NIFI-15211 Updated NiFi Registry JWT Key ID Resolution

[exceptionfactory]

Summary

NIFI-15211 Updates the NiFi Registry JSON Web Token Key Identifier resolution strategy, building on changes in #10521 and moving the kid claim location to work with the KeyLocator interface.

The SigningKeyResolverAdapter is deprecated, and previously provided the ability to retrieve the Key Identifier from a claim in the JWT payload. The KeyLocator limits access to the parsed JWT header, which did not contain the kid in the initial implementation. Changes now include setting the Key Identifier in the JWT header for subsequent resolution using the KeyLocator implementation.

Additional changes include adding nifi-registry-web-api to set the set paths changed that trigger execution of the integration-tests workflow. Integration tests for NiFi Registry exercise JWT generation and verification, validating these changes. The change also removes two unused methods from the JwtService class.

Tracking

Please complete the following tracking steps prior to pull request creation.

Issue Tracking

• Apache NiFi Jira issue created

Pull Request Tracking

• Pull Request title starts with Apache NiFi Jira issue number, such as NIFI-00000
• Pull Request commit message starts with Apache NiFi Jira issue number, as such NIFI-00000

Pull Request Formatting

• Pull Request based on current revision of the main branch
• Pull Request refers to a feature branch with one commit containing changes

Verification

Please indicate the verification steps performed prior to pull request creation.

Build

• Build completed using ./mvnw clean install -P contrib-check
  • JDK 21
  • JDK 25

Licensing

• New dependencies are compatible with the Apache License 2.0 according to the License Policy
• New dependencies are documented in applicable LICENSE and NOTICE files

Documentation

• Documentation formatting appears as expected in rendered files

[joewitt]

Ran into this with the integration tests so maybe I got further?

`[INFO] Running org.apache.nifi.runtime.manifest.RuntimeManifestIT
[ERROR] Tests run: 1, Failures: 1, Errors: 0, Skipped: 0, Time elapsed: 0.168 s <<< FAILURE! -- in org.apache.nifi.runtime.manifest.RuntimeManifestIT
[ERROR] org.apache.nifi.runtime.manifest.RuntimeManifestIT.testRuntimeManifest -- Time elapsed: 0.160 s <<< FAILURE!
org.opentest4j.AssertionFailedError: expected: but was:
at org.junit.jupiter.api.AssertionFailureBuilder.build(AssertionFailureBuilder.java:158)
at org.junit.jupiter.api.AssertionFailureBuilder.buildAndThrow(AssertionFailureBuilder.java:139)
at org.junit.jupiter.api.AssertEquals.failNotEqual(AssertEquals.java:201)
at org.junit.jupiter.api.AssertEquals.assertEquals(AssertEquals.java:184)
at org.junit.jupiter.api.AssertEquals.assertEquals(AssertEquals.java:179)
at org.junit.jupiter.api.Assertions.assertEquals(Assertions.java:1188)
at org.apache.nifi.runtime.manifest.RuntimeManifestIT.testRuntimeManifest(RuntimeManifestIT.java:105)

[INFO]
[INFO] Results:
[INFO]
[ERROR] Failures:
[ERROR] RuntimeManifestIT.testRuntimeManifest:105 expected: but was:
[INFO]`

[joewitt]

Broken in NIFI-15164

[exceptionfactory]

Thanks for evaluating these changes @joewitt, and for fixing the RuntimeManifestIT in #10527. I rebased and force-pushed the changes to this branch.

[joewitt]

Thanks. I had built with the commit and the full integration suite and it all worked. Merging now.