Uploaded image for project: 'Apache NiFi'
  1. Apache NiFi
  2. NIFI-5973

NiFi: Add 'unix' or 'hadoop' user-group-provider

Attach filesAttach ScreenshotVotersWatch issueWatchersCreate sub-taskLinkCloneUpdate Comment AuthorReplace String in CommentUpdate Comment VisibilityDelete Comments
    XMLWordPrintableJSON

    Details

      Description

      NiFi currently supports these group mappings:

      • File
      • LDAP

      Benefits of Unix or Hadoop based group identity:

      • File is now allowed any many environments as it's not integrated with the corporations identity system (typically AD or another LDAP).
      • LDAP adds a lot of complexity, overhead, and tons of up-front config per environment.
      • Most services, including those related to Hadoop, are moving to Unix based group lookups.

      How it works and some possible method to implement:

      Advantages of this method:

      • ability to get users/groups from multiple LDAP directories. (very common requirement)
      • little to no configuration: There is nothing customer or cluster specific to configure. (i.e. it "just works" with the default configs).
      • ease of change: if all services use this approach, you don't have to update dozens of services every time LDAP changes.
      • a lot less overhead: The OS has the users/groups. All of the services running the OS simply check locally for users/groups. Spares the LDAP servers and our machines from doing all the lookups.
      • group names are guaranteed to be consistent across services.
      • as this is becoming the standard in Knox, it makes KnoxSSO more stable.
      • less concern about LDAP credentials all over the place.
      • easier to pass security/compliance tests since we are utilising the customers existing identity infrastructure.

        Attachments

        Issue Links

          Activity

            People

            • Assignee:
              tmelhase Troy Melhase
              Reporter:
              seano Sean Roberts

              Dates

              • Created:
                Updated:
                Resolved:

                Time Tracking

                Estimated:
                Original Estimate - Not Specified
                Not Specified
                Remaining:
                Remaining Estimate - 0h
                0h
                Logged:
                Time Spent - 18h 10m
                18h 10m

                  Issue deployment