[NIFI-12550] Support OIDC Device Authorization Grant for API

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 2.0.0-M3
• Component/s: Security
• Environment: NiFi with OIDC provider configured
• Assignee: David Handermann
• Reporter: Igor Milavec
• Created: 27/Dec/23 11:27
• Updated: 10/May/24 16:18
• Resolved: 10/May/24 16:18

Description

Please add support for OIDC Device Authorization Grant. This is useful for running scripts that access the NiFi API from the CLI. At this time the options are:

1. Copy __Secure-Authorization-Bearer cookie from the browser session: not really a good practice, work and error prone
2. Enable MTLS: painful for the users as the browser starts to frequently challenge for the client cert and even if it worked fine, client certificate management process is typically lagging behind OIDC identity management
3. Use passwords: insecure and prohibited by policy

Having an API endpoint in the Access group that would allow the caller to exchange OIDC id or refresh token for a NiFi session token would be perfect for this use case.

Issue Links

• relates to: NIFI-11014 JWT token is rejected by NiFi when calling APIs
• relates to: NIFI-12317 REST API Rejects Keycloak OIDC Access Tokens with HTTP 401
• supercedes: NIFI-5302 Add Support for Client Credentials Flow with OIDC Access Tokens