[
https://issues.apache.org/jira/browse/NIFI-14061?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17903712#comment-17903712
]
Chris Sampson commented on NIFI-14061:
--------------------------------------
[~exceptionfactory] yes, I'd thought about a similar approach yesterday when
considering how (or if I'd want) to use something like a
[mitm-proxy](https://github.com/mitmproxy/mitmproxy) to sit in between NiFi and
the IdP in order to capture and update the {{well-known}} JSON document in the
response back to NiFi.
A file-based approach would be a lot simpler, albeit the NiFi administrator
would need to bear in mind that any changes to the JSON in the IdP would need
to manually be updated in the local version stored within a file. But that's a
lot simpler than hosting a proxy (of any flavour) in between NiFi and the IdP.
So maybe we should have tickets for implementing:
* a file-based {{well-known}} lookup for NiFi (this ticket?)
* the same for NiFi Registry (NIFI-14062?)
* NiFi (and NiFi Registry) allowing OAuth2 (without OIDC) connectivity with
directly specified IdP endpoints
* NiFi Registry OIDC using the updated Spring Security approach inline with
NiFi (noting the ongoing changes by [~hazmat345] for NIFI-13016 in
https://github.com/apache/nifi/pull/9566)
> Allow override of individual OIDC endpoints
> -------------------------------------------
>
> Key: NIFI-14061
> URL: https://issues.apache.org/jira/browse/NIFI-14061
> Project: Apache NiFi
> Issue Type: Improvement
> Affects Versions: 2.0.0
> Reporter: Chris Sampson
> Priority: Minor
>
> NiFi allows for the use of OIDC for User authentication and authorisation.
> This is currently configured via the
> {{nifi.security.user.oidc.discovery.url}} property (amongst others), which
> relies on the OIDC IdP to present its endpoints via the standard
> {{.well-known/oidc-configuration}} endpoint JSON document.
> In many cases, this is sufficient and works. However, in some network setups
> it might be that one can and would prefer to use internal vs. external
> connectivity for some of the OIDC endpoints (e.g. the token, userinfo,
> JWKSet) whereas others need to remain external (e.g. Auth and Session End)
> for the users to be directed to during login/logout.
> The OIDC IdP is (most likely) not able to be configured to communicate this
> via the {{.well-known}} endpoint as most would likely expect the endpoints to
> be accessed via the same domain by default.
> NiFi could allow users to override these endpoints individually, for example
> the {{.well-known}} document could be the default way to obtain the necessary
> OIDC configuration, but then individual endpoints could be overriden by
> additional (optional) {{nifi.properties}} settings.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
