Apache nifi Apache NIFI SSL群集位于单独的虚拟机上。自动化问题（我猜）_Apache Nifi

Apache nifi Apache NIFI SSL群集位于单独的虚拟机上。自动化问题（我猜）

apache-nifi

Apache nifi Apache NIFI SSL群集位于单独的虚拟机上。自动化问题（我猜）,apache-nifi,Apache Nifi,我需要Apache NIFI群集配置方面的帮助。我配置了独立的NIFI，集群没有SSL，但是在配置带有SSL的NIFI集群的过程中，我遇到了一些问题我想证书生成和authorizers.xml文件之间存在一些问题 ./logs/nifi-user.log中出错： 2020-03-13 17:22:47,365 WARN [NiFi Web Server-22] o.a.n.w.s.NiFiAuthenticationFilter Rejecting access to web api: Un

我需要Apache NIFI群集配置方面的帮助。我配置了独立的NIFI，集群没有SSL，但是在配置带有SSL的NIFI集群的过程中，我遇到了一些问题

我想证书生成和authorizers.xml文件之间存在一些问题

./logs/nifi-user.log中出错：

2020-03-13 17:22:47,365 WARN [NiFi Web Server-22] o.a.n.w.s.NiFiAuthenticationFilter Rejecting access to web api: Untrusted proxy CN=myhost, OU=NIFI

web UI中的错误：

Insufficient Permissions
Untrusted proxy CN=myhost, OU=NIFI

以下是my authorizers.xml：

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<authorizers>

<userGroupProvider>
<identifier>ldap-user-group-provider</identifier>
<class>org.apache.nifi.ldap.tenants.LdapUserGroupProvider</class>
<property name="Authentication Strategy">ANONYMOUS</property>

<property name="Manager DN"></property>
<property name="Manager Password"></property>

<property name="TLS - Keystore"></property>
<property name="TLS - Keystore Password"></property>
<property name="TLS - Keystore Type"></property>
<property name="TLS - Truststore"></property>
<property name="TLS - Truststore Password"></property>
<property name="TLS - Truststore Type"></property>
<property name="TLS - Client Auth"></property>
<property name="TLS - Protocol"></property>
<property name="TLS - Shutdown Gracefully"></property>

<property name="Referral Strategy">FOLLOW</property>
<property name="Connect Timeout">10 secs</property>
<property name="Read Timeout">10 secs</property>

<property name="Url">ldap://myldap.org:389</property>
<property name="Page Size"></property>
<property name="Sync Interval">30 mins</property>

<property name="User Search Base">ou=People,dc=mydomain,dc=org</property>
<property name="User Object Class">person</property>
<property name="User Search Scope">ONE_LEVEL</property>
<property name="User Search Filter"></property>
<property name="User Identity Attribute">uid</property>
<property name="User Group Name Attribute"></property>
<property name="User Group Name Attribute - Referenced Group Attribute"></property>

<property name="Group Search Base">ou=Group,dc=mydomain,dc=org</property>
<property name="Group Object Class">posixGroup</property>
<property name="Group Search Scope">ONE_LEVEL</property>
<property name="Group Search Filter"></property>
<property name="Group Name Attribute">cn</property>
<property name="Group Member Attribute">memberUid</property>
<property name="Group Member Attribute - Referenced User Attribute"></property>
</userGroupProvider>

<accessPolicyProvider>
<identifier>file-access-policy-provider</identifier>
<class>org.apache.nifi.authorization.FileAccessPolicyProvider</class>
<property name="User Group Provider">ldap-user-group-provider</property>
<property name="Authorizations File">./conf/authorizations.xml</property>
<property name="Initial Admin Identity">iamadmin</property>
<property name="Legacy Authorized Users File"></property>
<property name="Node Identity 1"></property>
<property name="Node Group"></property>
</accessPolicyProvider>


<authorizer>
<identifier>managed-authorizer</identifier>
<class>org.apache.nifi.authorization.StandardManagedAuthorizer</class>
<property name="Access Policy Provider">file-access-policy-provider</property>
</authorizer>

任何帮助都将不胜感激

附言：难道没有人在容器中有安全集群混淆的例子吗？Docker写文件什么的

UPD2:

我完全按照你说的做了，现在配置的一部分在所有主机上都是这样的：

   <accessPolicyProvider>
        <identifier>file-access-policy-provider</identifier>
        <class>org.apache.nifi.authorization.FileAccessPolicyProvider</class>
        <property name="User Group Provider">ldap-user-group-provider</property>
        <property name="Authorizations File">./conf/authorizations.xml</property>
        <property name="Initial Admin Identity">iamadmin</property>
        <property name="Legacy Authorized Users File"></property>
        <property name="Node Identity 1">myhost1</property>
        <property name="Node Identity 2">myhost2</property>
        <property name="Node Identity 3">myhost3</property>
        <property name="Node Group"></property>
    </accessPolicyProvider>

错误myhost2:

Caused by: org.apache.nifi.authorization.exception.AuthorizerCreationException: org.apache.nifi.authorization.exception.AuthorizerCreationException: Unable to locate node CN=myhost2, OU=NIFI to seed policies.

UPD3

好的，所以我去了导游处

，这是我的新autorizers.xml

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>

<authorizers>

    <userGroupProvider>
        <identifier>file-user-group-provider</identifier>
        <class>org.apache.nifi.authorization.FileUserGroupProvider</class>
        <property name="Users File">./conf/users.xml</property>
        <property name="Legacy Authorized Users File"></property>

        <property name="Initial User Identity 1">CN=myhost1, OU=NIFI</property>

        <property name="Initial User Identity 2">CN=myhost2, OU=NIFI</property>


    </userGroupProvider>



    <userGroupProvider>
        <identifier>ldap-user-group-provider</identifier>
        <class>org.apache.nifi.ldap.tenants.LdapUserGroupProvider</class>
        <property name="Authentication Strategy">ANONYMOUS</property>

        <property name="Manager DN"></property>
        <property name="Manager Password"></property>

        <property name="TLS - Keystore"></property>
        <property name="TLS - Keystore Password"></property>
        <property name="TLS - Keystore Type"></property>
        <property name="TLS - Truststore"></property>
        <property name="TLS - Truststore Password"></property>
        <property name="TLS - Truststore Type"></property>
        <property name="TLS - Client Auth"></property>
        <property name="TLS - Protocol"></property>
        <property name="TLS - Shutdown Gracefully"></property>

        <property name="Referral Strategy">FOLLOW</property>
        <property name="Connect Timeout">10 secs</property>
        <property name="Read Timeout">10 secs</property>

        <property name="Url">ldap://myldap:389</property>
        <property name="Page Size"></property>
        <property name="Sync Interval">30 mins</property>

        <property name="User Search Base">ou=People,dc=mydomain,dc=org</property>
        <property name="User Object Class">person</property>
        <property name="User Search Scope">ONE_LEVEL</property>
        <property name="User Search Filter"></property>
        <property name="User Identity Attribute">uid</property>
        <property name="User Group Name Attribute"></property>
        <property name="User Group Name Attribute - Referenced Group Attribute"></property>

        <property name="Group Search Base">ou=Group,dc=mydomain,dc=org</property>
        <property name="Group Object Class">posixGroup</property>
        <property name="Group Search Scope">ONE_LEVEL</property>
        <property name="Group Search Filter"></property>
        <property name="Group Name Attribute">cn</property>
        <property name="Group Member Attribute">memberUid</property>
        <property name="Group Member Attribute - Referenced User Attribute"></property>
    </userGroupProvider>


    <userGroupProvider>
        <identifier>composite-user-group-provider</identifier>
        <class>org.apache.nifi.authorization.CompositeUserGroupProvider</class>
        <property name="Configurable User Group Provider">file-user-group-provider</property>
        <property name="User Group Provider 1">ldap-user-group-provider</property>
    </userGroupProvider>


    <accessPolicyProvider>
        <identifier>file-access-policy-provider</identifier>
        <class>org.apache.nifi.authorization.FileAccessPolicyProvider</class>
        <property name="User Group Provider">composite-user-group-provider</property>
        <property name="Authorizations File">./conf/authorizations.xml</property>
        <property name="Initial Admin Identity">iamadmin</property>
        <property name="Legacy Authorized Users File"></property>
        <property name="Node Identity 1">CN=myhost1, OU=NIFI</property>
        <property name="Node Identity 2">CN=myhost2, OU=NIFI</property>
    </accessPolicyProvider>


    <authorizer>
        <identifier>managed-authorizer</identifier>
        <class>org.apache.nifi.authorization.StandardManagedAuthorizer</class>
        <property name="Access Policy Provider">file-access-policy-provider</property>
    </authorizer>

</authorizers>

请告诉我我做错了什么？您需要在authorizers.xml中指定节点标识，以便为每个节点创建正确的代理策略：

<property name="Node Identity 1"></property>

由于您已经启动了应用程序一次，因此需要停止应用程序，删除users.xml和authorizations.xml，然后编辑authorizers.xml以添加节点标识，然后启动。

查看UPD2。更改后，NIFI根本不启动节点标识需要与证书中的DNs匹配，因此“CN=myhost1，OU=NIFI”，然后这些标识需要存在于UserGroupProvider中，因此您需要将它们添加到LDAP中，就像它们是用户一样，或者您可以使用一个CompositeUserGroupProvider，您可以在NiFi管理指南中阅读它。它看起来是正确的，请仔细检查空格和区分大小写的问题，还可以确保在任何时候更改authorizers.xml中删除users.xml和authorizations.xml的任何内容以重新开始。。。我不知道问题出在哪里，我只是试图从官方文档中复制authorizers.xml示例，但出乎意料地成功了。谢谢你抽出时间！

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>

<authorizers>

    <userGroupProvider>
        <identifier>file-user-group-provider</identifier>
        <class>org.apache.nifi.authorization.FileUserGroupProvider</class>
        <property name="Users File">./conf/users.xml</property>
        <property name="Legacy Authorized Users File"></property>

        <property name="Initial User Identity 1">CN=myhost1, OU=NIFI</property>

        <property name="Initial User Identity 2">CN=myhost2, OU=NIFI</property>


    </userGroupProvider>



    <userGroupProvider>
        <identifier>ldap-user-group-provider</identifier>
        <class>org.apache.nifi.ldap.tenants.LdapUserGroupProvider</class>
        <property name="Authentication Strategy">ANONYMOUS</property>

        <property name="Manager DN"></property>
        <property name="Manager Password"></property>

        <property name="TLS - Keystore"></property>
        <property name="TLS - Keystore Password"></property>
        <property name="TLS - Keystore Type"></property>
        <property name="TLS - Truststore"></property>
        <property name="TLS - Truststore Password"></property>
        <property name="TLS - Truststore Type"></property>
        <property name="TLS - Client Auth"></property>
        <property name="TLS - Protocol"></property>
        <property name="TLS - Shutdown Gracefully"></property>

        <property name="Referral Strategy">FOLLOW</property>
        <property name="Connect Timeout">10 secs</property>
        <property name="Read Timeout">10 secs</property>

        <property name="Url">ldap://myldap:389</property>
        <property name="Page Size"></property>
        <property name="Sync Interval">30 mins</property>

        <property name="User Search Base">ou=People,dc=mydomain,dc=org</property>
        <property name="User Object Class">person</property>
        <property name="User Search Scope">ONE_LEVEL</property>
        <property name="User Search Filter"></property>
        <property name="User Identity Attribute">uid</property>
        <property name="User Group Name Attribute"></property>
        <property name="User Group Name Attribute - Referenced Group Attribute"></property>

        <property name="Group Search Base">ou=Group,dc=mydomain,dc=org</property>
        <property name="Group Object Class">posixGroup</property>
        <property name="Group Search Scope">ONE_LEVEL</property>
        <property name="Group Search Filter"></property>
        <property name="Group Name Attribute">cn</property>
        <property name="Group Member Attribute">memberUid</property>
        <property name="Group Member Attribute - Referenced User Attribute"></property>
    </userGroupProvider>


    <userGroupProvider>
        <identifier>composite-user-group-provider</identifier>
        <class>org.apache.nifi.authorization.CompositeUserGroupProvider</class>
        <property name="Configurable User Group Provider">file-user-group-provider</property>
        <property name="User Group Provider 1">ldap-user-group-provider</property>
    </userGroupProvider>


    <accessPolicyProvider>
        <identifier>file-access-policy-provider</identifier>
        <class>org.apache.nifi.authorization.FileAccessPolicyProvider</class>
        <property name="User Group Provider">composite-user-group-provider</property>
        <property name="Authorizations File">./conf/authorizations.xml</property>
        <property name="Initial Admin Identity">iamadmin</property>
        <property name="Legacy Authorized Users File"></property>
        <property name="Node Identity 1">CN=myhost1, OU=NIFI</property>
        <property name="Node Identity 2">CN=myhost2, OU=NIFI</property>
    </accessPolicyProvider>


    <authorizer>
        <identifier>managed-authorizer</identifier>
        <class>org.apache.nifi.authorization.StandardManagedAuthorizer</class>
        <property name="Access Policy Provider">file-access-policy-provider</property>
    </authorizer>

</authorizers>

Caused by: org.apache.nifi.authorization.exception.AuthorizerCreationException: org.apache.nifi.authorization.exception.AuthorizerCreationException: Unable to locate node CN=myhost2, OU=NIFI to seed policies.

<property name="Node Identity 1"></property>