[NIFI-5627] Improve handling of sensitive properties

• Type: Epic
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Component/s: Configuration, Core Framework
• Labels: component-versioning encryption properties registry security sensitive variable
• Epic Name: Improve handling of sensitive properties
• Epic Status: To Do
• Assignee: Andy LoPresto
• Reporter: Andy LoPresto
• Created: 24/Sep/18 17:25
• Updated: 02/Oct/18 21:35

Description

There are a number of disparate issues around the handling of sensitive properties.

There should be a clear naming strategy to differentiate:
1. component properties that are sensitive (InvokeHTTP password, EncryptContent password etc.)
1. secret framework configuration values (nifi.sensitive.props.key, nifi.security.keystorePasswd, LDAP Manager password, etc.)

This epic regards the first.

In addition:

• Sensitive component properties should be handled in Expression Language
• Sensitive component properties should be versionable in conjunction with NiFi Registry (this requires distributed key management)
• Dynamic property descriptors on components should be able to be marked as sensitive

Issue Links

• contains: NIFI-3110 Allow template export to include variable registry references for sensitive values
• contains: NIFI-5658 Build list of processors with various attributes at startup
• contains: NIFI-91 Allow the changing of sensitive property properties via the UI
• contains: NIFI-1140 Allow for attributes to be marked sensitive when being added to FlowFile
• contains: NIFI-2653 Encrypted configs should handle variable registry
• contains: NIFI-2424 Allow user to add a user defined sensitive property to processors
• contains: NIFI-3661 Add Checkbox for custom "Sensitive" properies to the "Add Property" UI
• contains: NIFI-863 NiFi "sensitive properties" properties are duplicated/unused