NiFi与NiFi Registry通过LDAP连接时匿名用户问题求助

问题现象 #

已部署NiFi和NiFi Registry并启用LDAP身份认证，移除anonymous匿名用户后出现以下问题：

• NiFi中为处理器组添加版本控制时，无法显示Registry中的任何存储桶
• 将anonymous用户添加至Registry后，存储桶正常显示，但这不符合安全预期
• 尝试将NiFi证书的DC信息加入LDAP配置，未解决问题

核心原因分析 #

问题本质是NiFi向Registry发起请求时的身份未被正确识别，导致请求被当作匿名处理，进而因权限不足无法读取存储桶。主要配置不匹配点在于：

• Registry的身份提供者（identityProviders）使用USE_USERNAME策略，以sAMAccountName作为用户身份标识，但授权配置（authorizers）中却用cn作为用户身份属性，导致NiFi传递的用户身份与Registry识别的身份不匹配
• Registry未给NiFi的LDAP用户/组分配存储桶的访问权限

解决步骤 #

1. 统一身份标识属性 #

修改Registry的authorizers.xml中LDAP用户组提供者的User Identity Attribute，与identityProviders.xml的身份策略保持一致：

<property name="User Identity Attribute">sAMAccountName</property>

（原配置中该属性为cn，需改为sAMAccountName，确保NiFi传递的用户名能被Registry正确识别）

2. 为LDAP组分配Registry权限 #

确保NiFi所属的LDAP组（如NiFi-Admins、NiFi-Developers）在Registry中拥有存储桶的访问权限：

• 登录Registry UI，进入Access Policies页面
• 为/buckets路径添加Read权限，授权对象选择对应的LDAP组
• 为具体存储桶的路径（如/buckets/{bucket-id}）添加Read权限，授权给目标组

3. 彻底禁用Registry匿名访问 #

修改Registry的nifi-registry.properties，关闭匿名认证：

nifi.registry.security.anonymous.authentication.enabled=false

4. 验证NiFi与Registry的身份传递 #

确认NiFi的Registry客户端配置正确传递用户身份：

• 检查NiFi的nifi.properties中nifi.registry.client.url指向正确的Registry地址
• 确保nifi.registry.client.authentication.strategy设置为与Registry认证方式匹配的策略，保证请求携带当前用户的身份信息

相关配置参考 #

Registry authorizers.xml 配置 #

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<authorizers>
    <userGroupProvider>
        <identifier>file-user-group-provider</identifier>
        <class>org.apache.nifi.registry.security.authorization.file.FileUserGroupProvider</class>
        <property name="Users File">./conf/users.xml</property>
        <property name="Initial User Identity 1"/>
    </userGroupProvider>

    <userGroupProvider>
        <identifier>ldap-user-group-provider</identifier>
        <class>org.apache.nifi.registry.security.ldap.tenants.LdapUserGroupProvider</class>
        <property name="Authentication Strategy">SIMPLE</property>
        <property name="Manager DN">CN=nifi-admin,OU=Service,OU=Users,OU=###,DC=###,DC=###</property>
        <property name="Manager Password">#####<PASSWORD>###</property>
        <property name="TLS - Keystore"/>
        <property name="TLS - Keystore Password"/>
        <property name="TLS - Keystore Type"/>
        <property name="TLS - Truststore"/>
        <property name="TLS - Truststore Password"/>
        <property name="TLS - Truststore Type"/>
        <property name="TLS - Client Auth"/>
        <property name="TLS - Protocol"/>
        <property name="TLS - Shutdown Gracefully"/>
        <property name="Referral Strategy">FOLLOW</property>
        <property name="Connect Timeout">10 secs</property>
        <property name="Read Timeout">10 secs</property>
        <property name="Url">####ldap://<address>:<port>####</property>
        <property name="Page Size"/>
        <property name="Sync Interval">30 mins</property>
        <property name="Group Membership - Enforce Case Sensitivity">false</property>
        <property name="User Search Base">DC=#,DC=#</property>
        <property name="User Object Class">user</property>
        <property name="User Search Scope">SUBTREE</property>
        <property name="User Search Filter">(|(memberOf=CN=NiFi-Admins,OU=NiFi,OU=Ordinary,OU=Groups,OU=#,DC=#,DC=#)(memberOf=NiFi-Developers,OU=NiFi,OU=Ordinary,OU=Groups,OU=#,DC=#,DC=#))</property>
        <!-- 此处已修改为sAMAccountName -->
        <property name="User Identity Attribute">sAMAccountName</property>
        <property name="User Group Name Attribute"/>
        <property name="User Group Name Attribute - Referenced Group Attribute"/>
        <property name="Group Search Base">OU=NiFi,OU=Ordinary,OU=Groups,OU=#,DC=#,DC=#</property>
        <property name="Group Object Class">group</property>
        <property name="Group Search Scope">SUBTREE</property>
        <property name="Group Search Filter"/>
        <property name="Group Name Attribute">cn</property>
        <property name="Group Member Attribute">member</property>
        <property name="Group Member Attribute - Referenced User Attribute"/>
    </userGroupProvider>

    <userGroupProvider>
        <identifier>composite-configurable-user-group-provider</identifier>
        <class>org.apache.nifi.registry.security.authorization.CompositeConfigurableUserGroupProvider</class>
        <property name="Configurable User Group Provider">file-user-group-provider</property>
        <property name="User Group Provider 1">ldap-user-group-provider</property>
    </userGroupProvider>

    <accessPolicyProvider>
        <identifier>file-access-policy-provider</identifier>
        <class>org.apache.nifi.registry.security.authorization.file.FileAccessPolicyProvider</class>
        <property name="User Group Provider">composite-configurable-user-group-provider</property>
        <property name="Authorizations File">./conf/authorizations.xml</property>
        <property name="Initial Admin Identity">nifi-admin</property>
        <property name="NiFi Group Name">NIFI-Admins</property>
        <!--<property name="NiFi Identity 1"></property>-->
    </accessPolicyProvider>

    <authorizer>
        <identifier>managed-authorizer</identifier>
        <class>org.apache.nifi.registry.security.authorization.StandardManagedAuthorizer</class>
        <property name="Access Policy Provider">file-access-policy-provider</property>
    </authorizer>
</authorizers>

Registry identityProviders.xml 配置 #

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<identityProviders>
    <provider>
        <identifier>ldap-identity-provider</identifier>
        <class>org.apache.nifi.registry.security.ldap.LdapIdentityProvider</class>
        <property name="Authentication Strategy">SIMPLE</property>
        <property name="Manager DN">CN=nifi-admin,OU=Service,OU=Users,OU=#,DC=#,DC=#</property>
        <property name="Manager Password">#####<PASSWORD>###</property>
        <property name="Referral Strategy">FOLLOW</property>
        <property name="Connect Timeout">10 secs</property>
        <property name="Read Timeout">10 secs</property>
        <property name="Url">####ldap://<address>:<port>####</property>
        <property name="User Search Base">DC=#,DC=#</property>
        <property name="User Search Filter">(sAMAccountName={0})</property>
        <property name="Identity Strategy">USE_USERNAME</property>
        <property name="Authentication Expiration">12 hours</property>
    </provider>
</identityProviders>

内容的提问来源于stack exchange，提问作者Viktoriya Loseva