Package org.apache.nifi.web.security.configuration

Class JwtAuthenticationSecurityConfiguration

java.lang.Object

org.apache.nifi.web.security.configuration.JwtAuthenticationSecurityConfiguration

@Configuration
public class JwtAuthenticationSecurityConfiguration
extends Object

JSON Web Token Configuration for Authentication Security

Field Summary

Fields

Modifier and Type	Field	Description
private final Authorizer	authorizer
private final org.springframework.security.oauth2.jwt.JwtDecoder	jwtDecoder
private final JwtRevocationService	jwtRevocationService
private final Duration	keyRotationPeriod
private final NiFiProperties	niFiProperties
private final StandardVerificationKeySelector	verificationKeySelector
private final VerificationKeyService	verificationKeyService

Constructor Summary

Constructors

Constructor	Description
JwtAuthenticationSecurityConfiguration(NiFiProperties niFiProperties, Authorizer authorizer, org.springframework.security.oauth2.jwt.JwtDecoder jwtDecoder, JwtRevocationService jwtRevocationService, StandardVerificationKeySelector standardVerificationKeySelector, VerificationKeyService verificationKeyService)

Method Summary

Modifier and Type	Method	Description
StandardAuthenticationEntryPoint	authenticationEntryPoint()	Authentication Entry Point delegating to Bearer Token Entry Point for returning headers on authentication failures
org.springframework.security.oauth2.server.resource.web.authentication.BearerTokenAuthenticationFilter	bearerTokenAuthenticationFilter(org.springframework.security.authentication.AuthenticationManager authenticationManager, org.springframework.security.authentication.AuthenticationDetailsSource<jakarta.servlet.http.HttpServletRequest,NiFiWebAuthenticationDetails> authenticationDetailsSource)	Bearer Token Authentication Filter responsible for reading and authenticating Bearer JSON Web Tokens from HTTP Requests
BearerTokenProvider	bearerTokenProvider()	Application Bearer Token Provider responsible for signing and encoding new JSON Web Tokens
org.springframework.security.oauth2.server.resource.web.BearerTokenResolver	bearerTokenResolver()	Bearer Token Resolver responsible for reading Bearer JSON Web Tokens from HTTP headers or cookies
org.springframework.scheduling.concurrent.ThreadPoolTaskScheduler	commandScheduler()	Command Scheduler responsible for running commands in background thread
IssuerProvider	issuerProvider()
StandardJwsSignerProvider	jwsSignerProvider()	JSON Web Signature Signer Provider responsible for managing Bearer Token signing key pairs
StandardJwtAuthenticationConverter	jwtAuthenticationConverter()	JSON Web Token Authentication Converter provides application User objects
org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationProvider	jwtAuthenticationProvider()	JSON Web Token Authentication Provider responsible for decoding and verifying Bearer Tokens from HTTP Requests
JwtLogoutListener	jwtLogoutListener()	JSON Web Token Logout Listener responsible for revoking application Bearer Tokens after logout completion
KeyExpirationCommand	keyExpirationCommand()	Key Expiration Command responsible for removing expired signing key pairs
KeyGenerationCommand	keyGenerationCommand(KeyPairGenerator keyPairGenerator)	Key Generation Command responsible for rotating JSON Web Signature key pairs based on configuration
RevocationExpirationCommand	revocationExpirationCommand()	Revocation Expiration Command responsible for removing expired application Bearer Token revocation records

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

niFiProperties

private final NiFiProperties niFiProperties

authorizer

private final Authorizer authorizer

jwtDecoder

private final org.springframework.security.oauth2.jwt.JwtDecoder jwtDecoder

jwtRevocationService

private final JwtRevocationService jwtRevocationService

verificationKeySelector

private final StandardVerificationKeySelector verificationKeySelector

verificationKeyService

private final VerificationKeyService verificationKeyService

keyRotationPeriod

private final Duration keyRotationPeriod

Constructor Details

JwtAuthenticationSecurityConfiguration

@Autowired
public JwtAuthenticationSecurityConfiguration(NiFiProperties niFiProperties,
 Authorizer authorizer,
 org.springframework.security.oauth2.jwt.JwtDecoder jwtDecoder,
 JwtRevocationService jwtRevocationService,
 StandardVerificationKeySelector standardVerificationKeySelector,
 VerificationKeyService verificationKeyService)

Method Details

bearerTokenAuthenticationFilter

@Bean
public org.springframework.security.oauth2.server.resource.web.authentication.BearerTokenAuthenticationFilter bearerTokenAuthenticationFilter(org.springframework.security.authentication.AuthenticationManager authenticationManager,
 org.springframework.security.authentication.AuthenticationDetailsSource<jakarta.servlet.http.HttpServletRequest,NiFiWebAuthenticationDetails> authenticationDetailsSource)

Bearer Token Authentication Filter responsible for reading and authenticating Bearer JSON Web Tokens from HTTP Requests

Parameters:

authenticationManager - Authentication Manager configured with JWT Authentication Provider

Returns:

Bearer Token Authentication Filter

bearerTokenResolver

@Bean
public org.springframework.security.oauth2.server.resource.web.BearerTokenResolver bearerTokenResolver()

Bearer Token Resolver responsible for reading Bearer JSON Web Tokens from HTTP headers or cookies

Returns:

Standard implementation of Bearer Token Resolver

authenticationEntryPoint

@Bean
public StandardAuthenticationEntryPoint authenticationEntryPoint()

Authentication Entry Point delegating to Bearer Token Entry Point for returning headers on authentication failures

Returns:

Authentication Entry Point

jwtAuthenticationProvider

@Bean
public org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationProvider jwtAuthenticationProvider()

JSON Web Token Authentication Provider responsible for decoding and verifying Bearer Tokens from HTTP Requests

Returns:

JSON Web Token Authentication Provider

jwtLogoutListener

@Bean
public JwtLogoutListener jwtLogoutListener()

JSON Web Token Logout Listener responsible for revoking application Bearer Tokens after logout completion

Returns:

JSON Web Token Logout Listener using Revocation Service for tracking

jwtAuthenticationConverter

@Bean
public StandardJwtAuthenticationConverter jwtAuthenticationConverter()

JSON Web Token Authentication Converter provides application User objects

Returns:

Authentication Converter from JSON Web Tokens to User objects

bearerTokenProvider

@Bean
public BearerTokenProvider bearerTokenProvider()

Application Bearer Token Provider responsible for signing and encoding new JSON Web Tokens

Returns:

Application Bearer Token Provider

issuerProvider

@Bean
public IssuerProvider issuerProvider()

jwsSignerProvider

@Bean
public StandardJwsSignerProvider jwsSignerProvider()

JSON Web Signature Signer Provider responsible for managing Bearer Token signing key pairs

Returns:

JSON Web Signature Signer Provider

keyGenerationCommand

@Bean
public KeyGenerationCommand keyGenerationCommand(KeyPairGenerator keyPairGenerator)

Key Generation Command responsible for rotating JSON Web Signature key pairs based on configuration

Parameters:

keyPairGenerator - Key Pair Generator for JSON Web Signatures

Returns:

Key Generation Command scheduled according to application properties

keyExpirationCommand

@Bean
public KeyExpirationCommand keyExpirationCommand()

Key Expiration Command responsible for removing expired signing key pairs

Returns:

Key Expiration Command scheduled according to application properties

revocationExpirationCommand

@Bean
public RevocationExpirationCommand revocationExpirationCommand()

Revocation Expiration Command responsible for removing expired application Bearer Token revocation records

Returns:

Revocation Expiration Command scheduled according to application properties

commandScheduler

@Bean
public org.springframework.scheduling.concurrent.ThreadPoolTaskScheduler commandScheduler()

Command Scheduler responsible for running commands in background thread

Returns:

Thread Pool Task Scheduler with named threads