[Merged by Bors] - Add support for LDAP authentication

[sbernauer]

Description

Doesn't make to much sense without authZ, but that is another story. Trying to split that to keep PRs small.

TODOs:

• Release operator-rs
• Watch AuthenticationClass

I tried using multiple LoginIdentityProvider as follows but NIFI failed to start up

        <provider>
            <identifier>login-identity-provider</identifier>
            <class>org.apache.nifi.authentication.single.user.SingleUserLoginIdentityProvider</class>
            <property name="Username">sbernauer</property>
            <property name="Password">sbernauer</property>
        </provider>
        <provider>
            <identifier>login-identity-provider</identifier>
            <class>org.apache.nifi.ldap.LdapProvider</class>
            <property name="Authentication Strategy">{authentication_strategy}</property>

            <property name="Manager DN">xxx_ldap_bind_username_xxx</property>
            <property name="Manager Password">xxx_ldap_bind_password_xxx</property>

            <property name="Referral Strategy">THROW</property>
            <property name="Connect Timeout">10 secs</property>
            <property name="Read Timeout">10 secs</property>

            <property name="Url">{protocol}://{hostname}:{port}</property>
            <property name="User Search Base">{search_base}</property>
            <property name="User Search Filter">{search_filter}</property>

            <property name="TLS - Client Auth">NONE</property>
            <property name="TLS - Keystore">/stackable/keystore/keystore.p12</property>
            <property name="TLS - Keystore Password">secret</property>
            <property name="TLS - Keystore Type">PKCS12</property>
            <property name="TLS - Truststore">/stackable/keystore/truststore.p12</property>
            <property name="TLS - Truststore Password">secret</property>
            <property name="TLS - Truststore Type">PKCS12</property>
            <property name="TLS - Protocol">TLSv1.2</property>
            <property name="TLS - Shutdown Gracefully">true</property>

            <property name="Identity Strategy">USE_DN</property>
            <property name="Authentication Expiration">7 days</property>
        </provider>

Startup error

│ nifi 2022-07-27 13:52:22,343 INFO [NiFi logging handler] org.apache.nifi.StdOut Caused by: org.apache.nifi.authentication.exception.ProviderCreationException: The Authentication Expiration must be specified.                          │
│ nifi 2022-07-27 13:52:22,343 INFO [NiFi logging handler] org.apache.nifi.StdOut     at org.apache.nifi.ldap.LdapProvider.onConfigured(LdapProvider.java:79)

Which doesn't make any sense

Review Checklist

• CRD change approved
• Code contains useful comments
• (Integration-)Test cases added (or not applicable)
• Documentation added (or not applicable)
• Changelog updated (or not applicable)
• Cargo.toml only contains references to git tags (not specific commits or branches)
• Helm chart can be installed and deployed operator works (or not applicable)

Once the review is done, comment bors r+ (or bors merge) to merge. Further information

[maltesander]

LGTM overall. One bigger thing, the create_reporting_task_job fails when using LDAP (because of the missing single user credentials):

cat: /stackable/adminuser/username: No such file or directory                                                   
cat: /stackable/adminuser/password: No such file or directory                                                   
usage: create_nifi_reporting_task.py [-h] -n NIFI_API_URL -u USERNAME -p                                        
                                     PASSWORD -v NIFI_VERSION -c CERT -m                                        
                                     METRICS_PORT [-t TASK_NAME]                                                
create_nifi_reporting_task.py: error: argument -u/--username: expected one argument

Not sure how, but it needs the right credentials from LDAP. Any idea how we can do that?

[sbernauer]

The reporting job should now be fixed.

[maltesander]

LGTM. Maybe talk to @siegfriedweber how and when we can release a new operator-rs tag?

[sbernauer]

@maltesander could you please do one final review?
I released operator-rs and tried using multiple LoginIdentityProviders without success (put the error in the description)

[maltesander]

LGTM.

[sbernauer]

bors r+

[bors]

Pull request successfully merged into main.

Build succeeded:

• All tests passed