[NIFI-1550] Authorizer API

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 1.0.0
• Component/s: Core Framework
• Assignee: Matt Gilman
• Reporter: Matt Gilman
• Created: 22/Feb/16 20:40
• Updated: 12/Aug/16 21:45
• Resolved: 12/Aug/16 21:45

Description

This is a parent ticket for tracking all work done for the Authorizer feature proposal phase 1 [1].

At a high level, all authorization decisions are delegated to a provider and given the identity of the entity, the resource being accessed, the action, and the context of the request.

Additionally, the Authorizer will be able to support an audit query that presents back the recently active users including their last request, last rejected attempts, and last mutable requests. A given implementation of an Authorizer may or may not offer to support user request audits.

Sub tickets will be created for tracking specific units of work. Once all sub tickets are completed, this ticket will be finished.

[1] https://cwiki.apache.org/confluence/display/NIFI/Support+Authorizer+API

Issue Links

• is related to: NIFI-2420 Add a section for Multi-tenant Authorization to the Admin Guide

Sub-Tasks

• Prepare codebase for introduction of Authorizer: Resolved
• Define new Authorizer API: Resolved
• Implement File Based Authorizer: Resolved
• Incorporate new Authorizer API: Resolved
• Introduce Component level revision checking: Resolved
• Update UI to reflect component level authorization: Resolved
• Address incorrect element name in default authorizers file: Resolved
• Fix URI's that are getting merged at NCM: Resolved
• Auto adjust flow layout: Resolved
• Scope Controller Services by Process Group: Resolved
• Scope Templates by Process Group: Resolved
• Convert authorized-users.xml to authorizations.xml: Resolved
• Backward compatibility for Site-to-Site client: Resolved
• Remote Process Group Port revision and authorization: Resolved
• Clustering - Merge all responses based on authorization: Resolved
• Add User & Group API: Resolved
• Restore access control unit tests: Resolved
• Make File Based Authorizer implement new User, Group, Policy API: Resolved
• UI - Remove registration process: Resolved
• Templates created should include template encoding version: Resolved
• Convert 0.x site-to-site access policies when possible: Resolved
• Create REST endpoints for user/group/policy management: Resolved
• User Identity Normalization: Resolved
• Allow Controller Services to be scoped at the Controller Level: Resolved
• Require revision for component creation: Resolved
• Ensure nodes in a cluster use consistent authorizations: Resolved
• Introduce UI for managing Users & User Groups: Resolved
• Users, Groups, Policies API handling of unsecure request: Resolved
• Make AccessPolicy have a single action: Resolved
• Remove User side of user-group relationship: Resolved
• Remove policy when component is deleted: Resolved