Fix #19201: Fix connection password masking

ingestion/src/metadata/ingestion/source/pipeline/nifi/connection.py

@@ -17,8 +17,10 @@
 from metadata.generated.schema.entity.automations.workflow import (
     Workflow as AutomationWorkflow,
 )
+from metadata.generated.schema.entity.services.connections.pipeline.nifi.basicAuth import (
+    NifiBasicAuth,
+)
 from metadata.generated.schema.entity.services.connections.pipeline.nifiConnection import (
-    BasicAuthentication,
     NifiConnection,
 )
 from metadata.generated.schema.entity.services.connections.testConnectionResult import (
@@ -34,7 +36,7 @@ def get_connection(connection: NifiConnection) -> NifiClient:
     """
     Create connection
     """
-    if isinstance(connection.nifiConfig, BasicAuthentication):
+    if isinstance(connection.nifiConfig, NifiBasicAuth):
         return NifiClient(
             host_port=connection.hostPort,
             username=connection.nifiConfig.username,

openmetadata-service/src/main/java/org/openmetadata/service/secrets/converter/ClassConverterFactory.java

@@ -42,7 +42,10 @@
 import org.openmetadata.schema.services.connections.database.datalake.GCSConfig;
 import org.openmetadata.schema.services.connections.database.deltalake.StorageConfig;
 import org.openmetadata.schema.services.connections.database.iceberg.IcebergFileSystem;
+import org.openmetadata.schema.services.connections.mlmodel.VertexAIConnection;
 import org.openmetadata.schema.services.connections.pipeline.AirflowConnection;
+import org.openmetadata.schema.services.connections.pipeline.MatillionConnection;
+import org.openmetadata.schema.services.connections.pipeline.NifiConnection;
 import org.openmetadata.schema.services.connections.search.ElasticSearchConnection;
 import org.openmetadata.schema.services.connections.storage.GCSConnection;
 
@@ -87,7 +90,10 @@ private ClassConverterFactory() {
                 new TestServiceConnectionRequestClassConverter()),
             Map.entry(TrinoConnection.class, new TrinoConnectionClassConverter()),
             Map.entry(Workflow.class, new WorkflowClassConverter()),
-            Map.entry(CockroachConnection.class, new CockroachConnectionClassConverter()));
+            Map.entry(CockroachConnection.class, new CockroachConnectionClassConverter()),
+            Map.entry(NifiConnection.class, new NifiConnectionClassConverter()),
+            Map.entry(MatillionConnection.class, new MatillionConnectionClassConverter()),
+            Map.entry(VertexAIConnection.class, new VertexAIConnectionClassConverter()));
     Map.entry(Workflow.class, new WorkflowClassConverter());
     Map.entry(CassandraConnection.class, new CassandraConnectionClassConverter());
   }

openmetadata-service/src/main/java/org/openmetadata/service/secrets/converter/MatillionConnectionClassConverter.java

@@ -0,0 +1,38 @@
+/*
+ *  Copyright 2025 Collate
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ */
+
+package org.openmetadata.service.secrets.converter;
+
+import java.util.List;
+import org.openmetadata.schema.services.connections.pipeline.MatillionConnection;
+import org.openmetadata.schema.services.connections.pipeline.matillion.MatillionETLAuth;
+import org.openmetadata.service.util.JsonUtils;
+
+/** Converter class to get an `MatillionConnection` object. */
+public class MatillionConnectionClassConverter extends ClassConverter {
+
+  public MatillionConnectionClassConverter() {
+    super(MatillionConnection.class);
+  }
+
+  @Override
+  public Object convert(Object object) {
+    MatillionConnection matillionConnection =
+        (MatillionConnection) JsonUtils.convertValue(object, this.clazz);
+
+    tryToConvertOrFail(matillionConnection.getConnection(), List.of(MatillionETLAuth.class))
+        .ifPresent(matillionConnection::setConnection);
+
+    return matillionConnection;
+  }
+}

openmetadata-service/src/main/java/org/openmetadata/service/secrets/converter/NifiConnectionClassConverter.java

@@ -0,0 +1,39 @@
+/*
+ *  Copyright 2025 Collate
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ */
+
+package org.openmetadata.service.secrets.converter;
+
+import java.util.List;
+import org.openmetadata.schema.services.connections.pipeline.NifiConnection;
+import org.openmetadata.schema.services.connections.pipeline.nifi.BasicAuth;
+import org.openmetadata.schema.services.connections.pipeline.nifi.ClientCertificateAuth;
+import org.openmetadata.service.util.JsonUtils;
+
+/** Converter class to get an `NifiConnection` object. */
+public class NifiConnectionClassConverter extends ClassConverter {
+
+  public NifiConnectionClassConverter() {
+    super(NifiConnection.class);
+  }
+
+  @Override
+  public Object convert(Object object) {
+    NifiConnection nifiConnection = (NifiConnection) JsonUtils.convertValue(object, this.clazz);
+
+    tryToConvertOrFail(
+            nifiConnection.getNifiConfig(), List.of(BasicAuth.class, ClientCertificateAuth.class))
+        .ifPresent(nifiConnection::setNifiConfig);
+
+    return nifiConnection;
+  }
+}

openmetadata-service/src/main/java/org/openmetadata/service/secrets/converter/VertexAIConnectionClassConverter.java

@@ -0,0 +1,37 @@
+/*
+ *  Copyright 2025 Collate
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ */
+package org.openmetadata.service.secrets.converter;
+
+import java.util.List;
+import org.openmetadata.schema.security.credentials.GCPCredentials;
+import org.openmetadata.schema.services.connections.mlmodel.VertexAIConnection;
+import org.openmetadata.service.util.JsonUtils;
+
+/** Converter class to get an `VertexAIConnection` object. */
+public class VertexAIConnectionClassConverter extends ClassConverter {
+
+  public VertexAIConnectionClassConverter() {
+    super(VertexAIConnection.class);
+  }
+
+  @Override
+  public Object convert(Object object) {
+    VertexAIConnection vertexAIConnection =
+        (VertexAIConnection) JsonUtils.convertValue(object, this.clazz);
+
+    tryToConvertOrFail(vertexAIConnection.getCredentials(), List.of(GCPCredentials.class))
+        .ifPresent(obj -> vertexAIConnection.setCredentials((GCPCredentials) obj));
+
+    return vertexAIConnection;
+  }
+}

openmetadata-spec/src/main/resources/json/schema/entity/services/connections/pipeline/matillion/matillionETL.json

@@ -0,0 +1,43 @@
+{
+    "$id": "https://open-metadata.org/schema/entity/services/connections/pipeline/matillion/matillionETL.json",
+    "$schema": "http://json-schema.org/draft-07/schema#",
+    "title": "Matillion ETL Auth Config",
+    "description": "Matillion ETL Auth Config.",
+    "javaType": "org.openmetadata.schema.services.connections.pipeline.matillion.MatillionETLAuth",
+    "type": "object",
+    "properties": {
+        "type": {
+            "type": "string",
+            "enum": [
+                "MatillionETL"
+            ],
+            "default": "MatillionETL"
+        },
+        "hostPort": {
+            "type": "string",
+            "title": "Host",
+            "description": "Matillion Host",
+            "default": "localhost"
+        },
+        "username": {
+            "title": "Username",
+            "description": "Username to connect to the Matillion. This user should have privileges to read all the metadata in Matillion.",
+            "type": "string"
+        },
+        "password": {
+            "title": "Password",
+            "description": "Password to connect to the Matillion.",
+            "type": "string",
+            "format": "password"
+        },
+        "sslConfig": {
+            "$ref": "../../../../../security/ssl/verifySSLConfig.json#/definitions/sslConfig"
+        }
+    },
+    "required": [
+        "hostPort",
+        "username",
+        "password"
+    ],
+    "additionalProperties": false
+}

openmetadata-spec/src/main/resources/json/schema/entity/services/connections/pipeline/matillionConnection.json

@@ -13,45 +13,6 @@
         "Matillion"
       ],
       "default": "Matillion"
-    },
-    "matillionETL": {
-      "description": "Matillion ETL Auth Config",
-      "type": "object",
-      "title": "Matillion ETL Auth Config",
-      "properties": {
-        "type": {
-          "type": "string",
-          "enum": [
-            "MatillionETL"
-          ],
-          "default": "MatillionETL"
-        },
-        "hostPort": {
-          "type": "string",
-          "title": "Host",
-          "description": "Matillion Host",
-          "default": "localhost"
-        },
-        "username": {
-          "title": "Username",
-          "description": "Username to connect to the Matillion. This user should have privileges to read all the metadata in Matillion.",
-          "type": "string"
-        },
-        "password": {
-          "title": "Password",
-          "description": "Password to connect to the Matillion.",
-          "type": "string",
-          "format": "password"
-        },
-        "sslConfig": {
-          "$ref": "../../../../security/ssl/verifySSLConfig.json#/definitions/sslConfig"
-        }
-      },
-      "required": [
-        "hostPort",
-        "username",
-        "password"
-      ]
     }
   },
   "properties": {
@@ -66,7 +27,7 @@
       "description": "Matillion Auth Configuration",
       "oneOf": [
         {
-          "$ref": "#/definitions/matillionETL"
+          "$ref": "matillion/matillionETL.json"
         }
       ]
     },

openmetadata-spec/src/main/resources/json/schema/entity/services/connections/pipeline/nifi/basicAuth.json

@@ -0,0 +1,28 @@
+{
+    "$id": "https://open-metadata.org/schema/entity/services/connections/pipeline/nifi/basicAuth.json",
+    "$schema": "http://json-schema.org/draft-07/schema#",
+    "title": "Nifi Basic Auth",
+    "description": "Configuration for connecting to Nifi Basic Auth.",
+    "javaType": "org.openmetadata.schema.services.connections.pipeline.nifi.BasicAuth",
+    "type": "object",
+    "properties": {
+        "username": {
+            "title": "Username",
+            "description": "Nifi user to authenticate to the API.",
+            "type": "string"
+        },
+        "password": {
+            "title": "Password",
+            "description": "Nifi password to authenticate to the API.",
+            "type": "string",
+            "format": "password"
+        },
+        "verifySSL": {
+            "title": "Verify SSL",
+            "description": "Boolean marking if we need to verify the SSL certs for Nifi. False by default.",
+            "type": "boolean",
+            "default": false
+        }
+    },
+    "additionalProperties": false
+}

openmetadata-spec/src/main/resources/json/schema/entity/services/connections/pipeline/nifi/clientCertificateAuth.json

@@ -0,0 +1,26 @@
+{
+    "$id": "https://open-metadata.org/schema/entity/services/connections/pipeline/nifi/clientCertificateAuth.json",
+    "$schema": "http://json-schema.org/draft-07/schema#",
+    "title": "Nifi Client Certificate Auth",
+    "description": "Configuration for connecting to Nifi Client Certificate Auth.",
+    "javaType": "org.openmetadata.schema.services.connections.pipeline.nifi.ClientCertificateAuth",
+    "type": "object",
+    "properties": {
+        "certificateAuthorityPath": {
+            "title": "Certificat Authority Path",
+            "description": "Path to the root CA certificate",
+            "type": "string"
+        },
+        "clientCertificatePath": {
+            "title": "Client Certificat",
+            "description": "Path to the client certificate",
+            "type": "string"
+        },
+        "clientkeyPath": {
+            "title": "Client Key",
+            "description": "Path to the client key",
+            "type": "string"
+        }
+    },
+    "additionalProperties": false
+}

openmetadata-spec/src/main/resources/json/schema/entity/services/connections/pipeline/nifiConnection.json

@@ -15,6 +15,7 @@
     "basicAuthentication": {
       "title": "Username/Password Authentication",
       "description": "username/password auth",
+      "javaType": "org.openmetadata.schema.services.connections.pipeline.NifiBasicAuth",
       "type":"object",
       "properties": {
         "username": {
@@ -41,6 +42,7 @@
       "title": "Client Certificate Authentication",
       "description": "client certificate auth",
       "type":"object",
+      "javaType": "org.openmetadata.schema.services.connections.pipeline.NifiClientAuth",
       "properties": {
         "certificateAuthorityPath":{
           "title":"Certificat Authority Path",
@@ -80,10 +82,10 @@
       "description": "We support username/password or client certificate authentication",
       "oneOf": [
         {
-          "$ref": "#/definitions/basicAuthentication"
+          "$ref": "nifi/basicAuth.json"
         },
         {
-          "$ref": "#/definitions/clientCertificateAuthentication"
+          "$ref": "nifi/clientCertificateAuth.json"
         }
       ]
     },