybe) but you should definitely be able to do what you’re trying >>to do with MiNiFi, happy to help with any issues you may run into. >> >>Regards, >>Matt >> >> >>> On Apr 17, 2022, at 11:40 AM, Jorge Machado <[email protected]> wrote: >>> >>> I did this on the pass and I end up switching to Nifi. I think you should >>> do the same. Minifi is kind of “Dead” not being developed anymore. I found >>> better to just switch to single instance of nifi >>> >>> Regards >>> Jorge >>> >>>> On 17. Apr 2022, at 03:30, David Early <[email protected]> wrote: >>>> >>>> We are considering using several dozen minifi instances to gather data at >>>> remote locations and send it to a cloud based central NiFi. >>>> >>>> The problem I am THINKING we will have is setting up ssl. The only way I >>>> know of to set up ssl for site to site requires a user be configured for >>>> the incoming data on the destination NiFi and permissions given to that >>>> user to be able to send data. >>>> >>>> Am I missing something? Will we have to manually set up a user in the >>>> cloud NiFi for each minifi instances so we can use ssl transport? >>>> >>>> Dave >>>
