# login as root into the sandbox
cd /opt
wget http://mirrors.ukfast.co.uk/sites/ftp.apache.org/nifi/1.4.0/nifi-1.4.0-bin.tar.gz

tar xvfz nifi-1.4.0-bin.tar.gz
useradd nifi -G hadoop
ln -s  nifi-1.4.0  nifi
chown -R nifi:nifi /opt/nifi-1.4.0
su - nifi
cd /opt/nifi

login to the sandbox as root, and run the following:
kinit
kadmin.local
kadmin.local:  addprinc -pw pa55word nifi
WARNING: no policy specified for [email protected]; defaulting to no policy
Principal "[email protected]" created.
kadmin.local:  xst -k /etc/security/keytabs/nifi.service.keytab nifi
Entry for principal nifi with kvno 2, encryption type aes256-cts-hmac-sha1-96 added to keytab WRFILE:/etc/security/keytabs/nifi.service.keytab.
Entry for principal nifi with kvno 2, encryption type aes128-cts-hmac-sha1-96 added to keytab WRFILE:/etc/security/keytabs/nifi.service.keytab.
Entry for principal nifi with kvno 2, encryption type des3-cbc-sha1 added to keytab WRFILE:/etc/security/keytabs/nifi.service.keytab.
Entry for principal nifi with kvno 2, encryption type arcfour-hmac added to keytab WRFILE:/etc/security/keytabs/nifi.service.keytab.

# Change the port from 8080 to 8090
sed -i 's/8080/8090/g' /opt/nifi/conf/nifi.properties  
KERBEROS_REALM=EU-WEST-1.COMPUTE.AMAZONAWS.COM

sed -i 's|nifi.kerberos.krb5.file.*|nifi.kerberos.krb5.file=/etc/krb5.conf|g' /opt/nifi/conf/nifi.properties  
sed -i "s|nifi.kerberos.service.principal.*|nifi.kerberos.service.principal=nifi@${KERBEROS_REALM}|g" /opt/nifi/conf/nifi.properties  
sed -i 's|nifi.kerberos.service.keytab.location.*|nifi.kerberos.service.keytab.location=/etc/security/keytabs/nifi.service.keytab|g' /opt/nifi/conf/nifi.properties

HOSTNAME=`hostname -f`
sed -i "s|nifi.kerberos.spnego.principal.*|nifi.kerberos.spnego.principal=HTTP/${HOSTNAME}@${KERBEROS_REALM}|g" /opt/nifi/conf/nifi.properties
sed -i "s|nifi.kerberos.spnego.keytab.location.*|nifi.kerberos.spnego.keytab.location=/etc/security/keytabs/spnego.service.keytab|g" /opt/nifi/conf/nifi.properties

# Create the following file (/opt/nifi/conf/jaas_policy_store.conf) :

tee /opt/nifi/conf/jaas_policy_store.conf <<'EOF'
Client {
   com.sun.security.auth.module.Krb5LoginModule required
   useKeyTab=true
   useTicketCache=true
   renewTicket=true
   keyTab="/etc/security/keytabs/hbase.service.keytab"
   serviceName="zookeeper"
   principal="hbase/[email protected]";
};
KafkaServer {
   com.sun.security.auth.module.Krb5LoginModule required
   useKeyTab=true
   useTicketCache=true
   renewTicket=true
   storeKey=true
   keyTab="/etc/security/keytabs/kafka.service.keytab"
   principal="kafka/[email protected]";
};
hdfs {
   com.sun.security.auth.module.Krb5LoginModule required
   useKeyTab=true
   storeKey=true
   renewTicket=true
   useTicketCache=true
   keyTab="/etc/security/keytabs/hdfs.headless.keytab"
   principal="[email protected]";

};
KafkaClient {
   com.sun.security.auth.module.Krb5LoginModule required
   useTicketCache=true
   useKeyTab=true
   renewTicket=true
   serviceName="kafka"
   keyTab="/etc/security/keytabs/hbase.service.keytab"
   principal="hbase/[email protected]";
};
EOF


# Add the following to the bootstrap.conf file:

printf "java.arg.15=-Djava.security.auth.login.config=/opt/nifi/conf/jaas_policy_store.conf\n" >> /opt/nifi/conf/bootstrap.conf

# Fix the classpath a bit to get phoenix/hbase working...

cd /opt/nifi/lib/bootstrap
ln -s /usr/hdp/2.5.0.0-1245/phoenix/phoenix-4.7.0.2.5.0.0-1245-client.jar


cd /opt/nifi/lib

ln -s /opt/pontus/nifi-pontus-hbase-processor-nar-1.0.nar
ln -s /opt/pontus/nifi-pontus-elastic-2.x-processor-nar-1.0.nar
ln -s /opt/pontus/nifi-pontus-service-api-nar-1.0.nar
ln -s /opt/pontus/nifi-pontus-service-nar-1.0.nar