As part of my experimentation with MiNiFi and Secure Clusters, it became evident to me that the current authorization model (based on internally managed UUIDs and Groups) will be particularly challenging to manage in the long run.
The main issue seems to be NiFi 1.x reliance on unique IDs for granular component access control, which, while excellent from an UI perspective, may become challenging when hundreds or thousands of MiNiFi agents are assigned with IDs in order to be able to access Remote Process Group and ports.
This feature proposal would introduce a new type of principal that would use the Issuer of a certificate as principal for authorizations purposes (instead of just using common name or subject alternative names).
The overall idea is to be able to allow N number of MiNiFi clients to securely communicate with a secure NiFi cluster without having to control access to flow components through coarse grained access control.
The following Diagram shows how this would work:
