NIFI-14048 Add fallback to RSA for Framework Application Tokens

[exceptionfactory]

Summary

NIFI-14048 Adjusts the framework web application security configuration to support fallback to the RSA key algorithm and the PS512 JSON Web Signature algorithm when the runtime Java Security Provider does not support the Ed25519 key algorithm.

NiFi versions prior to 2.0.0 used RSA with PS512 for signing and verifying Application Bearer Tokens. NiFi 2.0.0 changed the implementation to use Ed25519 with EdDSA for smaller key and signature sizes providing similar or better security than RSA.

At the time of this writing, Java Security Providers that enforce Federal Information Processing Standards do not include Ed25519 in the list of approved algorithms. FIPS 186-5 published in February 2023 adds Ed25519 to the list of approved algorithms, and FIPS providers such as Bouncy Castle have submitted versions for approval that include Ed25519.

Although the project does not provide official support for operating in a mode compatible with FIPS providers, enabling fallback support for RSA enables a transitional upgrade path for current deployments. Instead of introducing a new framework configuration property, changes in this pull request use java.security.Security to determine whether Ed25519 is supported on startup. In absence of support for Ed25519, the framework selects RSA for rotating JWT key pair generation and PS512 for token signing. The framework logs a message indicating the selected algorithm. This approach also provides the opportunity for subsequent removal when support for Ed25519 is incorporated in providers such as Bouncy Castle.

Tracking

Please complete the following tracking steps prior to pull request creation.

Issue Tracking

• Apache NiFi Jira issue created

Pull Request Tracking

• Pull Request title starts with Apache NiFi Jira issue number, such as NIFI-00000
• Pull Request commit message starts with Apache NiFi Jira issue number, as such NIFI-00000

Pull Request Formatting

• Pull Request based on current revision of the main branch
• Pull Request refers to a feature branch with one commit containing changes

Verification

Please indicate the verification steps performed prior to pull request creation.

Build

• Build completed using mvn clean install -P contrib-check
  • JDK 21

Licensing

• New dependencies are compatible with the Apache License 2.0 according to the License Policy
• New dependencies are documented in applicable LICENSE and NOTICE files

Documentation

• Documentation formatting appears as expected in rendered files

[exceptionfactory]

These changes can be tested at runtime using a standard Java Runtime Environment with a custom Java security properties configuration.

1. Create java.security.properties in the NiFi conf directory
2. Add the following line to java.security.properties:

security.provider.3=SunJCE

3. Add the following line to bootstrap.conf in the NiFi conf directory:

java.arg.securityProperties=-Djava.security.properties=./conf/java.security.properties

4. Start NiFi and view the nifi-user.log for the selected Key Pair Algorithm, which should be RSA

Configured Key Pair Algorithm [RSA] for JSON Web Signatures

This configuration replaces the default security provider in the third position with SunJCE. The default security provider in the third position is SunEC, which implements the Ed25519 algorithm. With the SunEC provider removed from the configuration, the Key Pair Generator Configuration will fall back to RSA instead of the default Ed25519 algorithm.