英文:
Why is there no "single-user" login identity provider in NiFi registry like in NiFi itself?
问题
我们正在考虑在我们的 NiFi 集群和注册表中都使用“单用户”身份提供者。
然而，我们注意到 NiFi 注册表 的管理指南没有包含此选项，与 NiFi 的指南不同。
除了没有人有需要或时间来实现它之外，NiFi 注册表为什么不像 NiFi 本身那样支持“单用户”身份提供者，是否有特定的原因？
英文:
We're thinking about using the "single-user" identity provider for both our NiFi cluster and registry.
However, we noticed that the administration guide for NiFi registry does not contain this option, unlike the one for NiFi.
Is there any particular reason (other than noone had the need / time to implement it) why the NiFi registry does not support a "single-user" identity provider like NiFi itself does?
答案1
得分: 1
谢谢提出这个问题。对于NiFi来说，单用户提供者是为独立开发和测试实例提供方便的，但不适用于集群部署。
对于Registry来说，单用户提供者并不那么合适，因为一个或多个NiFi节点需要访问它，还有来自浏览器的用户。
因此，对于Registry的任何安全部署，总会至少有两个“用户”。
NiFi可以充当代理，通过标头传递经过身份验证的用户，但NiFi本身仍然必须被授权为代理。这两个用户分别是NiFi服务器和通过浏览器访问的人类用户。
单用户认证理论上可以在集群部署中使用，但它不是为此设计的，并且不支持在该场景中使用。
单用户认证不应在集群部署的生产环境中使用。
单用户模式确实很方便，但其范围狭窄，目的是鼓励使用外部身份验证策略，其中有几种选项可供选择。您是否评估了可用选项，如LDAP、OIDC或SAML？
或者，对于所有访问，使用客户端证书身份验证可以避免需要活跃的外部身份验证系统，但这当然需要一个功能正常的证书颁发机构。
所有身份验证策略都委托给外部系统，以便NiFi不存储凭据，这反过来会引起其他安全挑战。这也是单用户模式如此狭窄的范围的另一个原因。
英文:
Thanks for raising the question. The single-user provider for NiFi is a convenience for standalone development and test instances, but it is not suitable for a clustered deployment.
For Registry, a single-user provider doesn’t make as much sense because one or more NiFi nodes need to access it, as well as a user coming from a browser.
So for any secured deployment of Registry, there will always be at least two “users”.
NiFi can act as a proxy, passing the authenticated user through a header, but NiFi itself still has be authorized as a proxy. The two users are the NiFi server, and the human user coming through the browser.
The single user authentication can theoretically be used in a clustered deployment, but it is not designed for that, and it is not supported in that scenario.
The single user authentication should never be used in production for a clustered deployment.
The single user mode is certainly convenient, but it is narrowly scoped with the purpose of encouraging use of external authentication strategies, of which there are several. Have you evaluated any of the available options, such as LDAP, OIDC, or SAML?
Alternatively, using client certificate authentication for all access avoids the need for an active external authentication system, but of course it requires a functional certificate authority.
All of the authentication strategies delegate to an external system so that NiFi does not store credentials, which would in turn raise other security challenges. That’s another reason single user mode is so narrowly scoped.
Disclaimer: This question was asked (and answered) in the NiFi community Slack and this answer is posted here to make the information readily available. Special thanks to David Handermann for providing an authoritative answer.
通过集体智慧和协作来改善编程学习和解决问题的方式。致力于成为全球开发者共同参与的知识库，让每个人都能够通过互相帮助和分享经验来进步。
评论