Configuring LDAP with NIFI operator on OpenShift/Kubernetes

[cm2pm]

How would I go about configuring my first admin user to access the Nifi Console- I have configured LDAPS for the console but when I attempt to sign in I receive error of insufficient permissions.

Is there a step I missed in documentation and I need to configure additional files?

I am running Stackable Nifi 1.23.2 - On OpenShift version > 4.12

[maltesander]

Hi @cm2pm,

could you have a look at this discussion https://github.com/orgs/stackabletech/discussions/18#discussioncomment-5802872 and check the NiFi LDAP docs https://docs.stackable.tech/home/stable/nifi/usage_guide/security#authentication-ldap.

If that does not help, could you please share your NiFi cluster config an logs?

Cheers,
Malte

[cm2pm]

Thanks for the response @maltesander ,

Yes I was able to familiarize myself with the documentation and I used the issue ticket you mentioned to help me somewhat gain understanding?

The problem is that the native way that the Nifi does LDAP look up to my understanding is that the LDAP search scope is configured for ONE_LEVEL. So regardless of my configuration the search was unable find my configured AD Bind account.

Some of these errors include:



From the Nifi cluster pod itself:

Caused by: org.springframework.security.authentication.InternalAuthenticationServiceException: [LDAP: error code 4 - Sizelimit Exceeded]; nested exception is javax.naming.SizeLimitExceededException: [LDAP: error code 4 - Sizelimit Exceeded]; remaining name ‘dc=domain,dc=com'
at org.springframework.security.ldap.authentication.LdapAuthenticationProvider.doAuthentication(LdapAuthenticationProvider.java:190)
at org.springframework.security.ldap.authentication.AbstractLdapAuthenticationProvider.authenticate(AbstractLdapAuthenticationProvider.java:79)
at org.apache.nifi.ldap.LdapProvider.authenticate(LdapProvider.java:276)
... 123 common frames omitted
Caused by: org.springframework.ldap.SizeLimitExceededException: [LDAP: error code 4 - Sizelimit Exceeded]; nested exception is javax.naming.SizeLimitExceededException: [LDAP: error code 4 - Sizelimit Exceeded]; remaining name ‘dc=domain,dc=com'
at org.springframework.ldap.support.LdapUtils.convertLdapException(LdapUtils.java:157)
at org.springframework.ldap.core.LdapTemplate.executeWithContext(LdapTemplate.java:824)
at org.springframework.ldap.core.LdapTemplate.executeReadOnly(LdapTemplate.java:807)
at org.springframework.security.ldap.SpringSecurityLdapTemplate.searchForSingleEntry(SpringSecurityLdapTemplate.java:260)
at org.springframework.security.ldap.search.FilterBasedLdapUserSearch.searchForUser(FilterBasedLdapUserSearch.java:100)
at org.springframework.security.ldap.authentication.BindAuthenticator.authenticate(BindAuthenticator.java:86)
at org.springframework.security.ldap.authentication.LdapAuthenticationProvider.doAuthentication(LdapAuthenticationProvider.java:174)
... 125 common frames omitted
Caused by: javax.naming.SizeLimitExceededException: [LDAP: error code 4 - Sizelimit Exceeded]
at java.naming/com.sun.jndi.ldap.LdapCtx.mapErrorCode(LdapCtx.java:3311)
at java.naming/com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:3205)
at java.naming/com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2996)
at java.naming/com.sun.jndi.ldap.AbstractLdapNamingEnumeration.getNextBatch(AbstractLdapNamingEnumeration.java:148)
at java.naming/com.sun.jndi.ldap.AbstractLdapNamingEnumeration.hasMoreImpl(AbstractLdapNamingEnumeration.java:217)
at java.naming/com.sun.jndi.ldap.AbstractLdapNamingEnumeration.hasMore(AbstractLdapNamingEnumeration.java:189)
at org.springframework.security.ldap.SpringSecurityLdapTemplate.searchForSingleEntryInternal(SpringSecurityLdapTemplate.java:277)
at org.springframework.security.ldap.SpringSecurityLdapTemplate.lambda$searchForSingleEntry$3(SpringSecurityLdapTemplate.java:260)
at org.springframework.ldap.core.LdapTemplate.executeWithContext(LdapTemplate.java:821)

This is my configuration for the AuthenticationClass and I didn’t have any issues here:

spec:
  provider:
    ldap:
      bindCredentials:
        scope:
          node: false
          pod: false
          services: []
        secretClass: ldap-bind-credentials
      hostname: ldap.domain.com
      ldapFieldNames:
        email: mail
        givenName: givenName
        group: memberOf
        surname: sn
        uid: sAMAccountName
      port: 636
      searchBase: dc=domain,dc=com
      searchFilter: ""
      tls:
        verification:
          server:
            caCert:
              secretClass: ldap-tls-secret

So what I have done is modify the XML File for authorizers.xml which I will attach to the response but essentially I updated to include:

<userGroupProvider>
    <identifier>ldap-user-group-provider</identifier>
    <class>org.apache.nifi.ldap.tenants.LDAPUserGroupProvider</class>
    <property name="Authentication Strategy">LDAPS</property>
    <property name="Manager DN">cn=common,ou=organization,dc=domain,dc=com</property>
    <property name="Manager Password">pass1</property>


<!-- took this section from other references like the login-identity-providers.xml file -->
    <property name="TLS - Client Auth">NONE</property>
    <property name="TLS - Keystore">/stackable/server_tls/keystore.p12</property>
    <property name="TLS - Keystore Password">secret</property>
    <property name="TLS - Keystore Type">PKCS12</property>
    <property name="TLS - Truststore">/stackable/server_tls/truststore.p12</property>
    <property name="TLS - Truststore Password">secret</property>
    <property name="TLS - Truststore Type">PKCS12</property>
    <property name="TLS - Protocol">TLSv1.2</property>
    <property name="TLS - Shutdown Gracefully">true</property>

    <property name="Referral Strategy">FOLLOW</property>
    <property name="Connect Timeout">10 secs</property>
    <property name="Read Timeout">10 secs</property>

    <property name="Url">ldaps://ldap.domain.com:636</property>
    <property name="Page Size"></property>
    <property name="Sync Interval">30 mins</property>

    <property name="User Search Base">dc=domain,dc=com</property>
    <property name="User Object Class">person</property>
    <property name="User Search Scope">SUBTREE</property>
    <property name="User Identity Attribute">cn</property>
</userGroupProvider>

I also mounted the authorizers file to the Nifi cluster deployment config which is reflected below but also condensed to remove null values:

spec:
  clusterConfig:
    authentication:
    - authenticationClass: ldap-full
    listenerClass: external-unstable
    sensitiveProperties:
      autoGenerate: true
      keySecret: nifi-sensitive-property-key
    zookeeperConfigMapName: simple-nifi-znode
  clusterOperation:
    reconciliationPaused: false
    stopped: false
  image:
    productVersion: 1.23.2
    pullPolicy: Always
  nodes:
    configOverrides:
      nifi.properties:
        nifi.web.proxy.host: simple-nifi-nifi.apps.web.domain.com, simple-nifi.nifi.svc.cluster.local:8443,
          simple-nifi.nifi.svc.cluster.local
    envOverrides: {}
    podOverrides:
      spec:
        containers:
        - name: nifi
          ports:
          - containerPort: 8443
            name: https
            protocol: TCP
          - containerPort: 9088
            name: protocol
            protocol: TCP
          - containerPort: 6243
            name: balance
            protocol: TCP
          - containerPort: 8081
            name: metrics
            protocol: TCP
          - containerPort: 10000
            name: smtp
            protocol: TCP
          volumeMounts:
          - mountPath: /stackable/nifi/conf/authorizers.xml
            name: authorizers-xml
            subPath: authorizers.xml
        volumes:
        - configMap:
            name: authorizers-xml
          name: authorizers-xml
           …..

It does not look like that was well received by the application as these are some of the logs I am seeing and my pod keeps crash looping. Here are the errors I am seeing —

Caused by: org.springframework.beans.factory.UnsatisfiedDependencyException: Error creating bean with name 'org.apache.nifi.web.security.configuration.AuthenticationSecurityConfiguration': Unsatisfied dependency expressed through constructor parameter 2; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'authorizer': FactoryBean threw exception on object creation; nested exception is java.lang.Exception: The specified user group provider class 'org.apache.nifi.ldap.tenants.LDAPUserGroupProvider' is not known to this nifi.
at org.springframework.beans.factory.support.ConstructorResolver.createArgumentArray(ConstructorResolver.java:800)
at org.springframework.beans.factory.support.ConstructorResolver.autowireConstructor(ConstructorResolver.java:229)
at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.autowireConstructor(AbstractAutowireCapableBeanFactory.java:1372)
at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBeanInstance(AbstractAutowireCapableBeanFactory.java:1222)
at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:582)
at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:542)
at org.springframework.beans.factory.support.AbstractBeanFactory.lambda$doGetBean$0(AbstractBeanFactory.java:335)
at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:234)
at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:333)
at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:208)
at org.springframework.beans.factory.support.ConstructorResolver.instantiateUsingFactoryMethod(ConstructorResolver.java:410)
...
Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'authorizer': FactoryBean threw exception on object creation; nested exception is java.lang.Exception: The specified user group provider class 'org.apache.nifi.ldap.tenants.LDAPUserGroupProvider' is not known to this nifi.
at 
... 97 common frames omitted
Caused by: java.lang.Exception: The specified user group provider class 'org.apache.nifi.ldap.tenants.LDAPUserGroupProvider' is not known to this nifi.
at org.apache.nifi.authorization.AuthorizerFactoryBean.createUserGroupProvider(AuthorizerFactoryBean.java:276)

If necessary this is also the logs of the Nifi reporting task pod:

2024-05-17 15:42:03,364 WARNING Retrying (Retry(total=2, connect=None, read=None, redirect=None, status=None)) after connection broken by 'NewConnectionError('<urllib3.connection.HTTPSConnection object at 0x7f55fd01ac18>: Failed to establish a new connection: [Errno 110] Connection timed out',)': /nifi-api/access/token
2024-05-17 15:42:03,364 WARNING Retrying (Retry(total=2, connect=None, read=None, redirect=None, status=None)) after connection broken by 'NewConnectionError('<urllib3.connection.HTTPSConnection object at 0x7f55fd01ac18>: Failed to establish a new connection: [Errno 110] Connection timed out',)': /nifi-api/access/token
WARNING:urllib3.connectionpool:Retrying (Retry(total=2, connect=None, read=None, redirect=None, status=None)) after connection broken by 'NewConnectionError('<urllib3.connection.HTTPSConnection object at 0x7f55fd01ac18>: Failed to establish a new connection: [Errno 110] Connection timed out',)': /nifi-api/access/token

[maltesander]

This is strange...

The specified user group provider class 'org.apache.nifi.ldap.tenants.LDAPUserGroupProvider' is not known to this nifi.

Did you get it to work without providing your own authorizers.xml?

Could you please share your the SecretClass ldap-bind-credentials and the login-identity-providers.xml and users.xml from the nifi pod or configmap? Please remove all included passwords.

[cm2pm]

Hi, So I solved that issue last week and it was end of day so I didn't get a chance to update.. The issue was related to case sensitivity (I used LDAPUserGroupProvider vs what is should be LdapUserGroupProvider)

Another follow up question that I think would help me is -

1. Is it possible to configure 2 LDAP login-identity-providers and to use for Stackable Nifi authentication?

2. Or as an alternative, is it possible to add a secondary userGroupProvider in authorizers.xml that would allow me to add AD users who don't fall within the same Search Base as my Bind account?

My AD Bind account is using a search base that is modeled as such - "OU=GroupsABC, dc=example, dc=com" because the search base "dc=example, dc=com" pulls too many users and I hit a size limit so I needed to be more specific.

The problem now is that I have users that may be associated with groups like "OU=GroupXYZ,DC=example,DC=com" and as of right now I cant login to Nifi with those additional users and my assumption for that is because don't fall in with "GroupsABC"