#jinja2: lstrip_blocks:"True", trim_blocks:"True"
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<!--
# {{ ansible_managed }}
-->
{% if ads_enterprise_edition | bool %}
{% set authorizers_content = nifi_config['authorizers.xml'] %}
{% set ldap_user_group_provider = nifi_config.ldap_user_group_provider %}
{% set service_name = nifi_service_key %}
{% set cfg_ranger_service_name = services[service_name].config['ranger_nifi_security']['ranger.plugin.nifi.service.name'] %}
{% set nifi_properties = nifi_config['nifi_properties_content'] %}
<authorizers>

    <userGroupProvider>
        <identifier>file-user-group-provider</identifier>
        <class>org.apache.nifi.authorization.FileUserGroupProvider</class>
        <property name="Users File">{{ _nifi_config_dir }}/users.xml</property>
        <property name="Legacy Authorized Users File"></property>
        {% if ldap_user_group_provider is none -%}
        <property name="Initial User Identity A">{{ authorizers_content.nifi_initial_admin_identity | d('') }}</property>
        {% endif -%}
        {% if (authorizers_content.nifi_authorized_nodes_list != []) and (authorizers_content.nifi_authorized_nodes_list | length > 0) -%}
        {% for node in authorizers_content.nifi_authorized_nodes_list -%}
        <property name="Initial User Identity {{ loop.index }}">{{ node }}</property>
        {% endfor -%}
        {% endif %}

    </userGroupProvider>

{% if ldap_user_group_provider is not none %}
    <userGroupProvider>
        <identifier>ldap-user-group-provider</identifier>
        <class>org.apache.nifi.ldap.tenants.LdapUserGroupProvider</class>
        <property name="Authentication Strategy">{{ ldap_user_group_provider.authentication_strategy }}</property>

        <property name="Manager DN">{{ ldap_user_group_provider.manager_dn | d() }}</property>
        <property name="Manager Password">{{ ldap_user_group_provider.manager_password | d() }}</property>

        <property name="TLS - Keystore">{{ ldap_user_group_provider.tls_keystore_path | d() }}</property>
        <property name="TLS - Keystore Password">{{ ldap_user_group_provider.tls_keystore_password | d() }}</property>
        <property name="TLS - Keystore Type">{{ ldap_user_group_provider.tls_keystore_type | d() }}</property>
        <property name="TLS - Truststore">{{ ldap_user_group_provider.tls_truststore_path | d() }}</property>
        <property name="TLS - Truststore Password">{{ ldap_user_group_provider.tls_truststore_password | d() }}</property>
        <property name="TLS - Truststore Type">{{ ldap_user_group_provider.tls_truststore_type | d() }}</property>
        <property name="TLS - Client Auth">{{ ldap_user_group_provider.tls_client_auth | d() }}</property>
        <property name="TLS - Protocol">{{ ldap_user_group_provider.tls_protocol | d() }}</property>
        <property name="TLS - Shutdown Gracefully">{{ ldap_user_group_provider.tls_shutdown_gracefully | d() }}</property>

        <property name="Referral Strategy">{{ ldap_user_group_provider.referral_strategy | d() }}</property>
        <property name="Connect Timeout">{{ ldap_user_group_provider.connect_timeout | d() }}</property>
        <property name="Read Timeout">{{ ldap_user_group_provider.read_timeout | d() }}</property>

        <property name="Url">{{ ldap_user_group_provider.ldap_url | d() }}</property>
        <property name="Page Size">{{ ldap_user_group_provider.page_size | d() }}</property>
        <property name="Sync Interval">{{ ldap_user_group_provider.sync_interval | d() }}</property>

        <property name="User Search Base">{{ ldap_user_group_provider.user_search_base | d() }}</property>
        <property name="User Object Class">{{ ldap_user_group_provider.user_object_class | d() }}</property>
        <property name="User Search Scope">{{ ldap_user_group_provider.user_search_scope | d() }}</property>
        <property name="User Search Filter">{{ ldap_user_group_provider.user_search_filter | d() }}</property>
        <property name="User Identity Attribute">{{ ldap_user_group_provider.user_identity_attribute | d() }}</property>
        <property name="User Group Name Attribute">{{ ldap_user_group_provider.user_group_name_attribute | d() }}</property>
        <property name="User Group Name Attribute - Referenced Group Attribute">{{ ldap_user_group_provider.user_group_name_attribute_referenced | d() }}</property>

        <property name="Group Search Base">{{ ldap_user_group_provider.group_search_base | d() }}</property>
        <property name="Group Object Class">{{ ldap_user_group_provider.group_object_class | d() }}</property>
        <property name="Group Search Scope">{{ ldap_user_group_provider.group_search_scope | d() }}</property>
        <property name="Group Search Filter">{{ ldap_user_group_provider.group_search_filter | d() }}</property>
        <property name="Group Name Attribute">{{ ldap_user_group_provider.group_name_attribute | d() }}</property>
        <property name="Group Member Attribute">{{ ldap_user_group_provider.group_member_attribute | d() }}</property>
        <property name="Group Member Attribute - Referenced User Attribute">{{ ldap_user_group_provider.group_member_attribute_referenced | d() }}</property>
    </userGroupProvider>

    <userGroupProvider>
        <identifier>composite-user-group-provider</identifier>
        <class>org.apache.nifi.authorization.CompositeConfigurableUserGroupProvider</class>
        <property name="Configurable User Group Provider">file-user-group-provider</property>
        <property name="User Group Provider 1">ldap-user-group-provider</property>
    </userGroupProvider>

{% endif %}


    <accessPolicyProvider>
        <identifier>file-access-policy-provider</identifier>
        <class>org.apache.nifi.authorization.FileAccessPolicyProvider</class>
        {% if ldap_user_group_provider is none -%}
        <property name="User Group Provider">file-user-group-provider</property>
        {% else -%}
        <property name="User Group Provider">composite-user-group-provider</property>
        {% endif -%}
        <property name="Authorizations File">{{ _nifi_config_dir }}/authorizations.xml</property>
        <property name="Initial Admin Identity">{{ authorizers_content.nifi_initial_admin_identity | default('') }}</property>
        <property name="Legacy Authorized Users File"></property>

        {% if (authorizers_content.nifi_authorized_nodes_list != []) and (authorizers_content.nifi_authorized_nodes_list | length > 0) -%}
        {% for node in authorizers_content.nifi_authorized_nodes_list -%}
        <property name="Node Identity {{ loop.index }}">{{ node }}</property>
        {% endfor -%}
        {% endif -%}
        <property name="Node Group"></property>
    </accessPolicyProvider>

{% if nifi_config.ranger_plugin or (job.action == 'plugin_ranger_manage' and job.config.ranger_plugin != None) %}
    <authorizer>
        <identifier>ranger-provider</identifier>
 {% if ldap_user_group_provider is not none %}
        <class>org.apache.nifi.ranger.authorization.ManagedRangerAuthorizer</class>
        <property name="User Group Provider">ldap-user-group-provider</property>
 {% else %}
        <class>org.apache.nifi.ranger.authorization.RangerNiFiAuthorizer</class>
 {% endif %}
        <property name="Ranger Audit Config Path">{{ _nifi_config_dir }}/ranger-nifi-audit.xml</property>
        <property name="Ranger Security Config Path">{{ _nifi_config_dir }}/ranger-nifi-security.xml</property>
        <property name="Ranger Service Type">nifi</property>
        <property name="Ranger Application Id">{{ cfg_ranger_service_name }}</property>
        <property name="Ranger Admin Identity">{{ authorizers_content.ranger_admin_identity }}</property>
        <property name="Ranger Kerberos Enabled">{{ ads_kerberos_enabled | lower }}</property>
    </authorizer>
{% endif %}

    <authorizer>
        <identifier>managed-authorizer</identifier>
        <class>org.apache.nifi.authorization.StandardManagedAuthorizer</class>
        <property name="Access Policy Provider">file-access-policy-provider</property>
        {% if ldap_user_group_provider is not none or nifi_properties['nifi.security.user.oidc.discovery.url'] is not none -%}
        <property name="Allow Anonymous Access">false</property>
        {% else -%}
        <property name="Allow Anonymous Access">true</property>
        {% endif -%}
    </authorizer>

</authorizers>
{% endif %}