Fix: Use a common JWT issuer across the whole NiFi 2 cluster
Nobody has claimed this yet.
Assessment
- Difficulty
- 5/5
- Estimated time
- Over a week
- Newbie friendliness
- 25/100
- Issue type
- Bug
- Clarity
- Needs clarification
- Activity status
- Stale
- Tech stack
- kubernetes, rust
- Domain
- authentication, infrastructure
Research direction
Review issues 810 and 809 first, then read Apache NiFi issue NIFI-7246 for the upstream constraints. Trace how the issuer is currently generated and whether it persists across restarts; done means one cluster-wide issuer is used and any healthy member accepts a valid JWT.
Written by the indexing model from the issue text.
Description
Part of https://github.com/stackabletech/nifi-operator/issues/809.
[!CAUTION]
Depends on https://github.com/stackabletech/nifi-operator/issues/810.Technically it could be done, but it is likely to be rejected upstream as it appears to have been done to avoid connecting to the wrong server.
Current state
In NiFi2, JWT tokens are issued for specific nodes, and the current recommendation is to use sticky-sessions on load balancers.
NIFI-7246
The uniqueness of JWT-generating keys to individual nodes (and thus the lack of transitivity of tokens between nodes) is by design. The solution is to enable sticky sessions in the load balancer.
This is rather unusual when dealing with a "cluster" where any healthy member should be able to service requests with the same answer as any other, and using the same authentication token.
JWT tokens are by design stateless, they contain everything they need to be validated without sticky-sessions or server-side shared session stores.
Example claim showing the issuer for a specific cluster member.
{
"aud": "https://simple-nifi-node-default-0.simple-nifi-node-default.default.svc.cluster.local:8443",
"exp": 1747013821,
"groups": [],
"iat": 1746985021,
"iss": "https://simple-nifi-node-default-0.simple-nifi-node-default.default.svc.cluster.local:8443",
"jti": "ad20e97e-5f60-4404-87a5-bcd8b3093746",
"nbf": 1746985021,
"preferred_username": "admin",
"sub": "admin"
}
Future state
- There should be a common issuer for the cluster so that a JWT token can be used on any cluster node.
- Any healthy cluster member should accept a valid JWT token in the same way any other cluster member would.
Unknowns
- How is the issuer currently generated? Does it persist across restarts?
- Dominant language
- Rust
- Stars
- 48
- Forks
- 12
- Avg merge
- 11h 26m
- Merged PRs (30d)
- 10
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from stackabletech/nifi-operator
-
Difficulty 3/5 1-2 days Newbie friendliness 68/100
stackabletech/nifi-operator#956 ·
-
Difficulty 4/5 3-5 days Newbie friendliness 45/100
stackabletech/nifi-operator#879 ·
-
customer-request type/bug
Difficulty 3/5 1-2 days Newbie friendliness 42/100
stackabletech/nifi-operator#842 · 1 comment ·
-
size/L
Difficulty 5/5 Over a week Newbie friendliness 20/100
stackabletech/nifi-operator#810 · 1 comment ·
-
epic size/XL type/security
Difficulty 5/5 Over a week Newbie friendliness 15/100
stackabletech/nifi-operator#809 ·
All issues in stackabletech/nifi-operator
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
-
bug good first issue package: quic
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
Difficulty 1/5 Under an hour Newbie friendliness 78/100
-
`dora trace view` sends a non-canonical full UUID as-is, so a valid trace ID shows "No spans found" Opencli coordinator rust
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
-
area: tasks enhancement good first issue help wanted
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
Jason-jo17/Polybench#15 · 1 comment ·