Client Registry Toolkit Download
Fusberta Loparo
Currently the CLI supports authenticating with a client certificate and an optional proxied-entity. A common scenario would be running the CLI from one of the nodes where NiFi or NiFi Registry is installed, which allows the CLI to use the same keystore and truststore as the NiFi/NiFi Registry instance.
This protection scheme uses HashiCorp Vault Transit Secrets Engine to outsource encryption to a configured Vault server. All HashiCorp Vault configuration is stored in the bootstrap-hashicorp-vault.conf file, as referenced in the bootstrap.conf of a NiFi or NiFi Registry instance. Therefore, when using the HASHICORP_VAULT_TRANSIT protection scheme, the nifi(.registry)?.bootstrap.protection.hashicorp.vault.conf property in the bootstrap.conf specified using the -b flag must be available to the Encrypt Configuration Tool and must be configured as described in the HashiCorp Vault providers section in the NiFi Administration Guide.
This protection scheme uses HashiCorp Vault Key Value Secrets Engine Version 1 to store sensitive values as Vault Secrets. All HashiCorp Vault configuration is stored in the bootstrap-hashicorp-vault.conf file, as referenced in the bootstrap.conf of a NiFi or NiFi Registry instance. Therefore, when using the HASHICORP_VAULT_KV protection scheme, the nifi(.registry)?.bootstrap.protection.hashicorp.vault.conf property in the bootstrap.conf specified using the -b flag must be available to the Encrypt Configuration Tool and must be configured as described in the HashiCorp Vault providers section in the NiFi Administration Guide.
This protection scheme uses AWS Key Management Service for encryption and decryption. AWS KMS configuration properties can be stored in the bootstrap-aws.conf file, as referenced in the bootstrap.conf of NiFi or NiFi Registry. If the configuration properties are not specified in bootstrap-aws.conf, then the provider will attempt to use the AWS default credentials provider, which checks standard environment variables and system properties. Therefore, when using the AWS_KMS protection scheme, the nifi(.registry)?.bootstrap.protection.aws.conf property in the bootstrap.conf specified using the -b flag must be available to the Encrypt Configuration Tool and must be configured as described in the AWS KMS provider section in the NiFi Administration Guide.
This protection scheme uses AWS Secrets Manager Service to store sensitive values as AWS Secrets. AWS Secrets Manager configuration properties can be stored in the bootstrap-aws.conf file, as referenced in the bootstrap.conf of NiFi or NiFi Registry. If the configuration properties are not specified in bootstrap-aws.conf, then the provider will attempt to use the AWS default credentials provider, which checks standard environment variables and system properties. Therefore, when using the AWS_SECRETS_MANAGER protection scheme, the nifi(.registry)?.bootstrap.protection.aws.conf property in the bootstrap.conf specified using the -b flag must be available to the Encrypt Configuration Tool and must be configured as described in the AWS Secrets Manager provider section in the NiFi Administration Guide.
Azure Key Vault providers will use theDefaultAzureCredentialfor authentication.The Azure Identity client librarydescribes the process for credentials resolution, which leverages environment variables, system properties, and fallsback toManaged Identityauthentication.
This protection scheme uses Google Cloud Key Management Service (Google Cloud Key Management Service) for encryption and decryption. Google Cloud KMS configuration properties are to be stored in the bootstrap-gcp.conf file, as referenced in the bootstrap.conf of NiFi or NiFi Registry. Credentials must be configured as per the following documentation: Google Cloud KMS documentation. Therefore, when using the GCP_KMS protection scheme, the nifi(.registry)?.bootstrap.protection.gcp.kms.conf property in the bootstrap.conf specified using the -b flag must be available to the Encrypt Configuration Tool and must be configured as described in the Google Cloud KMS provider section in the NiFi Administration Guide.
Sensitive configuration values are encrypted by the tool by default, however you can encrypt any additional properties, if desired.To encrypt additional properties, specify them as comma-separated values in the nifi.registry.sensitive.props.additional.keys property.
If the nifi-registry.properties file already has valid protected values and you wish to protect additional values using thesame root key already present in your bootstrap.conf, then run the tool without specifying a new key:
In order to change the key used to encrypt the sensitive values, provide the new key or password using the -k or -p flags as usual,and provide the existing key or password using --old-key or --old-password respectively. This will allow the toolkit to decrypt theexisting values and re-encrypt them, and update bootstrap.conf with the new key. Only one of the key or password needs to be specifiedfor each phase (old vs. new), and any combination is sufficient:
The following is an example of the commands for protection scheme migration from AES_GCM to AWS_KMS then back. Execute these commands at the nifi directory with the nifi-toolkit directory as a sibling directory. In addition, make sure to update bootstrap-aws.conf with your AWS KMS Key ARN/ID and have your credentials and region configured.
In order to facilitate the secure setup of NiFi, you can use the tls-toolkit command line utility to automatically generate the required keystores, truststore, and relevant configuration files. This is especially useful for securing multiple NiFi nodes, which can be a tedious and error-prone process.
The client can be used to request new Certificates from the CA. The client utility generates a keypair and Certificate Signing Request (CSR) and sends the CSR to the Certificate Authority. CA client mode is invoked by running ./bin/tls-toolkit.sh client or bin\tls-toolkit.sh client.
Place the files in the toolkit working directory. This is the directory where the tool is configured to output the signed certificates. This is not necessarily the directory where the binary is located or invoked.
For example, given the following scenario, the toolkit command can be run from its location as long as the output directory -o is ../hardcoded/, and the existing nifi-cert.pem and nifi-key.key will be used.
e.g. $ ./toolkit/bin/tls-toolkit.sh standalone -o ./hardcoded/ -n 'node4.nifi.apache.org' -P thisIsABadPassword -S thisIsABadPassword -O will result in a new directory at ./hardcoded/node4.nifi.apache.org with a keystore and truststore containing a certificate signed by ./hardcoded/nifi-key.key
I am using PSADT for about half a year now and almost every day, I get more excited about it. Packaging and software deploying is nothing new to me, before we started with intune, I managed about 500 clients with Matrix42/Empirum for about 5 years.
I had some trouble reading the registry values from HKCU, so I read them from HCU (no problem as we always have only 1 user profile per laptop). The rest runs like Mirko and That-Annoying-Guy suggested.
More about nifi.registry.sensitive.props.additional.keys - -registry-docs/html/administration-guide.html#encrypted-passwords-in-configuration-files::text=values%20in%20the-,nifi.registry.sensitive.props.additional.keys,-property.
Oracle recommends using the latest 19c Release Update of Oracle Instant Clientor Oracle Database Client. This is a Long Term Release.
Alternatively you can use the latest 21c Release Update if you require clientfeatures introduced in this Innovation Release.
DigiCert retired the Organizational Unit (OU) field for all public TLS/SSLcertificates to comply with industry standards as of August 2022. This meansthat public TLS/SSL certificates issued by DigiCert will no longer have an OUfield. Refer to MOS note 2911553.1for details.
To avoid disruption to applications connecting to Oracle Autonomous Database onShared Exadata Infrastructure (ADB-S) during the server side certificatechange, you must use hostname based matching of the server certificate.
The following versions of Oracle Instant Client automatically support hostnamebased matching:
Versions: 18.19 (or later), 19.2 (or later), 21 (base release or later)
- Oracle Call Interface (OCI), Oracle C++ Call Interface (OCCI) or ODBCapplications must use one of the above client versions.
- Oracle Database drivers based on Oracle Instant Client or Oracle DatabaseClient (e.g ODPI-C, python-oracledb Thick mode, cx_Oracle, node-oracledb,godror, PHP OCI8, PHP PDO_OCI, ruby-oci8, ROracle, and rust-oracle) must usethe driver with a compatible client version from the list above.
ADB-S connection strings contain a hostname "...(HOST=xyz)..." which depends onthe region. For example, in the Chicago region the hostname would be"adb.us-chicago-1.oraclecloud.com". If you have replaced the default hostnamewith an IP address or a custom hostname, then hostname based DN matching willfail. The solution is to add a new entry to your /etc/hosts file using theoriginal ADB-S domain suffix. Your connection string should then use this newname. For example an entry "localtunnel.adb.us-chicago-1.oraclecloud.com"could be created and used.
In summary, registries are patient-centered, purpose-driven, and designed to derive information on defined exposures and health outcome. In contrast, EHRs are visit-centered and transactional. Despite these differences, EHRs capture a wealth of data that is relevant to patient registries. EHRs also may assist in certain functions that a patient registry requires (e.g., data collection, data cleaning, data storage), and a registry may augment the value of the information collected in an EHR (e.g., comparative safety, effectiveness and value, population management, quality reporting).3
df19127ead