<p>I've installed an apache nifi secured cluster with the <a href="https://github.com/cetic/helm-nifi" rel="nofollow noreferrer">helm-nifi</a> chart (with single user authorization).</p>
<p>When I do port-forworad to my pc and access the https://localhost:8443 I can login nifi without issues and I can see my cluster.</p>
<p>But - when I access nifi via my ingress url (nifi.dev-tools.mycompany.com) and trying to login I get an error:</p>
<p><a href="https://i.stack.imgur.com/OiXN2.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/OiXN2.png" alt="enter image description here" /></a></p>
<p>Inside the pod I can see this error in <code>nifi-user.log</code>:</p>
<pre><code>Caused by: org.springframework.security.oauth2.jwt.BadJwtException: An error occurred while attempting to decode the Jwt: Signed JWT rejected: Another algorithm expected, or no matching key(s) found
        at org.springframework.security.oauth2.jwt.NimbusJwtDecoder.createJwt(NimbusJwtDecoder.java:180)
        at org.springframework.security.oauth2.jwt.NimbusJwtDecoder.decode(NimbusJwtDecoder.java:137)
        at org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationProvider.getJwt(JwtAuthenticationProvider.java:97)
        ... 104 common frames omitted
Caused by: com.nimbusds.jose.proc.BadJOSEException: Signed JWT rejected: Another algorithm expected, or no matching key(s) found
        at com.nimbusds.jwt.proc.DefaultJWTProcessor.process(DefaultJWTProcessor.java:357)
        at com.nimbusds.jwt.proc.DefaultJWTProcessor.process(DefaultJWTProcessor.java:303)
        at org.springframework.security.oauth2.jwt.NimbusJwtDecoder.createJwt(NimbusJwtDecoder.java:154)
        ... 106 common frames omitted
</code></pre>
<p>My relevant <code>values</code> are:</p>
<pre><code>replicaCount: 3
externalSecure: true
isNode: true
externalSecure: true
auth:
  singleUser:
    username: username
    password: changemechangeme 
certManager:
  enabled: true
  clusterDomain: cluster.local
  keystorePasswd: changeme
  truststorePasswd: changeme
  replaceDefaultTrustStore: true
  additionalDnsNames:
    - localhost
    - nifi.dev-tools.mycompany.com
ingress:
  enabled: true
  # className: nginx
  annotations:
    nginx.ingress.kubernetes.io/upstream-vhost: &quot;localhost:8443&quot;
    nginx.ingress.kubernetes.io/proxy-redirect-from: &quot;https://localhost:8443&quot;
    nginx.ingress.kubernetes.io/proxy-redirect-to: &quot;https://nifi.dev-tools.mycompany.com&quot;
    kubernetes.io/tls-acme: &quot;true&quot;
    nginx.ingress.kubernetes.io/backend-protocol: &quot;HTTPS&quot;
  tls:
    - hosts:
        - nifi.dev-tools.mycompany.com
      secretName: nifi-ca
  hosts:
    - nifi.dev-tools.mycompany.com
  path: /
</code></pre>
<p>When I check the tls in my ingress url I can see is not the nifi-ca tls, but my default ingress tls:</p>
<p><a href="https://i.stack.imgur.com/bwpNZ.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/bwpNZ.png" alt="enter image description here" /></a></p>
<p>In the localhost is:</p>
<p><a href="https://i.stack.imgur.com/BjUV6.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/BjUV6.png" alt="enter image description here" /></a></p>
<p>So I guess it's related... how can I solve it?</p>

Shayki Abramczyk
<p>I couldn't make it work with single username, but it's working for me with <a href="https://www.keycloak.org/" rel="nofollow noreferrer">keycloak</a> as user management.</p>
<p>After I deployed keycloak in my cluster I configured the <code>values.yaml</code> to:</p>
<pre><code>oidc:
  enabled: true
  discoveryUrl: http://keycloack.mycompany.com/realms/nifi/.well-known/openid-configuration
  clientId: nifi
  clientSecret: mysecret
  claimIdentifyingUser: email
  admin: myuser@mycompany.com
  ## Request additional scopes, for example profile
  additionalScopes:
</code></pre>
<p>And to make it work need also to update the <code>ingress</code> settings (inside the <code>values.yaml</code>) and add the following annotations:</p>
<pre><code>nginx.ingress.kubernetes.io/affinity: &quot;cookie&quot;
nginx.ingress.kubernetes.io/session-cookie-name: &quot;hello-cookie&quot;
nginx.ingress.kubernetes.io/session-cookie-expires: &quot;1728000&quot;
nginx.ingress.kubernetes.io/session-cookie-max-age: &quot;1728000&quot;
nginx.ingress.kubernetes.io/ssl-redirect: &quot;false&quot;
nginx.ingress.kubernetes.io/affinity-mode: persistent
nginx.ingress.kubernetes.io/session-cookie-hash: sha1
</code></pre>
<p>Now I can login the secured cluster with the user that I configured in the keycloak.</p>
