Docker-based test environment for both custom NiFi processors: the
MultiIssuerJWTTokenAuthenticator (FlowFile-based JWT validation) and the
RestApiGateway (the primary flow group — an HTTP gateway with JWT auth).
Provides containerized NiFi (HTTPS) and Keycloak instances for testing with real JWT tokens.
Exposed NiFi ports: 9095/9443 (NiFi HTTPS UI/API and the gateway’s embedded
HTTPS listener) and 7777 (the HandleHttpRequest flow pipeline). Keycloak is on
9085 (HTTPS) and 9086 (management/health).
-
Docker with Compose plugin (
docker compose) -
curl (for health check scripts)
-
Maven (or use the included
./mvnwwrapper)
# 1. Build NAR and start containers (Keycloak + NiFi)
./integration-testing/src/main/docker/run-and-deploy.sh
# 2. Access services
# NiFi UI: https://localhost:9095/nifi/ (testUser / drowssap)
# Keycloak HTTPS: https://localhost:9085/admin/ (admin / admin)
# 3. Stop containers
./integration-testing/src/main/docker/stop-test-container.sh| Setting | Value |
|---|---|
URL |
|
API |
|
Protocol |
HTTPS (self-signed certificate, port 8443 internal → 9095 host) |
Authentication |
SingleUserLoginIdentityProvider |
Credentials |
|
Base image |
|
NAR mount |
repo-root |
Custom configuration files are copied from src/main/docker/nifi/conf/ into the container at build time.
| Setting | Value |
|---|---|
HTTPS Admin |
|
Health endpoint |
|
Admin credentials |
|
Image |
|
Database |
In-memory ( |
| Setting | Value |
|---|---|
Test users |
|
Test client ID |
|
Client type |
Public client (no secret required) |
JWKS endpoint (from host) |
|
JWKS endpoint (container-to-container) |
|
The realm is imported automatically from src/main/docker/keycloak/oauth_integration_tests-realm.json.
Separate realm with its own RSA key pair, used for invalid-signature testing.
| Setting | Value |
|---|---|
Test user |
|
Test client ID |
|
Client secret |
|
JWKS endpoint (from host) |
|
The realm is imported automatically from src/main/docker/keycloak/other_realm-realm.json.
All scripts are in src/main/docker/. They can be run from any directory.
| Script | Description |
|---|---|
|
Full startup: always rebuilds NARs ( |
|
Starts Keycloak first, then NiFi. Waits for both to be healthy (2-minute timeout). Does NOT build/deploy the NAR. |
|
Starts Keycloak only and waits for health check via |
|
Runs |
|
Rebuilds NAR, copies to deploy dir, restarts NiFi container ( |
|
Waits for NiFi to be ready, then starts all flow processors via the NiFi REST API and verifies the flow pipeline bound to port 7777. Invoked by |
|
Copies both |
| Script | Description |
|---|---|
|
Fast health check of Docker containers and HTTP endpoints. Supports |
|
Prints Docker system info, container status, logs, and resource usage |
|
Checks NAR file existence and deployment status in both host and container |
| Script | Description |
|---|---|
|
Generates self-signed certificates for NiFi (PKCS12) and Keycloak (PEM) |
|
Validates certificate files and their usage |
|
Tests NiFi authentication flow |
|
Sets NiFi SingleUser credentials via |
src/main/docker/
├── Dockerfile # NiFi container (based on apache/nifi:2.10.0)
├── docker-compose.yml # NiFi + Keycloak orchestration
├── certificates/ # Generated TLS certificates
│ ├── keystore.p12 # NiFi keystore
│ ├── truststore.p12 # NiFi truststore
│ ├── localhost.cer # Keycloak certificate (DER)
│ ├── localhost.crt # Keycloak certificate (PEM)
│ └── localhost.key # Keycloak private key
├── nifi/conf/ # NiFi configuration (copied into container)
│ ├── nifi.properties # Main config (HTTPS on 8443)
│ ├── login-identity-providers.xml # SingleUser: testUser/drowssap
│ ├── authorizers.xml # SingleUser authorizer
│ ├── keystore.p12 / truststore.p12 # TLS keystores
│ ├── flow.json / flow.json.gz # Pre-configured flow (JSON source + gzipped; the .gz is what NiFi loads)
│ ├── cui-nifi-extensions.properties # CUI extension static configuration
│ ├── test-jwks.json # JWKS test data for validation tests
│ └── bootstrap.conf / logback.xml / state-management.xml
├── keycloak/
│ ├── oauth_integration_tests-realm.json # Primary realm import
│ └── other_realm-realm.json # Secondary realm (signature testing)
├── maintenance/ # Certificate and credential utilities
├── scripts/ # Maven-invoked orchestration scripts
│ ├── deploy-and-start.sh # Pre-integration-test: copy NAR + start containers + wait
│ ├── wait-for-containers.sh # Health polling: containers → NiFi API → flow pipeline
│ └── stop-containers.sh # Post-integration-test: stop containers
├── run-and-deploy.sh # Full build + start (always rebuilds NARs)
├── start-nifi.sh # Start Keycloak + NiFi
├── start-keycloak.sh # Start Keycloak only
├── stop-test-container.sh # Stop all containers
├── redeploy-nifi.sh # Rebuild + restart NiFi (always rebuilds NARs)
├── copy-deployment.sh # Build + copy NAR (--skip-build to skip Maven)
├── check-status.sh # Health check
├── debug-containers.sh # Container diagnostics
└── debug-nar-deployment.sh # NAR deployment diagnostics# Build NAR and start everything
./integration-testing/src/main/docker/run-and-deploy.sh# After modifying processor code or UI:
./integration-testing/src/main/docker/redeploy-nifi.shThis rebuilds the NAR, copies it to the deploy directory, and restarts the NiFi container.
-
Open NiFi at https://localhost:9095/nifi/ and log in with
testUser/drowssap -
Drag a processor onto the canvas, search for
MultiIssuerJWTTokenAuthenticator -
Configure the JWKS URL:
https://keycloak:8443/realms/oauth_integration_tests/protocol/openid-connect/certs -
Obtain a test token from Keycloak:
curl -sk -X POST https://localhost:9085/realms/oauth_integration_tests/protocol/openid-connect/token \ -H 'Content-Type: application/x-www-form-urlencoded' \ -d 'grant_type=password&client_id=test_client&username=testUser&password=drowssap'
When running via Maven (./mvnw verify -Pintegration-tests -pl integration-testing -am), the lifecycle is:
-
Maven reactor builds all dependent modules (processors, UI WAR, NARs) via
-am -
deploy-and-start.sh(pre-integration-test phase) copies NARs to deploy dir (skipping redundant Maven build via--skip-build), starts Docker containers, and waits for readiness -
Failsafe runs all IT classes with parallel class execution (3 concurrent threads)
-
cleanup-containers(post-integration-test phase) collects logs and stops containers
Integration test classes run concurrently via junit-platform.properties:
-
Classes run in parallel (up to 3 concurrent threads)
-
Methods within a class run sequentially (preserves
@Nestedordering) -
All tests are read-only against shared containers, so parallel execution is safe
copy-deployment.sh accepts --skip-build to avoid redundant Maven builds:
-
Maven path (
deploy-and-start.sh): passes--skip-buildbecause the Maven reactor already built fresh NARs -
Standalone path (
run-and-deploy.sh,redeploy-nifi.sh): always rebuilds to pick up code changes
Self-signed certificates for localhost with 1-year validity:
-
NiFi: PKCS12 format (
keystore.p12,truststore.p12), password:password -
Keycloak: PEM format (
localhost.crt,localhost.key)
Certificates are checked into the repository. Regenerate if needed:
./integration-testing/src/main/docker/maintenance/generate-certificates.sh# Quick health check
./integration-testing/src/main/docker/check-status.sh
# Container status
docker compose -f integration-testing/src/main/docker/docker-compose.yml ps# NiFi logs
docker compose -f integration-testing/src/main/docker/docker-compose.yml logs nifi
# Follow NiFi application log
docker compose -f integration-testing/src/main/docker/docker-compose.yml exec nifi \
tail -f /opt/nifi/nifi-current/logs/nifi-app.log
# Keycloak logs
docker compose -f integration-testing/src/main/docker/docker-compose.yml logs keycloak| Issue | Resolution |
|---|---|
Port conflict on 9085, 9086, 9095, 9443, or 7777 |
Stop other services using those ports, or check with |
NiFi fails to start |
Check logs; ensure certificates exist in |
Keycloak health check fails |
Verify port 9086 is reachable: |
NAR not loaded |
Run |
Certificate errors in browser |
Expected with self-signed certs — accept the warning. Regenerate with |