[NIFI-13294] Deprecate Apache Knox SSO Integration for Removal

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 1.27.0
• Assignee: David Handermann
• Reporter: David Handermann
• Created: 24/May/24 18:39
• Updated: 27/Jun/24 14:40
• Resolved: 25/May/24 20:21

Description

NiFi 1.4.0 introduced support for authentication with Apache Knox Single Sign-On based on JSON Web Tokens provided through a cookie and verified using a configurable public key.

Separate from Apache Knox SSO authentication, Apache Knox itself provides gateway access as a proxy using the X-ProxiedEntitiesChain HTTP Header. Proxy access should remain supported as it is part of the X.509 client certificate authentication strategy. Deployment patterns based on Apache Knox gateway access work without any features or configuration properties specific to Knox.

With the implementation of standards-based Single Sign-On using OpenID Connect and SAML 2, custom cookie-based SSO with Apache Knox should be deprecated for removal.

Issue Links

• links to: GitHub Pull Request #8875
• mentioned in: Page Loading...