How to Setup Secure Apache NIFI with Certificate Based Authentication Method: Step By Step Complete Guide

Lot of system administrators and developers are searching on Google that how they can secure Apache NIFI or move it from http to https. People are not much aware about what steps they need to perform to make NIFI secure. So today, we are going to share a complete guide including each step, to all users who want to make NIFI secure using SSL certificate or move it from http to https.

Apache NIFI is an open source tool for workflow automation and by default, it runs without any authentication process. Users can set authentication method and setup secure Apache NIFI using SSL certificate, Apache Knox or LDAP and OpenId Connect. Most of users like to choose SSL certificate based authentication as it is much easy and secure as well.

We will guide you, how you can setup secure Apache NIFI for windows and Linux. First we will talk about the prerequisites then we will guide you what to do step by step.

Prerequisite:

• Apache Nifi binary files
• Authority Certificate (.pem)
• Server based certificate (.pfx)
• Client based certificate (.pfx)
• Truststore key (.jks)
• Ubuntu bash for windows/ Linux Command Line

Steps 1: How to generate certificates

You just need to register on below web link and follow the steps explained in below images.

https://www.tinycert.org/ registration is free. After registration you will see this dashboard page.

Now,First you need to create “Authority Certificate (.pem)” as in below image.

Click on create button.

Provide information as an example information is given in below image.

Click on create and you will see Authority Certificate is created as shown in below image.

Now, you need to create 2 (Server and Client) side SSL certificates. so you need to click on create button highlighted on right side of below image.

Provide information for server and client side certificate details and click on create button as shown in below images.

Now download all of created certificates in below formats.

Steps 2: How to generate Truststore Key (.jks)

All of certificates are ready and now we will create a Truststore key using command line tools.

To generate Truststore Key using Ubuntu Bash , Fist you need to open CMD (Commadn Line tool for windows). navigate to Directory where you saved all 3 certificates. type “bash” and press enter and execute below command.

keytool -import -file <ca_file>.pem -alias cacert -keystore truststore.jks -storepass <password>

For Linux, you just need to navigate to directory having all 3 certificates and then run the above command.

Ask you for agreement, Type “Yes” and press Enter.

You can see your Truststore has been generated and encrypted with a password as well.

Steps 3: How to configure NIFI properties File (nifi.properties)

You need to configure properties highlighted in below image. NIFI properties could be find in “conf” directory.

you can see, we have defined the path to certificates and password which we used will generating Truststore key. now save NIFI properties file.

Steps 4: How to configure Authorizers properties File (Authorizers.xml)

Now last and final step is to add certificate details to Authorizers.xml file and this file also could be found in NIFI “conf” directory.

Note: Red highlighted files are auto generated file after complete configuration and NIFI 1st successful run.

Now, we will edit “Authorizers.xml” file as shown in below image. you need to add below details on 2 places in “Authorizers.xml” file.

“CN=Client, OU=ABC, O=ABC Company, L=Your City, ST=Your State, C=US”

1.

2.

Congratulations, you have completed all backend configurations 🙂

Steps 5: How to configure web browser for accessing NIFI using secure Certificate

it is very simple you just need to import previously generated “Client” certificate at start.

Follow be steps defined in images.

Go to browser settings and search for “Manage Certificates”.

Click on import button.

Now we will run NIFI from “bin” directory by double click on “run-nifi.bat” from windows and “./nifi.sh” from Linux command.

following window will be shown after running.

you can also see log file “nifi-app.log” of NIFI, available in logs directory.

now we are good to go and will navigate to NIFI address on web browser with defined port as we configured “https://localhost:9443/nifi/”

Sometimes NIFI gives an error of “No Header found for NIFI” that is one of the major issue reported in remote deployment of Apache NIFI so you no need to worry. Just add “nifi.web.proxy.host” as shown in below image.

Note: This IP “127.0.0.1” refers to localhost for remote access you need to specify public IP of the machine.

Cheers !

In case of any issue, please comment. i will try to respond you within 24 hours.

For more updates, please bookmark Paktechub