[NIFI-1990] Implement consistent security controls for cluster, site-to-site, and API communications

• Type: Bug
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 0.6.1
• Component/s: Core Framework
• Labels: client-auth clustering security site-to-site tls
• Assignee: Andy LoPresto
• Reporter: Andy LoPresto
• Created: 09/Jun/16 18:17
• Updated: 25/Jul/18 22:38

Description

As discovered in NIFI-1981, edge cases in configuration of cluster communications over TLS without client authentication caused errors in the application. We should provide a consistent experience, from documentation to configuration to execution:

• Machine to machine communication should have two settings – plaintext or TLS with mutual authentication.
  • Cluster
  • Site to Site
• The API / UI should allow more granular control – plaintext, TLS with server authentication only, or TLS with mutual authentication. Some clients (API consumers, users in an enterprise environment) may have client certificates, but the majority will not, and TLS authentication of the server, and data integrity and confidentiality assurances should still be available.
  • Site to site over the API (see NIFI-1857) will respect this setting for the TLS handshake negotiation, but will manually enforce the presence of a client certificate in an HTTP header on any request arriving over HTTPS.

The nifi.security.needClientAuth setting should be removed from nifi.properties. A new setting nifi.security.api.needClientAuth will be added, and documented to explicitly apply only to the API (and, by extension, Web UI).

Issue Links

• Is contained by: NIFI-5458 Improve NiFi TLS and certificate management
• is related to: NIFI-1981 Cluster communication requires client certificates even if needClientAuth set to false
• is related to: NIFI-1480 Allow different cipher suites configurable properties for NiFi UI & integrations
• is related to: NIFI-1478 Audit SSLContextFactory and SSLSocketFactory usage throughout application
• is related to: NIFI-1857 Support HTTP(S) as a transport mechanism for Site-to-Site
• relates to: NIFI-1995 Support keystores with multiple certificates by exposing alias selection in configuration