[NIFI-6833] Provide instance qualification of principals in KeytabCredentialsService

• Type: Improvement
• Status: Patch Available
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 1.9.2
• Component/s: Extensions
• Assignee: Jeff Storck
• Reporter: Jeff Storck
• Created: 01/Nov/19 21:43
• Updated: 11/May/21 00:08

Description

A KeytabCredentialsService should be able to qualify a principal or shortname with the instance on which it is running.

A new property should be added that allows the user to select one of the following qualification options:

• none
• hostname
• FQDN

If NiFi is running on host "nifi.apache.org" and a KeytabCredentialsService was created with a Kerberos Principal property value of "[e-mail]", the KeytabCredentialsService** should be able return a qualified principal, based on the qualification option:

• none -> "[e-mail]"
• hostname -> "nifi/[e-mail]"
• FQDN -> "nifi/[e-mail]"

If a shortname is used it should be qualified as the qualification option indicates:

• none -> "nifi"
• hostname -> "nifi/nifi"
• FQDN -> "nifi/nifi.apache.org"

Validation of the KeytabCredentialsService should fail if the principal is already instance-qualified and "hostname" or "FQDN" is selected for the qualification option.

Issue Links

• links to: GitHub Pull Request #3904