[
https://issues.apache.org/jira/browse/NIFI-14061?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17903010#comment-17903010
]
David Handermann commented on NIFI-14061:
-----------------------------------------
Thanks for describing this potential improvement [~Chris S].
As described, I don't think it is a good idea to support overriding selected
endpoints from the discovery configuration. The purpose of the OIDC
Configuration is to provide all the necessary configuration, so if it is
incorrect, that should be addressed on the Identity Provider, or through an
intermediate proxy, not at the NiFi level.
With that being said, OIDC is built on top of OAuth 2, and provides
formalization around various approaches. From that angle, there is potential
value in supporting OAuth 2 on its own, which would necessitate configuring
individual endpoints for token retrieval and verification. This excludes some
elements, such as User Info, which are specific to OIDC, but it could support
integrated authentication with providers that do not implement the complete set
of OIDC specifications.
Part of a potential implementation should include identifying at least one
common identity provider that supports expected OAuth 2 endpoints, but not
OIDC. This would provide a baseline of expected support. Without that, the
variety of implementation strategies could make this difficult to maintain.
If you have additional background on a potential identity provider that
supports OAuth 2 with the Authorization Code Flow, but not OIDC, that would be
a helpful bit of additional background.
> Allow override of individual OIDC endpoints
> -------------------------------------------
>
> Key: NIFI-14061
> URL: https://issues.apache.org/jira/browse/NIFI-14061
> Project: Apache NiFi
> Issue Type: Improvement
> Affects Versions: 2.0.0
> Reporter: Chris Sampson
> Priority: Minor
>
> NiFi allows for the use of OIDC for User authentication and authorisation.
> This is currently configured via the
> {{nifi.security.user.oidc.discovery.url}} property (amongst others), which
> relies on the OIDC IdP to present its endpoints via the standard
> {{.well-known/oidc-configuration}} endpoint JSON document.
> In many cases, this is sufficient and works. However, in some network setups
> it might be that one can and would prefer to use internal vs. external
> connectivity for some of the OIDC endpoints (e.g. the token, userinfo,
> JWKSet) whereas others need to remain external (e.g. Auth and Session End)
> for the users to be directed to during login/logout.
> The OIDC IdP is (most likely) not able to be configured to communicate this
> via the {{.well-known}} endpoint as most would likely expect the endpoints to
> be accessed via the same domain by default.
> NiFi could allow users to override these endpoints individually, for example
> the {{.well-known}} document could be the default way to obtain the necessary
> OIDC configuration, but then individual endpoints could be overriden by
> additional (optional) {{nifi.properties}} settings.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
