Setting NiFi properties with empty value or disabling them

[dmasice]

Hi,

I'm trying to add OIDC configuration to NiFi in order to use Keycloak for authentication. But in order to do so, I need to disable the nifi.security.user.login.identity.provider property (or set it to an empty value).

Right now, if I try to set it to an empty value, the operator replaces it with the login-identity-provider value.

Also, the cluster definition requires the spec.clusterConfig.authentication.method to be set, and that replaces the authorizers.xml with the one generated by the operator, though I can use a custom one in another path (via extraVolumes) and set nifi.authorizer.configuration.file to the new path.

Is there a way to set the nifi.security.user.login.identity.provider (or any other property, if needed) to an empty value?

Thanks.

Best regards.

[sbernauer]

Hi @dmasice, thanks for the report! We plan to support OIDC integration for most of our products (nifi, trino, superset, airflow etc.) via our [https://docs.stackable.tech/home/stable/concepts/authentication.html](AuthenticationClass mechanism), so that the usage should be really easy.
Anyway, regarding the actual problem of setting a property to an empty value I did test the following

apiVersion: nifi.stackable.tech/v1alpha1
kind: NifiCluster
metadata:
  name: simple-nifi
spec:
  image:
    productVersion: 1.21.0
    stackableVersion: "0.0.0-dev"
  clusterConfig:
    authentication:
      method:
        singleUser:
          adminCredentialsSecret: nifi-admin-credentials-simple
          autoGenerate: true
    listenerClass: external-unstable
    sensitiveProperties:
      keySecret: nifi-sensitive-property-key
      autoGenerate: true
    zookeeperConfigMapName: simple-nifi-znode
  nodes:
    configOverrides:
      nifi.properties:
        nifi.security.user.login.identity.provider: ""
    roleGroups:
      default:
        replicas: 2

(nifi taken from https://docs.stackable.tech/home/nightly/nifi/getting_started/first_steps.html, only added the configOverrides section)
Resulting in

kubectl get cm simple-nifi-node-default -o yaml | grep 'nifi.security.user.login.identity.provider'
    nifi.security.user.login.identity.provider=

Which looks like the expected outcome to me. Nifi will refuse to start because org.apache.nifi.authorization.exception.AuthorizerCreationException: SingleUserAuthorizer requires org.apache.nifi.authentication.single.user.SingleUserLoginIdentityProvider to be configured.

Does this work for you as well?

All the best,
Sebastian

[dmasice]

Yes! That seems to work. I don't know why I didn't try that, maybe I thought that it would add the empty string as the value instead of leaving the property value empty.

Thank you :-)

[lfrancke]

It is something we should maybe document better then?

[sbernauer]

Created stackabletech/documentation#426

[dmasice]

With the OIDC properties and my custom authorizers.xml in place, NiFi starts and I'm redirected to our Keycloak server. Now I just need to solve a problem with the certificates (see #29).