[NIFI-13296] Deprecate Kerberos SPNEGO Authentication for Removal

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 1.27.0
• Assignee: David Handermann
• Reporter: David Handermann
• Created: 24/May/24 20:55
• Updated: 27/Jun/24 14:40
• Resolved: 25/May/24 19:59

Description

NiFi 0.6.0 added Kerberos authentication with SPNEGO as a framework feature based on Spring Security Kerberos. Although Spring Security Kerberos continues to be maintained, SPNEGO authentication is not common, requiring specialized client browser configuration for access. As noted in the linked instructions, popular web browsers do not support SPNEGO in the default configuration, and Google Chrome requires either a custom policy or launch from the command line with arguments that list permitted DNS names.

Based on these considerations, and in light of more common Single Sign-On strategies using OpenID Connect and SAML 2, NiFi framework support for Kerberos authentication with SPNEGO should be deprecated for subsequent removal in NiFi 2.

This deprecation should not impact the Kerberos Login Identity Provider, which continues to support username and password authentication based on the form-based login process.

Issue Links

• links to: GitHub Pull Request #8878
• mentioned in: Page Loading...