nifi-commits mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From mcgil...@apache.org
Subject nifi git commit: NIFI-2953 Update Multi-tenant authorization doc for changes to policy management UI. This closes #1225
Date Tue, 15 Nov 2016 21:11:26 GMT
Repository: nifi
Updated Branches:
  refs/heads/master 45bf8430f -> 76b859c4e


NIFI-2953 Update Multi-tenant authorization doc for changes to policy management UI. This
closes #1225


Project: http://git-wip-us.apache.org/repos/asf/nifi/repo
Commit: http://git-wip-us.apache.org/repos/asf/nifi/commit/76b859c4
Tree: http://git-wip-us.apache.org/repos/asf/nifi/tree/76b859c4
Diff: http://git-wip-us.apache.org/repos/asf/nifi/diff/76b859c4

Branch: refs/heads/master
Commit: 76b859c4efbf621066be4e4e8bb14efd8be6b818
Parents: 45bf843
Author: Andrew Lim <andrewlim.apache@gmail.com>
Authored: Tue Nov 15 15:02:39 2016 -0500
Committer: Matt Gilman <matt.c.gilman@gmail.com>
Committed: Tue Nov 15 16:10:46 2016 -0500

----------------------------------------------------------------------
 .../src/main/asciidoc/administration-guide.adoc |  29 ++++++++++++-------
 .../images/access-policy-config-start.png       | Bin 146821 -> 147911 bytes
 .../asciidoc/images/group-creation-dialog.png   | Bin 22155 -> 23956 bytes
 .../images/override_policy_copy_empty.png       | Bin 0 -> 85319 bytes
 .../process-group-modify-policy-add-user2.png   | Bin 59160 -> 60728 bytes
 .../images/process-group-modify-policy.png      | Bin 84716 -> 85122 bytes
 .../process-group-view-policy-add-user2.png     | Bin 59064 -> 60488 bytes
 .../images/process-group-view-policy.png        | Bin 84686 -> 85737 bytes
 .../processor-inherited-modify-policy.png       | Bin 74404 -> 71252 bytes
 .../asciidoc/images/processor-modify-policy.png | Bin 103896 -> 99723 bytes
 .../processor-replacement-modify-policy.png     | Bin 61262 -> 62718 bytes
 .../processor-replacement-view-policy.png       | Bin 60817 -> 62564 bytes
 .../asciidoc/images/processor-view-policy.png   | Bin 104448 -> 100181 bytes
 .../images/replacetext-processor-added.png      | Bin 179579 -> 182331 bytes
 .../asciidoc/images/user1-create-connection.png | Bin 160503 -> 162464 bytes
 .../asciidoc/images/user1-edit-connection.png   | Bin 185060 -> 187482 bytes
 .../main/asciidoc/images/user1-full-access.png  | Bin 183790 -> 195397 bytes
 .../main/asciidoc/images/user2-can-connect.png  | Bin 179306 -> 176660 bytes
 .../images/user2-connected-processors.png       | Bin 185050 -> 181803 bytes
 .../asciidoc/images/user2-edit-connection.png   | Bin 183074 -> 190377 bytes
 .../asciidoc/images/user2-edit-processor.png    | Bin 188768 -> 193925 bytes
 .../asciidoc/images/user2-moved-processor.png   | Bin 189742 -> 192262 bytes
 .../asciidoc/images/user2-no-connection.png     | Bin 174751 -> 171092 bytes
 .../images/user2-no-edit-connection.png         | Bin 271325 -> 206133 bytes
 .../asciidoc/images/user2-restricted-access.png | Bin 187504 -> 196958 bytes
 25 files changed, 18 insertions(+), 11 deletions(-)
----------------------------------------------------------------------


http://git-wip-us.apache.org/repos/asf/nifi/blob/76b859c4/nifi-docs/src/main/asciidoc/administration-guide.adoc
----------------------------------------------------------------------
diff --git a/nifi-docs/src/main/asciidoc/administration-guide.adoc b/nifi-docs/src/main/asciidoc/administration-guide.adoc
index be2e684..cd063ba 100644
--- a/nifi-docs/src/main/asciidoc/administration-guide.adoc
+++ b/nifi-docs/src/main/asciidoc/administration-guide.adoc
@@ -415,7 +415,7 @@ Here is an example LDAP entry using the name John Smith:
 </authorizers>
 ----
 
-Here is a example Kerberos entry using the name John Smith and realm `NIFI.APACHE.ORG`:
+Here is an example Kerberos entry using the name John Smith and realm `NIFI.APACHE.ORG`:
 
 ----
 <authorizer>
@@ -433,7 +433,7 @@ Here is a example Kerberos entry using the name John Smith and realm `NIFI.APACH
 </authorizers>
 ----
 
-After you have edited and saved the 'authorizers.xml' file, restart NiFi.  The “Initial
Admin Identity” user and administrative policies are added to the 'authorizations.xml' file
during restart. Once NiFi starts, the “Initial Admin Identity” user is able to access
the UI and begin managing users, groups, and policies.
+After you have edited and saved the 'authorizers.xml' file, restart NiFi.  The “Initial
Admin Identity” user and administrative policies are added to the 'users.xml' and 'authorizations.xml'
files during restart. Once NiFi starts, the “Initial Admin Identity” user is able to access
the UI and begin managing users, groups, and policies.
 
 NOTE: For a brand new secure flow, providing the "Initial Admin Identity" gives that user
access to get into the UI and to manage users, groups and policies.  But if that user wants
to start modifying the flow, they need to grant themselves policies for the root process group.
The system is unable to do this automatically because in a new flow the UUID of the root process
group is not permanent until the flow.xml.gz is generated.  If the NiFi instance is an upgrade
from an existing flow.xml.gz or a 1.x instance going from unsecure to secure, then the "Initial
Admin Identity" user is automatically given the privileges to modify the flow.
 
@@ -458,7 +458,7 @@ Here is an example entry:
 </authorizers>
 ----
 
-After you have edited and saved the 'authorizers.xml' file, restart NiFi. Users and roles
from the 'authorized-users.xml' file are converted and added as identities and policies in
the 'authorizations.xml' file.  Once the application starts, users who previously had a legacy
Administrator role can access the UI and begin managing users, groups, and policies.
+After you have edited and saved the 'authorizers.xml' file, restart NiFi. Users and roles
from the 'authorized-users.xml' file are converted and added as identities and policies in
the 'users.xml' and 'authorizations.xml' files.  Once the application starts, users who previously
had a legacy Administrator role can access the UI and begin managing users, groups, and policies.
 
 Here is a summary of policies assigned to each legacy role if the NiFi instance has an existing
flow.xml.gz:
 
@@ -648,6 +648,8 @@ You can override an inherited policy (as described in the <<moving-a-processor>>
 
 NOTE: “View the policies” and “modify the policies” component-level access policies
are an exception to this inherited behavior. When a user is added to either policy, they
are added to the current list of administrators. They do not override higher level administrators. For
this reason, only component specific administrators are displayed for the “view the policies”
and “modify the policies" access policies.
 
+NOTE:  You cannot modify the users/groups on an inherited policy.  Users and groups can only
be added or removed from a parent policy or an override policy.
+
 [[access-policy-config-examples]]
 Access Policy Configuration Examples
 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
@@ -679,8 +681,13 @@ To allow User2 to move the GenerateFlowFile processor in the dataflow
and only t
   image:processor-modify-policy.png["Processor Modify Policy"]
   The “modify the component” policy that currently exists on the processor (child) is
the “modify the component” policy inherited from the root process group (parent) on which
User1 has privileges.
 [start=4]
-4. Select the Override link in the policy inheritance message to create a replacement policy.
-5. On the replacement policy that is created, select the Add User icon (image:iconAddUser.png["Add
User Icon"]). Find or enter User1 in the User Identity field and select OK.  Select the Add
User icon again, find or enter User2 and select OK.
+4. Select the Override link in the policy inheritance message.  When creating the replacement
policy, you are given a choice to override with a copy of the inherited policy or an empty
policy.
+
+image:override_policy_copy_empty.png["Create Override Policy"]
+
+Select the Override button to create a copy.
+[start=5]
+5. On the replacement policy that is created, select the Add User icon (image:iconAddUser.png["Add
User Icon"]). Find or enter User2 in the User Identity field and select OK.
 
 image:processor-replacement-modify-policy.png["Processor Replacement Modify Policy"]
 
@@ -699,8 +706,8 @@ In the “Moving a Processor” example above, User2 was added to the
“modify
   image:processor-view-policy.png["Processor View Policy"]
   The view the component” policy that currently exists on the processor (child) is the
"view the component” policy inherited from the root process group (parent) on which User1
has privileges.
 [start=4]
-4. Select the Override link in the policy inheritance message to create a replacement policy.
-5. On the replacement policy that is created, select the Add User icon (image:iconAddUser.png["Add
User Icon"]). Find or enter User1 in the User Identity field and select OK.  Select the Add
User icon again, find or enter User2 and select OK.
+4. Select the Override link in the policy inheritance message, keep the default of Copy policy
and select the Override button.
+5. On the override policy that is created, select the Add User icon (image:iconAddUser.png["Add
User Icon"]). Find or enter User2 in the User Identity field and select OK.
 
 image:processor-replacement-view-policy.png["Processor Replacement View Policy"]
 
@@ -721,8 +728,8 @@ image:user2-no-connection.png["User2 No Connection"]
 
 This is because:
 
-* User2 does not have modify access on the process group and is therefore not able to create
a connection.
-* Even though User2 has view and modify access to the source component (GenerateFlowFile),
User2 does not have any access policy on the destination component (LogAttribute).
+* User2 does not have modify access on the process group.
+* Even though User2 has view and modify access to the source component (GenerateFlowFile),
User2 does not have an access policy on the destination component (LogAttribute).
 
 To allow User2 to connect GenerateFlowFile to LogAttribute, as User1:
 
@@ -730,7 +737,7 @@ To allow User2 to connect GenerateFlowFile to LogAttribute, as User1:
 2. Select the Access Policies icon (image:iconAccessPolicies.png["Access Policies Icon"])
from the Operate palette and the Access Policies dialog opens.
 3. Select "modify the component” from the policy drop-down.
   image:process-group-modify-policy.png["Process Group Modify Policy"]
-  [start=4]
+[start=4]
 4. Select the Add User icon (image:iconAddUser.png["Add User Icon"]). Find or enter User2
and select OK.
 
 image:process-group-modify-policy-add-user2.png["Process Group Modify Policy Add User2"]
@@ -766,7 +773,7 @@ To allow User2 to connect GenerateFlowFile to ReplaceText, as User1:
 2. Select the Access Policies icon (image:iconAccessPolicies.png["Access Policies Icon"]).
 3. Select "view the component” from the policy drop-down.
   image:process-group-view-policy.png["Process Group View Policy"]
-  [start=4]
+[start=4]
 4. Select the Add User icon (image:iconAddUser.png["Add User Icon"]). Find or enter User2
and select OK.
 
 image:process-group-view-policy-add-user2.png["Process Group View Policy Add User2"]

http://git-wip-us.apache.org/repos/asf/nifi/blob/76b859c4/nifi-docs/src/main/asciidoc/images/access-policy-config-start.png
----------------------------------------------------------------------
diff --git a/nifi-docs/src/main/asciidoc/images/access-policy-config-start.png b/nifi-docs/src/main/asciidoc/images/access-policy-config-start.png
index da3d54b..8d89171 100644
Binary files a/nifi-docs/src/main/asciidoc/images/access-policy-config-start.png and b/nifi-docs/src/main/asciidoc/images/access-policy-config-start.png
differ

http://git-wip-us.apache.org/repos/asf/nifi/blob/76b859c4/nifi-docs/src/main/asciidoc/images/group-creation-dialog.png
----------------------------------------------------------------------
diff --git a/nifi-docs/src/main/asciidoc/images/group-creation-dialog.png b/nifi-docs/src/main/asciidoc/images/group-creation-dialog.png
index 5a23b88..9b7ed2d 100644
Binary files a/nifi-docs/src/main/asciidoc/images/group-creation-dialog.png and b/nifi-docs/src/main/asciidoc/images/group-creation-dialog.png
differ

http://git-wip-us.apache.org/repos/asf/nifi/blob/76b859c4/nifi-docs/src/main/asciidoc/images/override_policy_copy_empty.png
----------------------------------------------------------------------
diff --git a/nifi-docs/src/main/asciidoc/images/override_policy_copy_empty.png b/nifi-docs/src/main/asciidoc/images/override_policy_copy_empty.png
new file mode 100644
index 0000000..5aaa665
Binary files /dev/null and b/nifi-docs/src/main/asciidoc/images/override_policy_copy_empty.png
differ

http://git-wip-us.apache.org/repos/asf/nifi/blob/76b859c4/nifi-docs/src/main/asciidoc/images/process-group-modify-policy-add-user2.png
----------------------------------------------------------------------
diff --git a/nifi-docs/src/main/asciidoc/images/process-group-modify-policy-add-user2.png
b/nifi-docs/src/main/asciidoc/images/process-group-modify-policy-add-user2.png
index aa4225b..1119f8a 100644
Binary files a/nifi-docs/src/main/asciidoc/images/process-group-modify-policy-add-user2.png
and b/nifi-docs/src/main/asciidoc/images/process-group-modify-policy-add-user2.png differ

http://git-wip-us.apache.org/repos/asf/nifi/blob/76b859c4/nifi-docs/src/main/asciidoc/images/process-group-modify-policy.png
----------------------------------------------------------------------
diff --git a/nifi-docs/src/main/asciidoc/images/process-group-modify-policy.png b/nifi-docs/src/main/asciidoc/images/process-group-modify-policy.png
index db1395b..f1af9e0 100644
Binary files a/nifi-docs/src/main/asciidoc/images/process-group-modify-policy.png and b/nifi-docs/src/main/asciidoc/images/process-group-modify-policy.png
differ

http://git-wip-us.apache.org/repos/asf/nifi/blob/76b859c4/nifi-docs/src/main/asciidoc/images/process-group-view-policy-add-user2.png
----------------------------------------------------------------------
diff --git a/nifi-docs/src/main/asciidoc/images/process-group-view-policy-add-user2.png b/nifi-docs/src/main/asciidoc/images/process-group-view-policy-add-user2.png
index 0e1cf6a..4079c1c 100644
Binary files a/nifi-docs/src/main/asciidoc/images/process-group-view-policy-add-user2.png
and b/nifi-docs/src/main/asciidoc/images/process-group-view-policy-add-user2.png differ

http://git-wip-us.apache.org/repos/asf/nifi/blob/76b859c4/nifi-docs/src/main/asciidoc/images/process-group-view-policy.png
----------------------------------------------------------------------
diff --git a/nifi-docs/src/main/asciidoc/images/process-group-view-policy.png b/nifi-docs/src/main/asciidoc/images/process-group-view-policy.png
index 79bda56..40d9ee4 100644
Binary files a/nifi-docs/src/main/asciidoc/images/process-group-view-policy.png and b/nifi-docs/src/main/asciidoc/images/process-group-view-policy.png
differ

http://git-wip-us.apache.org/repos/asf/nifi/blob/76b859c4/nifi-docs/src/main/asciidoc/images/processor-inherited-modify-policy.png
----------------------------------------------------------------------
diff --git a/nifi-docs/src/main/asciidoc/images/processor-inherited-modify-policy.png b/nifi-docs/src/main/asciidoc/images/processor-inherited-modify-policy.png
index b503e25..faa3eb1 100644
Binary files a/nifi-docs/src/main/asciidoc/images/processor-inherited-modify-policy.png and
b/nifi-docs/src/main/asciidoc/images/processor-inherited-modify-policy.png differ

http://git-wip-us.apache.org/repos/asf/nifi/blob/76b859c4/nifi-docs/src/main/asciidoc/images/processor-modify-policy.png
----------------------------------------------------------------------
diff --git a/nifi-docs/src/main/asciidoc/images/processor-modify-policy.png b/nifi-docs/src/main/asciidoc/images/processor-modify-policy.png
index 2efb4fb..ec11a22 100644
Binary files a/nifi-docs/src/main/asciidoc/images/processor-modify-policy.png and b/nifi-docs/src/main/asciidoc/images/processor-modify-policy.png
differ

http://git-wip-us.apache.org/repos/asf/nifi/blob/76b859c4/nifi-docs/src/main/asciidoc/images/processor-replacement-modify-policy.png
----------------------------------------------------------------------
diff --git a/nifi-docs/src/main/asciidoc/images/processor-replacement-modify-policy.png b/nifi-docs/src/main/asciidoc/images/processor-replacement-modify-policy.png
index 398da25..4af2876 100644
Binary files a/nifi-docs/src/main/asciidoc/images/processor-replacement-modify-policy.png
and b/nifi-docs/src/main/asciidoc/images/processor-replacement-modify-policy.png differ

http://git-wip-us.apache.org/repos/asf/nifi/blob/76b859c4/nifi-docs/src/main/asciidoc/images/processor-replacement-view-policy.png
----------------------------------------------------------------------
diff --git a/nifi-docs/src/main/asciidoc/images/processor-replacement-view-policy.png b/nifi-docs/src/main/asciidoc/images/processor-replacement-view-policy.png
index 5fb9968..fa701c6 100644
Binary files a/nifi-docs/src/main/asciidoc/images/processor-replacement-view-policy.png and
b/nifi-docs/src/main/asciidoc/images/processor-replacement-view-policy.png differ

http://git-wip-us.apache.org/repos/asf/nifi/blob/76b859c4/nifi-docs/src/main/asciidoc/images/processor-view-policy.png
----------------------------------------------------------------------
diff --git a/nifi-docs/src/main/asciidoc/images/processor-view-policy.png b/nifi-docs/src/main/asciidoc/images/processor-view-policy.png
index 14f3c7c..8bebd11 100644
Binary files a/nifi-docs/src/main/asciidoc/images/processor-view-policy.png and b/nifi-docs/src/main/asciidoc/images/processor-view-policy.png
differ

http://git-wip-us.apache.org/repos/asf/nifi/blob/76b859c4/nifi-docs/src/main/asciidoc/images/replacetext-processor-added.png
----------------------------------------------------------------------
diff --git a/nifi-docs/src/main/asciidoc/images/replacetext-processor-added.png b/nifi-docs/src/main/asciidoc/images/replacetext-processor-added.png
index a0ea098..7b4fcde 100644
Binary files a/nifi-docs/src/main/asciidoc/images/replacetext-processor-added.png and b/nifi-docs/src/main/asciidoc/images/replacetext-processor-added.png
differ

http://git-wip-us.apache.org/repos/asf/nifi/blob/76b859c4/nifi-docs/src/main/asciidoc/images/user1-create-connection.png
----------------------------------------------------------------------
diff --git a/nifi-docs/src/main/asciidoc/images/user1-create-connection.png b/nifi-docs/src/main/asciidoc/images/user1-create-connection.png
index d12d8cd..6e062c6 100644
Binary files a/nifi-docs/src/main/asciidoc/images/user1-create-connection.png and b/nifi-docs/src/main/asciidoc/images/user1-create-connection.png
differ

http://git-wip-us.apache.org/repos/asf/nifi/blob/76b859c4/nifi-docs/src/main/asciidoc/images/user1-edit-connection.png
----------------------------------------------------------------------
diff --git a/nifi-docs/src/main/asciidoc/images/user1-edit-connection.png b/nifi-docs/src/main/asciidoc/images/user1-edit-connection.png
index 842a8b1..dc3db6c 100644
Binary files a/nifi-docs/src/main/asciidoc/images/user1-edit-connection.png and b/nifi-docs/src/main/asciidoc/images/user1-edit-connection.png
differ

http://git-wip-us.apache.org/repos/asf/nifi/blob/76b859c4/nifi-docs/src/main/asciidoc/images/user1-full-access.png
----------------------------------------------------------------------
diff --git a/nifi-docs/src/main/asciidoc/images/user1-full-access.png b/nifi-docs/src/main/asciidoc/images/user1-full-access.png
index a977d9a..d364a8c 100644
Binary files a/nifi-docs/src/main/asciidoc/images/user1-full-access.png and b/nifi-docs/src/main/asciidoc/images/user1-full-access.png
differ

http://git-wip-us.apache.org/repos/asf/nifi/blob/76b859c4/nifi-docs/src/main/asciidoc/images/user2-can-connect.png
----------------------------------------------------------------------
diff --git a/nifi-docs/src/main/asciidoc/images/user2-can-connect.png b/nifi-docs/src/main/asciidoc/images/user2-can-connect.png
index c2a58b7..37ec232 100644
Binary files a/nifi-docs/src/main/asciidoc/images/user2-can-connect.png and b/nifi-docs/src/main/asciidoc/images/user2-can-connect.png
differ

http://git-wip-us.apache.org/repos/asf/nifi/blob/76b859c4/nifi-docs/src/main/asciidoc/images/user2-connected-processors.png
----------------------------------------------------------------------
diff --git a/nifi-docs/src/main/asciidoc/images/user2-connected-processors.png b/nifi-docs/src/main/asciidoc/images/user2-connected-processors.png
index ff207f2..d8c7bb5 100644
Binary files a/nifi-docs/src/main/asciidoc/images/user2-connected-processors.png and b/nifi-docs/src/main/asciidoc/images/user2-connected-processors.png
differ

http://git-wip-us.apache.org/repos/asf/nifi/blob/76b859c4/nifi-docs/src/main/asciidoc/images/user2-edit-connection.png
----------------------------------------------------------------------
diff --git a/nifi-docs/src/main/asciidoc/images/user2-edit-connection.png b/nifi-docs/src/main/asciidoc/images/user2-edit-connection.png
index 23584bb..a367aea 100644
Binary files a/nifi-docs/src/main/asciidoc/images/user2-edit-connection.png and b/nifi-docs/src/main/asciidoc/images/user2-edit-connection.png
differ

http://git-wip-us.apache.org/repos/asf/nifi/blob/76b859c4/nifi-docs/src/main/asciidoc/images/user2-edit-processor.png
----------------------------------------------------------------------
diff --git a/nifi-docs/src/main/asciidoc/images/user2-edit-processor.png b/nifi-docs/src/main/asciidoc/images/user2-edit-processor.png
index 430a2fe..11e88cb 100644
Binary files a/nifi-docs/src/main/asciidoc/images/user2-edit-processor.png and b/nifi-docs/src/main/asciidoc/images/user2-edit-processor.png
differ

http://git-wip-us.apache.org/repos/asf/nifi/blob/76b859c4/nifi-docs/src/main/asciidoc/images/user2-moved-processor.png
----------------------------------------------------------------------
diff --git a/nifi-docs/src/main/asciidoc/images/user2-moved-processor.png b/nifi-docs/src/main/asciidoc/images/user2-moved-processor.png
index 1dac9f4..a5998d2 100644
Binary files a/nifi-docs/src/main/asciidoc/images/user2-moved-processor.png and b/nifi-docs/src/main/asciidoc/images/user2-moved-processor.png
differ

http://git-wip-us.apache.org/repos/asf/nifi/blob/76b859c4/nifi-docs/src/main/asciidoc/images/user2-no-connection.png
----------------------------------------------------------------------
diff --git a/nifi-docs/src/main/asciidoc/images/user2-no-connection.png b/nifi-docs/src/main/asciidoc/images/user2-no-connection.png
index 3717f04..500f86a 100644
Binary files a/nifi-docs/src/main/asciidoc/images/user2-no-connection.png and b/nifi-docs/src/main/asciidoc/images/user2-no-connection.png
differ

http://git-wip-us.apache.org/repos/asf/nifi/blob/76b859c4/nifi-docs/src/main/asciidoc/images/user2-no-edit-connection.png
----------------------------------------------------------------------
diff --git a/nifi-docs/src/main/asciidoc/images/user2-no-edit-connection.png b/nifi-docs/src/main/asciidoc/images/user2-no-edit-connection.png
index d28127a..6412fd9 100644
Binary files a/nifi-docs/src/main/asciidoc/images/user2-no-edit-connection.png and b/nifi-docs/src/main/asciidoc/images/user2-no-edit-connection.png
differ

http://git-wip-us.apache.org/repos/asf/nifi/blob/76b859c4/nifi-docs/src/main/asciidoc/images/user2-restricted-access.png
----------------------------------------------------------------------
diff --git a/nifi-docs/src/main/asciidoc/images/user2-restricted-access.png b/nifi-docs/src/main/asciidoc/images/user2-restricted-access.png
index c2455ca..9e170c1 100644
Binary files a/nifi-docs/src/main/asciidoc/images/user2-restricted-access.png and b/nifi-docs/src/main/asciidoc/images/user2-restricted-access.png
differ


Mime
View raw message