Uploaded image for project: 'Apache NiFi'
  1. Apache NiFi
  2. NIFI-8766

Improve JWT Authentication Handling

    XMLWordPrintableJSON

Details

    • Improvement
    • Status: Resolved
    • Major
    • Resolution: Fixed
    • 1.14.0, 1.13.2
    • 1.15.0
    • Core UI, Security

    Description

      NiFi access for username and password authentication currently leverages several custom classes to handle JWT generation, signing, and verification. The JWT service uses symmetric keys generated for each user with the HMAC SHA256 signing algorithm, and stores signing keys in the local node database. NiFi deletes the symmetric signing key for each user on logout.

      The Spring Security OAuth2 library provides more standardized components to handle JWT verification, which will reduce the need for custom Spring Security authentication provider classes. The JWT generation process should be evaluated and refactored to support more frequent key rotation. Transitioning to asymmetric keys for JWT signing and avoiding persistence of private signing keys should also be considered.

      Attachments

        Issue Links

          Activity

            People

              exceptionfactory David Handermann
              exceptionfactory David Handermann
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Time Tracking

                  Estimated:
                  Original Estimate - Not Specified
                  Not Specified
                  Remaining:
                  Remaining Estimate - 0h
                  0h
                  Logged:
                  Time Spent - 7.5h
                  7.5h