[NIFI-8298] Refactor nifi-security-utils to reduce dependence on Bouncy Castle

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.13.0
• Fix Version/s: 1.14.0
• Component/s: Core Framework
• Assignee: David Handermann
• Reporter: David Handermann
• Created: 08/Mar/21 15:16
• Updated: 19/Mar/21 17:16
• Resolved: 19/Mar/21 17:16

Description

The nifi-security-utils module includes classes that perform a variety of functions from TLS communication handling to hashing and encryption operations. Many of these classes do not depend on the Bouncy Castle Security Provider library, but many NAR bundles include a dependency on nifi-security-utils either directly or indirectly through nifi-processor-utils. The Bouncy Castle Security Provider library is almost 6 MB, which contributes a notable amount to the size of the NiFi assembled binary after completion, due to the number of copies of the library. Refactoring nifi-security-utils into more granular modules should remove the transitive inclusion of Bouncy Castle from a number of modules.

Several capabilities, including Kerberos handling and SSLSocket classes can be separated into discrete modules without dependence on Bouncy Castle. Other classes used for secure hashing and cipher processing rely on Bouncy Castle, but have uses limited to framework components.

Issue Links

• relates to: NIFI-7468 Improve internal handling of SSL channels
• links to: GitHub Pull Request #4881