[NIFI-5508] Support disabling wantClientAuth when running behind a reverse proxy.

• Type: Bug
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 1.7.0, 1.7.1
• Component/s: Security
• Labels: rever
• Environment: Reverse Proxy & trying to use other credential provider when the reverse proxy provides a client certificate itself.
• Assignee: Unassigned
• Reporter: Curtis W Ruck
• Created: 10/Aug/18 12:43
• Updated: 10/Apr/23 13:31

Description

As discussed on mailing list.

JettyServer always calls either setNeedClientAuth(true) or setWantClientAuth(true).

When used with a reverse proxy that has a client certificate, it is impossible currently to use other credential providers as the X509 authentication takes precedence.

Adding the ability to disable wantClientAuth via a NiFi property would enable the ability to leverage existing SSO solutions behind a reverse proxy.

Issue Links

• is related to: NIFI-5493 Reverse Proxy & OIDC
• links to: GitHub Pull Request #2944
• links to: GitHub Pull Request #2944