Has anyone been able to make progress on successfully authenticating via REST calls (/nifi-api) with an OIDC-secured NiFi instance? I've scoured the interwebs and see a lot of old posts asking about it, but no updated info.
I have NiFi configured such that we can successfully authenticate via the UI with a redirect to Azure Active Directory. However, we need to now start building a custom application that can edit flows on users’ behalf, and thus our application needs to communicate directly with NiFi APIs. I’ve played around with creating a new Service Principal in Azure and getting a bearer token for that service principal, which is in the same tenant that my OIDC setup is configured to, but I cannot for the life of me figure out how to trade that valid (from AAD’s perspective) Bearer token for a JWT from NiFi. Is there any programmatic way of interacting with the /access/oidc/exchange endpoint?
I can reach into the browser and copy the JWT from an authenticated browser session with the NiFi UI and execute REST calls with /nifi-api that way and it works, but that's obviously not a valid flow here. We need something that doesn't rely on browser redirects.