Nifi 2.4.0 - OIDC authentication

[jpjoux]

I am using nipyapi==0.22.0
In Nifi, no issue to authenticate by using OIDC

I am able to connect to our Identity Provider
I am retrieving a token and I am looking for a processor group

set_service_auth_token(token=access_token)
pg = nipyapi.canvas.get_process_group(PROCESSING_GROUP_NAME, "name", False)

I have the following error when calling get_process_group :

  File "~/python3.11/site-packages/future/utils/__init__.py", line 406, in raise_from
    exec(execstr, myglobals, mylocals)
  File "<string>", line 1, in <module>
ValueError: {
"cause0":"java.lang.IllegalArgumentException: Identity cannot be null",
"message":"java.lang.IllegalArgumentException: Identity cannot be null",
"url":"/nifi-api/flow/process-groups/root",
"status":"500"
}

What is wrong ?

[Chaffelson]

The 0.x client only supports NiFi 1.x
To work with NiFi 2.x you'll need the PR for the major update.
#388

There's instructions in there for creating a NiFi OIDC profile and how to Auth - the docs are newly written for it so please let me know your feedback.

[jpjoux]

Thank for your feed back

I have tested the following code

import nipyapi
import requests
from importlib.metadata import version
from nipyapi import config, utils

# tested with nifi2x branch
print(f'--> Nipyapi version: {version("nipyapi")}')

nipyapi.config.nifi_config.verify_ssl = False
nipyapi.config.global_ssl_verify = False
nipyapi.config.disable_insecure_request_warnings = True
nifi_login = "toto@toto.com"
nifi_password = "password123"
utils.set_endpoint("https://nifi-2.preprod.test.internal/nifi-api", ssl=False, login=True)

response = nipyapi.security.service_login_oidc(
    service='nifi', 
    username=nifi_login,
    password=nifi_password,
    client_id='nifi-2',
    client_secret='clientsecret123456',
    oidc_token_endpoint='https://keycloak.preprod.test.internal/auth/realms/test/protocol/openid-connect/token',
    bool_response=False,
    return_token_info=True
)

# we obtain token from keycloack
print(response)

# testing to get process group 
nipyapi.canvas.get_process_group("my-workflow")

And we have the following error

...
  File "/home/test/Developpements/GIT/Tmp/nipyapi/nipyapi/nifi/rest.py", line 214, in request
    raise ApiException(http_resp=r)
nipyapi.nifi.rest.ApiException: (401)
Reason: Unauthorized
...
'Bearer error="invalid_token", error_description="An error occurred while attempting to decode the Jwt: Signed JWT rejected: Another algorithm expected, or no matching key(s) found"

Traceback (most recent call last):
  File "/home/test/Developpements/GIT/Tmp/test_py_scripts/test_nipyapi.py", line 43, in <module>
    nipyapi.canvas.get_process_group("my-workflow")
  File "/home/test/Developpements/GIT/Tmp/nipyapi/nipyapi/utils.py", line 613, in wrapper
    return f(*args, **kwargs)
           ^^^^^^^^^^^^^^^^^^
  File "/home/test/Developpements/GIT/Tmp/nipyapi/nipyapi/canvas.py", line 171, in get_process_group
    with nipyapi.utils.rest_exceptions():
  File "/usr/lib/python3.11/contextlib.py", line 155, in __exit__
    self.gen.throw(typ, value, traceback)
  File "/home/test/Developpements/GIT/Tmp/nipyapi/nipyapi/utils.py", line 603, in rest_exceptions
    raise ValueError(e.body) from e
ValueError: Unauthorized error="invalid_token", error_description="An error occurred while attempting to decode the Jwt: Signed JWT rejected: Another algorithm expected, or no matching key(s) found", error_uri="https://tools.ietf.org/html/rfc6750#section-3.1"

It seems that the token provided to NIFI Api does not use an algorithm known by Nifi-2

Any idea ?

[Chaffelson]

So it looks like service_login_oidc is working as expected and fetching the token, but NiFi is rejecting it.
NiPyAPI is testing with keycloak 23 using default settings for OIDC, and this error doesn't occur locally, so I would suspect that either you're on a version with different defaults or have modified the algorithm being used for user nifi-2 or have modified the one that NiFi is expecting.

Per the NiFi SysAdmin Guide it defaults to RS256 and is controlled by NiFi setting nifi.security.user.oidc.preferred.jwsalgorithm.

See if you can find a mismatch in these configurations, or you could unpack the token to see what algorithm is being used to ensure it's doing what is expected.

Also if you just want to look at NiFi / NiPy with OIDC auth, there is a sandbox option in the PR for profile secure-oidc which will use docker compose to connect NiFi with Keycloak using simple defaults if that is useful to you.
If you have docker desktop running, you can checkout the PR, and run NIPYAPI_PROFILE=secure-oidc make sandbox from the project root to instantiate it.