[NIFI-11252] OIDC secret properties that are encrypted by default are not being decrypted in Nifi Registry

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.20.0
• Fix Version/s: 2.0.0, 1.21.0
• Component/s: NiFi Registry
• Assignee: Ryan
• Reporter: Ryan
• Created: 06/Mar/23 12:06
• Updated: 15/Mar/23 21:23
• Resolved: 15/Mar/23 20:40

Description

Since upgrading to 1.20.0 from 1.16.2 I have been getting the following error: Unable to exchange authorization for ID token: An error occurred while invoking the Token endpoint: Invalid client secret 

In version 1.20.0 nifi.registry.security.user.oidc.client.secret has been added to the default list of properties that are encrypted by the Nifi Toolkit's property encryption tool, however, it has not been added to the ProtectedNiFiRegistryProperties file which is used to read and decrypt these properties.

This results in the encrypted string being passed to the OIDC provider resulting in the error above.

I have gotten around this issue for the time being by setting the following property.

nifi.registry.sensitive.props.additional.keys=nifi.registry.security.user.oidc.client.secret 

Issue Links

• links to: GitHub Pull Request #7044