Specific security tasks for a production NiFi: TLS, authentication providers, authorization policies, sensitive values, restricted components, encryption, patching and testing.
Setting up TLS for NiFi nodes and clients: PEM or keystore files, supported key algorithms, certificates with the right hostnames for cluster endpoint identification, client certificates for Site-to-Site and rotation without downtime.
Designing users, groups and access policies so teams can work on their own process groups: global versus component policies, inheritance, separating view and modify rights, policies for provenance and data, and auditing who can do what.
Using LdapUserGroupProvider to bring directory users and groups into NiFi read-only: LDAPS or START_TLS, search bases and filters, sync interval, composite providers and mapping identities to policies.
Configuring NiFi as an OpenID Connect client of Keycloak: discovery URL, client credentials, claim used as identity, group claims for policies, PKCE, logout and token refresh behavior.
Signing in to NiFi with Microsoft Entra ID over OpenID Connect or SAML: app registration, identity claim choice, group claims and limits, identity mapping rules and keeping a recovery admin.
Why the generated single-user login is a starting point only, and how to move to LDAP, OIDC or SAML with an initial admin group, managed authorizer policies and no shared accounts.
Setting and protecting nifi.sensitive.props.key: what it encrypts, matching keys across cluster nodes, rotating it with the nifi.sh command, and the effect on exported flow definitions and parameter values.
Controlling who can use ExecuteProcess, ExecuteStreamCommand, ExecuteScript and Groovy components: restricted component policies, flow analysis rules that disallow component types, and reviewing flows for command injection.
Locking down the ZooKeeper ensemble NiFi uses for coordination and state: access control lists, TLS between NiFi and ZooKeeper, embedded versus external ZooKeeper and when Kubernetes Leases remove the need for it.
Protecting content, FlowFile and provenance repositories now that NiFi repository encryption is deprecated: volume encryption options, what the sensitive properties key does and does not cover, and evidence for auditors.
Encrypting and signing data inside flows before it leaves NiFi: EncryptContentPGP, SignContentPGP and the age-based EncryptContentAge, key services, and replacing the deprecated EncryptContent processor.
Tracking NiFi and NiFi Registry CVEs, reading severity ratings, planning patch upgrades within the 2.x line and handling third-party library findings in scanner reports.
Scoping a security test of a NiFi deployment: exposed UI and API endpoints, listener processors, authorization policy review, Site-to-Site, management port binding and what the NiFi security model treats as a configuration issue.
A pre-go-live checklist for NiFi: TLS everywhere, real authentication, least-privilege policies, restricted components, sensitive key handling, management port binding, ZooKeeper security, encrypted volumes and patch cadence.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.