exceptionfactory commented on a change in pull request #5262:
URL: https://github.com/apache/nifi/pull/5262#discussion_r680401912
##########
File path: nifi-docs/src/main/asciidoc/administration-guide.adoc
##########
@@ -489,6 +489,28 @@ To enable authentication via Apache Knox the following
properties must be config
this listing. The audience that is populated in the token can be configured in
Knox.
|==================================================================================================================================================
+[[json_web_token]]
+=== JSON Web Tokens
+
+NiFi uses JSON Web Tokens to provide authenticated access after the initial
login process. Generated JSON Web Tokens include the authenticated user identity
+as well as the issuer and expiration from the configured Login Identity
Provider.
+
+NiFi uses generated RSA Key Pairs with a key size of 4096 bits to support the
`RS512` algorithm for JSON Web Signatures. The system stores RSA
+Public Keys using the configured local State Provider and retains the RSA
Private Key in memory. This approach supports signature verification
+for the expiration configured in the Login Identity Provider without
persisting the private key.
+
+JSON Web Token support includes revocation on logout using JSON Web Token
Identifiers. The system denies access for expired tokens based on the
+Login Identity Provider configuration, but revocation invalidates the token
prior to expiration. The system stores revoked identifiers using the
Review comment:
Thanks for pointing out the detail of the
`SingleUserLoginIdentityProvider`. The documentation is generic to cover both
explicit configuration values or internal default settings, which are specific
to the provider implementation. In light that, do you think the current word is
sufficient? Perhaps a separate PR to update the Single User authentication
section would be helpful.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
