Uploaded image for project: 'Apache NiFi'
  1. Apache NiFi
  2. NIFI-5973

NiFi: Add 'unix' or 'hadoop' user-group-provider

    XMLWordPrintableJSON

    Details

      Description

      NiFi currently supports these group mappings:

      • File
      • LDAP

      Benefits of Unix or Hadoop based group identity:

      • File is now allowed any many environments as it's not integrated with the corporations identity system (typically AD or another LDAP).
      • LDAP adds a lot of complexity, overhead, and tons of up-front config per environment.
      • Most services, including those related to Hadoop, are moving to Unix based group lookups.

      How it works and some possible method to implement:

      Advantages of this method:

      • ability to get users/groups from multiple LDAP directories. (very common requirement)
      • little to no configuration: There is nothing customer or cluster specific to configure. (i.e. it "just works" with the default configs).
      • ease of change: if all services use this approach, you don't have to update dozens of services every time LDAP changes.
      • a lot less overhead: The OS has the users/groups. All of the services running the OS simply check locally for users/groups. Spares the LDAP servers and our machines from doing all the lookups.
      • group names are guaranteed to be consistent across services.
      • as this is becoming the standard in Knox, it makes KnoxSSO more stable.
      • less concern about LDAP credentials all over the place.
      • easier to pass security/compliance tests since we are utilising the customers existing identity infrastructure.

        Attachments

          Issue Links

            Activity

              People

              • Assignee:
                tmelhase Troy Melhase
                Reporter:
                seano Sean Roberts
              • Votes:
                0 Vote for this issue
                Watchers:
                8 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved:

                  Time Tracking

                  Estimated:
                  Original Estimate - Not Specified
                  Not Specified
                  Remaining:
                  Remaining Estimate - 0h
                  0h
                  Logged:
                  Time Spent - 18h 10m
                  18h 10m