<extensionManifest><groupId>org.apache.nifi</groupId><artifactId>nifi-oauth2-provider-nar</artifactId><version>1.27.0</version><parentNar><groupId>org.apache.nifi</groupId><artifactId>nifi-standard-shared-nar</artifactId><version>1.27.0</version></parentNar><systemApiVersion>1.27.0</systemApiVersion><buildInfo><tag>nifi-1.27.0-RC2</tag><branch>UNKNOWN</branch><revision>e0c4461</revision></buildInfo><extensions><extension><name>org.apache.nifi.oauth2.OAuth2TokenProviderImpl</name><type>CONTROLLER_SERVICE</type><deprecationNotice><reason></reason><alternatives><alternative>org.apache.nifi.oauth2.StandardOauth2AccessTokenProvider</alternative></alternatives></deprecationNotice><description>This controller service provides a way of working with access and refresh tokens via the password and client_credential grant flows in the OAuth2 specification. It is meant to provide a way for components to get a token from an oauth2 provider and pass that token as a part of a header to another service.</description><tags><tag>oauth2</tag><tag>provider</tag><tag>authorization</tag></tags><properties><property><name>oauth2-ssl-context</name><displayName>SSL Context</displayName><description></description><controllerServiceDefinition><className>org.apache.nifi.ssl.SSLContextService</className><groupId>org.apache.nifi</groupId><artifactId>nifi-standard-services-api-nar</artifactId><version>1.27.0</version></controllerServiceDefinition><required>false</required><sensitive>false</sensitive><expressionLanguageSupported>false</expressionLanguageSupported><expressionLanguageScope>NONE</expressionLanguageScope><dynamicallyModifiesClasspath>false</dynamicallyModifiesClasspath><dynamic>false</dynamic></property><property><name>oauth2-access-token-url</name><displayName>Access Token Url</displayName><description>The full endpoint of the URL where access tokens are handled.</description><defaultValue></defaultValue><required>true</required><sensitive>false</sensitive><expressionLanguageSupported>true</expressionLanguageSupported><expressionLanguageScope>VARIABLE_REGISTRY</expressionLanguageScope><dynamicallyModifiesClasspath>false</dynamicallyModifiesClasspath><dynamic>false</dynamic></property></properties><providedServiceAPIs><providedServiceAPI><className>org.apache.nifi.oauth2.OAuth2TokenProvider</className><groupId>org.apache.nifi</groupId><artifactId>nifi-standard-services-api-nar</artifactId><version>1.27.0</version></providedServiceAPI></providedServiceAPIs></extension><extension><name>org.apache.nifi.oauth2.StandardOauth2AccessTokenProvider</name><type>CONTROLLER_SERVICE</type><description>Provides OAuth 2.0 access tokens that can be used as Bearer authorization header in HTTP requests. Can use either Resource Owner Password Credentials Grant or Client Credentials Grant. Client authentication can be done with either HTTP Basic authentication or in the request body.</description><tags><tag>oauth2</tag><tag>provider</tag><tag>authorization</tag><tag>access token</tag><tag>http</tag></tags><properties><property><name>authorization-server-url</name><displayName>Authorization Server URL</displayName><description>The URL of the authorization server that issues access tokens.</description><required>true</required><sensitive>false</sensitive><expressionLanguageSupported>true</expressionLanguageSupported><expressionLanguageScope>VARIABLE_REGISTRY</expressionLanguageScope><dynamicallyModifiesClasspath>false</dynamicallyModifiesClasspath><dynamic>false</dynamic></property><property><name>client-authentication-strategy</name><displayName>Client Authentication Strategy</displayName><description>Strategy for authenticating the client against the OAuth2 token provider service.</description><defaultValue>REQUEST_BODY</defaultValue><allowableValues><allowableValue><displayName>REQUEST_BODY</displayName><value>REQUEST_BODY</value><description>Send client authentication in request body. RFC 6749 Section 2.3.1 recommends Basic Authentication instead of request body.</description></allowableValue><allowableValue><displayName>BASIC_AUTHENTICATION</displayName><value>BASIC_AUTHENTICATION</value><description>Send client authentication using HTTP Basic authentication.</description></allowableValue></allowableValues><required>true</required><sensitive>false</sensitive><expressionLanguageSupported>false</expressionLanguageSupported><expressionLanguageScope>NONE</expressionLanguageScope><dynamicallyModifiesClasspath>false</dynamicallyModifiesClasspath><dynamic>false</dynamic></property><property><name>grant-type</name><displayName>Grant Type</displayName><description>The OAuth2 Grant Type to be used when acquiring an access token.</description><defaultValue>password</defaultValue><allowableValues><allowableValue><displayName>User Password</displayName><value>password</value><description>Resource Owner Password Credentials Grant. Used to access resources available to users. Requires username and password and usually Client ID and Client Secret.</description></allowableValue><allowableValue><displayName>Client Credentials</displayName><value>client_credentials</value><description>Client Credentials Grant. Used to access resources available to clients. Requires Client ID and Client Secret.</description></allowableValue><allowableValue><displayName>Refresh Token</displayName><value>refresh_token</value><description>Refresh Token Grant. Used to get fresh access tokens based on a previously acquired refresh token. Requires Client ID and Client Secret (apart from Refresh Token).</description></allowableValue></allowableValues><required>true</required><sensitive>false</sensitive><expressionLanguageSupported>false</expressionLanguageSupported><expressionLanguageScope>NONE</expressionLanguageScope><dynamicallyModifiesClasspath>false</dynamicallyModifiesClasspath><dynamic>false</dynamic></property><property><name>service-user-name</name><displayName>Username</displayName><description>Username on the service that is being accessed.</description><required>true</required><sensitive>false</sensitive><expressionLanguageSupported>true</expressionLanguageSupported><expressionLanguageScope>VARIABLE_REGISTRY</expressionLanguageScope><dynamicallyModifiesClasspath>false</dynamicallyModifiesClasspath><dynamic>false</dynamic><dependencies><dependency><propertyName>grant-type</propertyName><propertyDisplayName>Grant Type</propertyDisplayName><dependentValues><dependentValue>password</dependentValue></dependentValues></dependency></dependencies></property><property><name>service-password</name><displayName>Password</displayName><description>Password for the username on the service that is being accessed.</description><required>true</required><sensitive>true</sensitive><expressionLanguageSupported>false</expressionLanguageSupported><expressionLanguageScope>NONE</expressionLanguageScope><dynamicallyModifiesClasspath>false</dynamicallyModifiesClasspath><dynamic>false</dynamic><dependencies><dependency><propertyName>grant-type</propertyName><propertyDisplayName>Grant Type</propertyDisplayName><dependentValues><dependentValue>password</dependentValue></dependentValues></dependency></dependencies></property><property><name>refresh-token</name><displayName>Refresh Token</displayName><description>Refresh Token.</description><required>true</required><sensitive>true</sensitive><expressionLanguageSupported>true</expressionLanguageSupported><expressionLanguageScope>VARIABLE_REGISTRY</expressionLanguageScope><dynamicallyModifiesClasspath>false</dynamicallyModifiesClasspath><dynamic>false</dynamic><dependencies><dependency><propertyName>grant-type</propertyName><propertyDisplayName>Grant Type</propertyDisplayName><dependentValues><dependentValue>refresh_token</dependentValue></dependentValues></dependency></dependencies></property><property><name>client-id</name><displayName>Client ID</displayName><description></description><required>false</required><sensitive>false</sensitive><expressionLanguageSupported>true</expressionLanguageSupported><expressionLanguageScope>VARIABLE_REGISTRY</expressionLanguageScope><dynamicallyModifiesClasspath>false</dynamicallyModifiesClasspath><dynamic>false</dynamic></property><property><name>client-secret</name><displayName>Client secret</displayName><description></description><required>true</required><sensitive>true</sensitive><expressionLanguageSupported>false</expressionLanguageSupported><expressionLanguageScope>NONE</expressionLanguageScope><dynamicallyModifiesClasspath>false</dynamicallyModifiesClasspath><dynamic>false</dynamic><dependencies><dependency><propertyName>client-id</propertyName><propertyDisplayName>Client ID</propertyDisplayName></dependency></dependencies></property><property><name>scope</name><displayName>Scope</displayName><description>Space-delimited, case-sensitive list of scopes of the access request (as per the OAuth 2.0 specification)</description><required>false</required><sensitive>false</sensitive><expressionLanguageSupported>false</expressionLanguageSupported><expressionLanguageScope>NONE</expressionLanguageScope><dynamicallyModifiesClasspath>false</dynamicallyModifiesClasspath><dynamic>false</dynamic></property><property><name>resource</name><displayName>Resource</displayName><description>Resource URI for the access token request defined in RFC 8707 Section 2</description><required>false</required><sensitive>false</sensitive><expressionLanguageSupported>false</expressionLanguageSupported><expressionLanguageScope>NONE</expressionLanguageScope><dynamicallyModifiesClasspath>false</dynamicallyModifiesClasspath><dynamic>false</dynamic></property><property><name>audience</name><displayName>Audience</displayName><description>Audience for the access token request defined in RFC 8693 Section 2.1</description><required>false</required><sensitive>false</sensitive><expressionLanguageSupported>false</expressionLanguageSupported><expressionLanguageScope>NONE</expressionLanguageScope><dynamicallyModifiesClasspath>false</dynamicallyModifiesClasspath><dynamic>false</dynamic></property><property><name>refresh-window</name><displayName>Refresh Window</displayName><description>The service will attempt to refresh tokens expiring within the refresh window, subtracting the configured duration from the token expiration.</description><defaultValue>0 s</defaultValue><required>true</required><sensitive>false</sensitive><expressionLanguageSupported>false</expressionLanguageSupported><expressionLanguageScope>NONE</expressionLanguageScope><dynamicallyModifiesClasspath>false</dynamicallyModifiesClasspath><dynamic>false</dynamic></property><property><name>ssl-context-service</name><displayName>SSL Context Service</displayName><description></description><controllerServiceDefinition><className>org.apache.nifi.ssl.SSLContextService</className><groupId>org.apache.nifi</groupId><artifactId>nifi-standard-services-api-nar</artifactId><version>1.27.0</version></controllerServiceDefinition><required>false</required><sensitive>false</sensitive><expressionLanguageSupported>false</expressionLanguageSupported><expressionLanguageScope>NONE</expressionLanguageScope><dynamicallyModifiesClasspath>false</dynamicallyModifiesClasspath><dynamic>false</dynamic></property><property><name>HTTP Protocols</name><displayName>HTTP Protocols</displayName><description>HTTP Protocols supported for Application Layer Protocol Negotiation with TLS</description><defaultValue>H2_HTTP_1_1</defaultValue><allowableValues><allowableValue><displayName>http/1.1</displayName><value>HTTP_1_1</value><description>HTTP/1.1</description></allowableValue><allowableValue><displayName>h2 http/1.1</displayName><value>H2_HTTP_1_1</value><description>HTTP/2 and HTTP/1.1 negotiated based on requested protocols</description></allowableValue><allowableValue><displayName>h2</displayName><value>H2</value><description>HTTP/2</description></allowableValue></allowableValues><required>true</required><sensitive>false</sensitive><expressionLanguageSupported>false</expressionLanguageSupported><expressionLanguageScope>NONE</expressionLanguageScope><dynamicallyModifiesClasspath>false</dynamicallyModifiesClasspath><dynamic>false</dynamic><dependencies><dependency><propertyName>ssl-context-service</propertyName><propertyDisplayName>SSL Context Service</propertyDisplayName></dependency></dependencies></property><property><name>proxy-configuration-service</name><displayName>Proxy Configuration Service</displayName><description>Specifies the Proxy Configuration Controller Service to proxy network requests. Supported proxies: HTTP + AuthN</description><controllerServiceDefinition><className>org.apache.nifi.proxy.ProxyConfigurationService</className><groupId>org.apache.nifi</groupId><artifactId>nifi-standard-services-api-nar</artifactId><version>1.27.0</version></controllerServiceDefinition><required>false</required><sensitive>false</sensitive><expressionLanguageSupported>false</expressionLanguageSupported><expressionLanguageScope>NONE</expressionLanguageScope><dynamicallyModifiesClasspath>false</dynamicallyModifiesClasspath><dynamic>false</dynamic></property></properties><providedServiceAPIs><providedServiceAPI><className>org.apache.nifi.oauth2.OAuth2AccessTokenProvider</className><groupId>org.apache.nifi</groupId><artifactId>nifi-standard-services-api-nar</artifactId><version>1.27.0</version></providedServiceAPI></providedServiceAPIs></extension></extensions></extensionManifest>