Nifi login doesn't work with ingress nginx

Question

I've installed an apache nifi secured cluster with the helm-nifi chart (with single user authorization).

When I do port-forworad to my pc and access the https://localhost:8443 I can login nifi without issues and I can see my cluster.

But - when I access nifi via my ingress url (nifi.dev-tools.mycompany.com) and trying to login I get an error:

Inside the pod I can see this error in nifi-user.log:

Caused by: org.springframework.security.oauth2.jwt.BadJwtException: An error occurred while attempting to decode the Jwt: Signed JWT rejected: Another algorithm expected, or no matching key(s) found
        at org.springframework.security.oauth2.jwt.NimbusJwtDecoder.createJwt(NimbusJwtDecoder.java:180)
        at org.springframework.security.oauth2.jwt.NimbusJwtDecoder.decode(NimbusJwtDecoder.java:137)
        at org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationProvider.getJwt(JwtAuthenticationProvider.java:97)
        ... 104 common frames omitted
Caused by: com.nimbusds.jose.proc.BadJOSEException: Signed JWT rejected: Another algorithm expected, or no matching key(s) found
        at com.nimbusds.jwt.proc.DefaultJWTProcessor.process(DefaultJWTProcessor.java:357)
        at com.nimbusds.jwt.proc.DefaultJWTProcessor.process(DefaultJWTProcessor.java:303)
        at org.springframework.security.oauth2.jwt.NimbusJwtDecoder.createJwt(NimbusJwtDecoder.java:154)
        ... 106 common frames omitted

My relevant values are:

replicaCount: 3
externalSecure: true
isNode: true
externalSecure: true
auth:
  singleUser:
    username: username
    password: changemechangeme 
certManager:
  enabled: true
  clusterDomain: cluster.local
  keystorePasswd: changeme
  truststorePasswd: changeme
  replaceDefaultTrustStore: true
  additionalDnsNames:
    - localhost
    - nifi.dev-tools.mycompany.com
ingress:
  enabled: true
  # className: nginx
  annotations:
    nginx.ingress.kubernetes.io/upstream-vhost: "localhost:8443"
    nginx.ingress.kubernetes.io/proxy-redirect-from: "https://localhost:8443"
    nginx.ingress.kubernetes.io/proxy-redirect-to: "https://nifi.dev-tools.mycompany.com"
    kubernetes.io/tls-acme: "true"
    nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
  tls:
    - hosts:
        - nifi.dev-tools.mycompany.com
      secretName: nifi-ca
  hosts:
    - nifi.dev-tools.mycompany.com
  path: /

When I check the tls in my ingress url I can see is not the nifi-ca tls, but my default ingress tls:

In the localhost is:

So I guess it's related... how can I solve it?

Answer 1

I couldn't make it work with single username, but it's working for me with keycloak as user management.

After I deployed keycloak in my cluster I configured the values.yaml to:

oidc:
  enabled: true
  discoveryUrl: http://keycloack.mycompany.com/realms/nifi/.well-known/openid-configuration
  clientId: nifi
  clientSecret: mysecret
  claimIdentifyingUser: email
  admin: [email protected]
  ## Request additional scopes, for example profile
  additionalScopes:

And to make it work need also to update the ingress settings (inside the values.yaml) and add the following annotations:

nginx.ingress.kubernetes.io/affinity: "cookie"
nginx.ingress.kubernetes.io/session-cookie-name: "hello-cookie"
nginx.ingress.kubernetes.io/session-cookie-expires: "1728000"
nginx.ingress.kubernetes.io/session-cookie-max-age: "1728000"
nginx.ingress.kubernetes.io/ssl-redirect: "false"
nginx.ingress.kubernetes.io/affinity-mode: persistent
nginx.ingress.kubernetes.io/session-cookie-hash: sha1

Now I can login the secured cluster with the user that I configured in the keycloak.