[
https://issues.apache.org/jira/browse/NIFI-14061?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17903440#comment-17903440
]
David Handermann commented on NIFI-14061:
-----------------------------------------
Thanks for the helpful background [~Chris S].
The Elasticsearch example is interesting, particularly the fact that they
mention the OIDC Configuration JSON, but don't use it in the configuration.
One idea along these lines that has come to mind in the past would be to
support a file-based URL, in addition to an HTTP URL, for the Discovery URL.
That would require formatting the JSON to match the OIDC specification
standard, but it would support customization at the NiFi level, without
introducing a number of new properties. What do you think about that approach?
Regarding OAuth2, one example that comes to mind is
[GitHub|https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app],
which supports login integration with OAuth2, but not with the full OIDC
specification. That might be one example for an alternative feature
implementation.
As for a more narrowly-scoped change, however, the file-based URL seems worth
considering.
> Allow override of individual OIDC endpoints
> -------------------------------------------
>
> Key: NIFI-14061
> URL: https://issues.apache.org/jira/browse/NIFI-14061
> Project: Apache NiFi
> Issue Type: Improvement
> Affects Versions: 2.0.0
> Reporter: Chris Sampson
> Priority: Minor
>
> NiFi allows for the use of OIDC for User authentication and authorisation.
> This is currently configured via the
> {{nifi.security.user.oidc.discovery.url}} property (amongst others), which
> relies on the OIDC IdP to present its endpoints via the standard
> {{.well-known/oidc-configuration}} endpoint JSON document.
> In many cases, this is sufficient and works. However, in some network setups
> it might be that one can and would prefer to use internal vs. external
> connectivity for some of the OIDC endpoints (e.g. the token, userinfo,
> JWKSet) whereas others need to remain external (e.g. Auth and Session End)
> for the users to be directed to during login/logout.
> The OIDC IdP is (most likely) not able to be configured to communicate this
> via the {{.well-known}} endpoint as most would likely expect the endpoints to
> be accessed via the same domain by default.
> NiFi could allow users to override these endpoints individually, for example
> the {{.well-known}} document could be the default way to obtain the necessary
> OIDC configuration, but then individual endpoints could be overriden by
> additional (optional) {{nifi.properties}} settings.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
