[
https://issues.apache.org/jira/browse/NIFI-16327?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18117661#comment-18117661
]
Nicolas Chauvet edited comment on NIFI-16327 at 9/21/26 9:23 AM:
-----------------------------------------------------------------
Thanks for the answer and sorry for answering back late.
# I've only managed to reproduce with CERT, but others authentication method
are likely affected.
# Here is a redacted reproducer as followed.
# The failure occurs only at login, I haven't tried token renewal
# No logs from HC Vault instance.
# I have a patch that was successfully tested to recover namespace
[https://github.com/apache/nifi/pull/11701]
Redacted reproducer:
- Controller Settings > Management Controller Services
- Click + and fill SSLContext
- Click Add to create SSLContextService
- Edit the service
- Fill keystore and truststore properties
- Save and enable the service.
- Click + and fill Hashi
- Click Add to create StandardHashiCorpVaultClientService
- Fill URL in VaultURI
- Fill namespace
- Pick CERT as Vault Authentication
- Pick the previous SSL Context Service.
- Save and enable the service.
The service kept in enabling state, eventually leading to an error and
backtrace.
(
StandardHashiCorpVaultClientService[id=6c2e45f5-01a0-1000-1fe0-dc003cf3c17a]
Failed to invoke @OnEnabled method:
org.apache.nifi.reporting.InitializationException: Failed to initialize
HashiCorp Vault client
- Caused by: org.springframework.beans.factory.NoSuchBeanDefinitionException:
No bean named 'clientHttpRequestFactoryWrapper' available
org.apache.nifi.reporting.InitializationException: Failed to initialize
HashiCorp Vault client
at
org.apache.nifi.vault.hashicorp.StandardHashiCorpVaultClientService.onEnabled(StandardHashiCorpVaultClientService.java:133)
at
java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:103)
at java.base/java.lang.reflect.Method.invoke(Method.java:580)
at
org.apache.nifi.util.ReflectionUtils.invokeMethodsWithAnnotations(ReflectionUtils.java:146)
at
org.apache.nifi.util.ReflectionUtils.invokeMethodsWithAnnotations(ReflectionUtils.java:134)
at
org.apache.nifi.util.ReflectionUtils.invokeMethodsWithAnnotations(ReflectionUtils.java:79)
at
org.apache.nifi.util.ReflectionUtils.invokeMethodsWithAnnotation(ReflectionUtils.java:56)
at
org.apache.nifi.controller.service.StandardControllerServiceNode$2.run(StandardControllerServiceNode.java:718)
at org.apache.nifi.engine.FlowEngine.lambda$wrap$1(FlowEngine.java:105)
at
java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:572)
at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:317)
at
java.base/java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:304)
at
java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1144)
at
java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:642)
at java.base/java.lang.Thread.run(Thread.java:1583)
Caused by: org.springframework.beans.factory.NoSuchBeanDefinitionException: No
bean named 'clientHttpRequestFactoryWrapper' available
at
org.springframework.beans.factory.support.DefaultListableBeanFactory.getBeanDefinition(DefaultListableBeanFactory.java:971)
at
org.springframework.beans.factory.support.AbstractBeanFactory.getMergedLocalBeanDefinition(AbstractBeanFactory.java:1369)
at
org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:296)
at
org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:201)
at
org.springframework.context.support.AbstractApplicationContext.getBean(AbstractApplicationContext.java:1305)
at
org.springframework.vault.config.AbstractVaultConfiguration.getClientFactoryWrapper(AbstractVaultConfiguration.java:345)
at
org.springframework.vault.config.AbstractVaultConfiguration.vaultClient(AbstractVaultConfiguration.java:149)
at
org.springframework.vault.config.EnvironmentVaultConfiguration.clientAuthentication(EnvironmentVaultConfiguration.java:270)
at
org.apache.nifi.vault.hashicorp.StandardHashiCorpVaultCommunicationService.<init>(StandardHashiCorpVaultCommunicationService.java:117)
at
org.apache.nifi.vault.hashicorp.StandardHashiCorpVaultClientService.createCommunicationService(StandardHashiCorpVaultClientService.java:168)
at
org.apache.nifi.vault.hashicorp.StandardHashiCorpVaultClientService.onEnabled(StandardHashiCorpVaultClientService.java:131)
... 14 more
)
was (Author: kwizart):
Thanks for the answer and sorry for answering back late.
# I've only managed to reproduce with CERT, but others authentication method
are likely affected.
# Here is a redacted reproducer as followed.
# The failure occurs only at login, I haven't tried token renewal
# No logs from HC Vault instance.
# I have a patch that was successfully tested to recover namespace
[https://github.com/apache/nifi/pull/11701]
Redacted reproducer:
- Controller Settings > Management Controller Services
- Click + and fill SSLContext
- Click Add to create SSLContextService
- Edit the service
- Fill keystore and truststore properties
- Save and enable the service.
- Click + and fill Hashi
- Click Add to create StandardHashiCorpVaultClientService
- Fill URL in VaultURI
- Pick CERT as Vault Authentication
- Pick the previous SSL Context Service.
- Save and enable the service.
The service kept in enabling state, eventually leading to an error and
backtrace.
(
StandardHashiCorpVaultClientService[id=6c2e45f5-01a0-1000-1fe0-dc003cf3c17a]
Failed to invoke @OnEnabled method:
org.apache.nifi.reporting.InitializationException: Failed to initialize
HashiCorp Vault client
- Caused by: org.springframework.beans.factory.NoSuchBeanDefinitionException:
No bean named 'clientHttpRequestFactoryWrapper' available
org.apache.nifi.reporting.InitializationException: Failed to initialize
HashiCorp Vault client
at
org.apache.nifi.vault.hashicorp.StandardHashiCorpVaultClientService.onEnabled(StandardHashiCorpVaultClientService.java:133)
at
java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:103)
at java.base/java.lang.reflect.Method.invoke(Method.java:580)
at
org.apache.nifi.util.ReflectionUtils.invokeMethodsWithAnnotations(ReflectionUtils.java:146)
at
org.apache.nifi.util.ReflectionUtils.invokeMethodsWithAnnotations(ReflectionUtils.java:134)
at
org.apache.nifi.util.ReflectionUtils.invokeMethodsWithAnnotations(ReflectionUtils.java:79)
at
org.apache.nifi.util.ReflectionUtils.invokeMethodsWithAnnotation(ReflectionUtils.java:56)
at
org.apache.nifi.controller.service.StandardControllerServiceNode$2.run(StandardControllerServiceNode.java:718)
at org.apache.nifi.engine.FlowEngine.lambda$wrap$1(FlowEngine.java:105)
at
java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:572)
at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:317)
at
java.base/java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:304)
at
java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1144)
at
java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:642)
at java.base/java.lang.Thread.run(Thread.java:1583)
Caused by: org.springframework.beans.factory.NoSuchBeanDefinitionException: No
bean named 'clientHttpRequestFactoryWrapper' available
at
org.springframework.beans.factory.support.DefaultListableBeanFactory.getBeanDefinition(DefaultListableBeanFactory.java:971)
at
org.springframework.beans.factory.support.AbstractBeanFactory.getMergedLocalBeanDefinition(AbstractBeanFactory.java:1369)
at
org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:296)
at
org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:201)
at
org.springframework.context.support.AbstractApplicationContext.getBean(AbstractApplicationContext.java:1305)
at
org.springframework.vault.config.AbstractVaultConfiguration.getClientFactoryWrapper(AbstractVaultConfiguration.java:345)
at
org.springframework.vault.config.AbstractVaultConfiguration.vaultClient(AbstractVaultConfiguration.java:149)
at
org.springframework.vault.config.EnvironmentVaultConfiguration.clientAuthentication(EnvironmentVaultConfiguration.java:270)
at
org.apache.nifi.vault.hashicorp.StandardHashiCorpVaultCommunicationService.<init>(StandardHashiCorpVaultCommunicationService.java:117)
at
org.apache.nifi.vault.hashicorp.StandardHashiCorpVaultClientService.createCommunicationService(StandardHashiCorpVaultClientService.java:168)
at
org.apache.nifi.vault.hashicorp.StandardHashiCorpVaultClientService.onEnabled(StandardHashiCorpVaultClientService.java:131)
... 14 more
)
> HC Vault namespace propagation error on non-token Authentication
> ----------------------------------------------------------------
>
> Key: NIFI-16327
> URL: https://issues.apache.org/jira/browse/NIFI-16327
> Project: Apache NiFi
> Issue Type: Bug
> Components: Extensions
> Affects Versions: 2.10.0, 2.11.0
> Reporter: Nicolas Chauvet
> Priority: Trivial
> Labels: vault
> Time Spent: 10m
> Remaining Estimate: 0h
>
> The vault.namespace property was not propagated to login requests for CERT
> and other non-TOKEN authentication methods, because NIFI-16013 removed the
> restTemplateBuilder override that added the X-Vault-Namespace header. Spring
> Vault 4.1 builds the login VaultClient through that builder, so the login
> request was sent to the Vault root namespace.
> This is a regression introduced in 2.10.0
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
