[NIFI-8711] Support keyboard-interactive authentication for SFTP

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.10.0, 1.13.2
• Fix Version/s: 1.14.0
• Component/s: Extensions
• Labels: SFTP SSH security sshj
• Assignee: David Handermann
• Reporter: David Handermann
• Created: 16/Jun/21 17:29
• Updated: 30/Jun/21 12:04
• Resolved: 30/Jun/21 12:04

Description

Changing the supporting library from JSch to SSHJ resulted in removing support for keyboard-interactive authentication when configuring a password in SFTP components. 

Some SSH servers disable password authentication but support keyboard-interactive authentication.  SSHJ provides support for keyboard-interactive authentication using a password, and SFTP components should attempt both password authentication and keyboard-interactive authentication when a password is configured.

Without support for keyboard-interactive authentication, SFTP processors report the following error even when configured with valid username and password credentials:

UserAuthException: Exhausted available authentication methods

SSHJ reports the following debug log with valid credentials when the server has disabled password authentication:

net.schmizz.sshj.userauth.UserAuthImpl `password` auth failed

Issue Links

• is caused by: NIFI-5816 SFTP cannot connect due to JSch limitations
• links to: GitHub Pull Request #5166