diff --git a/nifi-registry-core/nifi-registry-data-model/src/main/java/org/apache/nifi/registry/authorization/CurrentUser.java b/nifi-registry-core/nifi-registry-data-model/src/main/java/org/apache/nifi/registry/authorization/CurrentUser.java
index 1bd4d4e..af135ec 100644
--- a/nifi-registry-core/nifi-registry-data-model/src/main/java/org/apache/nifi/registry/authorization/CurrentUser.java
+++ b/nifi-registry-core/nifi-registry-data-model/src/main/java/org/apache/nifi/registry/authorization/CurrentUser.java
@@ -24,6 +24,7 @@
 
     private String identity;
     private boolean anonymous;
+    private boolean loginSupported;
     private ResourcePermissions resourcePermissions;
 
     @ApiModelProperty(value = "The identity of the current user", readOnly = true)
@@ -44,6 +45,15 @@
         this.anonymous = anonymous;
     }
 
+    @ApiModelProperty(value = "Indicates if the NiFi instance supports logging in")
+    public boolean isLoginSupported() {
+        return loginSupported;
+    }
+
+    public void setLoginSupported(boolean loginSupported) {
+        this.loginSupported = loginSupported;
+    }
+
     @ApiModelProperty(value = "The access that the current user has to top level resources", readOnly = true)
     public ResourcePermissions getResourcePermissions() {
         return resourcePermissions;
diff --git a/nifi-registry-core/nifi-registry-data-model/src/main/java/org/apache/nifi/registry/bucket/Bucket.java b/nifi-registry-core/nifi-registry-data-model/src/main/java/org/apache/nifi/registry/bucket/Bucket.java
index 6837a6d..9cd82e0 100644
--- a/nifi-registry-core/nifi-registry-data-model/src/main/java/org/apache/nifi/registry/bucket/Bucket.java
+++ b/nifi-registry-core/nifi-registry-data-model/src/main/java/org/apache/nifi/registry/bucket/Bucket.java
@@ -43,6 +43,8 @@
 
     private Boolean allowBundleRedeploy;
 
+    private Boolean allowPublicRead;
+
     private Permissions permissions;
 
     @ApiModelProperty(value = "An ID to uniquely identify this object.", readOnly = true)
@@ -90,6 +92,15 @@
         this.allowBundleRedeploy = allowBundleRedeploy;
     }
 
+    @ApiModelProperty("Indicates if this bucket allows read access to unauthenticated anonymous users")
+    public Boolean isAllowPublicRead() {
+        return allowPublicRead;
+    }
+
+    public void setAllowPublicRead(final Boolean allowPublicRead) {
+        this.allowPublicRead = allowPublicRead;
+    }
+
     @ApiModelProperty(value = "The access that the current user has to this bucket.", readOnly = true)
     public Permissions getPermissions() {
         return permissions;
diff --git a/nifi-registry-core/nifi-registry-framework/src/main/java/org/apache/nifi/registry/db/DatabaseMetadataService.java b/nifi-registry-core/nifi-registry-framework/src/main/java/org/apache/nifi/registry/db/DatabaseMetadataService.java
index 3f75439..63a4bd1 100644
--- a/nifi-registry-core/nifi-registry-framework/src/main/java/org/apache/nifi/registry/db/DatabaseMetadataService.java
+++ b/nifi-registry-core/nifi-registry-framework/src/main/java/org/apache/nifi/registry/db/DatabaseMetadataService.java
@@ -76,13 +76,14 @@
 
     @Override
     public BucketEntity createBucket(final BucketEntity b) {
-        final String sql = "INSERT INTO BUCKET (ID, NAME, DESCRIPTION, CREATED, ALLOW_EXTENSION_BUNDLE_REDEPLOY) VALUES (?, ?, ?, ?, ?)";
+        final String sql = "INSERT INTO BUCKET (ID, NAME, DESCRIPTION, CREATED, ALLOW_EXTENSION_BUNDLE_REDEPLOY, ALLOW_PUBLIC_READ) VALUES (?, ?, ?, ?, ?, ?)";
         jdbcTemplate.update(sql,
                 b.getId(),
                 b.getName(),
                 b.getDescription(),
                 b.getCreated(),
-                b.isAllowExtensionBundleRedeploy() ? 1 : 0);
+                b.isAllowExtensionBundleRedeploy() ? 1 : 0,
+                b.isAllowPublicRead() ? 1 : 0);
         return b;
     }
 
@@ -104,8 +105,20 @@
 
     @Override
     public BucketEntity updateBucket(final BucketEntity bucket) {
-        final String sql = "UPDATE BUCKET SET name = ?, description = ?, allow_extension_bundle_redeploy = ? WHERE id = ?";
-        jdbcTemplate.update(sql, bucket.getName(), bucket.getDescription(), bucket.isAllowExtensionBundleRedeploy() ? 1 : 0, bucket.getId());
+        final String sql = "UPDATE BUCKET SET " +
+                    "name = ?, " +
+                    "description = ?, " +
+                    "allow_extension_bundle_redeploy = ?, " +
+                    "allow_public_read = ? " +
+                "WHERE id = ?";
+
+        jdbcTemplate.update(sql,
+                bucket.getName(),
+                bucket.getDescription(),
+                bucket.isAllowExtensionBundleRedeploy() ? 1 : 0,
+                bucket.isAllowPublicRead() ? 1 : 0,
+                bucket.getId());
+
         return bucket;
     }
 
diff --git a/nifi-registry-core/nifi-registry-framework/src/main/java/org/apache/nifi/registry/db/entity/BucketEntity.java b/nifi-registry-core/nifi-registry-framework/src/main/java/org/apache/nifi/registry/db/entity/BucketEntity.java
index fe980d0..b6bf12b 100644
--- a/nifi-registry-core/nifi-registry-framework/src/main/java/org/apache/nifi/registry/db/entity/BucketEntity.java
+++ b/nifi-registry-core/nifi-registry-framework/src/main/java/org/apache/nifi/registry/db/entity/BucketEntity.java
@@ -31,6 +31,8 @@
 
     private boolean allowExtensionBundleRedeploy;
 
+    private boolean allowPublicRead;
+
 
     public String getId() {
         return id;
@@ -72,6 +74,14 @@
         this.allowExtensionBundleRedeploy = allowExtensionBundleRedeploy;
     }
 
+    public boolean isAllowPublicRead() {
+        return allowPublicRead;
+    }
+
+    public void setAllowPublicRead(boolean allowPublicRead) {
+        this.allowPublicRead = allowPublicRead;
+    }
+
     @Override
     public int hashCode() {
         return Objects.hashCode(this.id);
diff --git a/nifi-registry-core/nifi-registry-framework/src/main/java/org/apache/nifi/registry/db/mapper/BucketEntityRowMapper.java b/nifi-registry-core/nifi-registry-framework/src/main/java/org/apache/nifi/registry/db/mapper/BucketEntityRowMapper.java
index 5ef5c60..5bda0a8 100644
--- a/nifi-registry-core/nifi-registry-framework/src/main/java/org/apache/nifi/registry/db/mapper/BucketEntityRowMapper.java
+++ b/nifi-registry-core/nifi-registry-framework/src/main/java/org/apache/nifi/registry/db/mapper/BucketEntityRowMapper.java
@@ -34,6 +34,7 @@
         b.setDescription(rs.getString("DESCRIPTION"));
         b.setCreated(rs.getTimestamp("CREATED"));
         b.setAllowExtensionBundleRedeploy(rs.getInt("ALLOW_EXTENSION_BUNDLE_REDEPLOY") == 0 ? false : true);
+        b.setAllowPublicRead(rs.getInt("ALLOW_PUBLIC_READ") == 0 ? false : true);
         return b;
     }
 
diff --git a/nifi-registry-core/nifi-registry-framework/src/main/java/org/apache/nifi/registry/security/authorization/AuthorizerFactory.java b/nifi-registry-core/nifi-registry-framework/src/main/java/org/apache/nifi/registry/security/authorization/AuthorizerFactory.java
index 43862fe..916892b 100644
--- a/nifi-registry-core/nifi-registry-framework/src/main/java/org/apache/nifi/registry/security/authorization/AuthorizerFactory.java
+++ b/nifi-registry-core/nifi-registry-framework/src/main/java/org/apache/nifi/registry/security/authorization/AuthorizerFactory.java
@@ -31,6 +31,7 @@
 import org.apache.nifi.registry.security.exception.SecurityProviderCreationException;
 import org.apache.nifi.registry.security.exception.SecurityProviderDestructionException;
 import org.apache.nifi.registry.security.util.XmlUtils;
+import org.apache.nifi.registry.service.RegistryService;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.springframework.beans.factory.DisposableBean;
@@ -88,6 +89,7 @@
     private final NiFiRegistryProperties properties;
     private final ExtensionManager extensionManager;
     private final SensitivePropertyProvider sensitivePropertyProvider;
+    private final RegistryService registryService;
 
     private Authorizer authorizer;
     private final Map<String, UserGroupProvider> userGroupProviders = new HashMap<>();
@@ -98,11 +100,13 @@
     public AuthorizerFactory(
             final NiFiRegistryProperties properties,
             final ExtensionManager extensionManager,
-            @Nullable final SensitivePropertyProvider sensitivePropertyProvider) {
+            @Nullable final SensitivePropertyProvider sensitivePropertyProvider,
+            final RegistryService registryService) {
 
         this.properties = properties;
         this.extensionManager = extensionManager;
         this.sensitivePropertyProvider = sensitivePropertyProvider;
+        this.registryService = registryService;
 
         if (this.properties == null) {
             throw new IllegalStateException("NiFiRegistryProperties cannot be null");
@@ -111,6 +115,10 @@
         if (this.extensionManager == null) {
             throw new IllegalStateException("ExtensionManager cannot be null");
         }
+
+        if (this.registryService == null) {
+            throw new IllegalStateException("RegistryService cannot be null");
+        }
     }
 
     /***** UserGroupProviderLookup *****/
@@ -354,10 +362,22 @@
         // call post construction lifecycle event
         instance.initialize(new StandardAuthorizerInitializationContext(identifier, this, this, this));
 
-        return installIntegrityChecks(instance);
+        // wrap the instance Authorizer with checks to ensure integrity of data
+        final Authorizer integrityCheckAuthorizer = installIntegrityChecks(instance);
+
+        // wrap the integrity checked Authorizer with the FrameworkAuthorizer
+        return createFrameworkAuthorizer(integrityCheckAuthorizer);
     }
 
-        private void performMethodInjection(final Object instance, final Class authorizerClass) throws IllegalAccessException, IllegalArgumentException, InvocationTargetException {
+    private Authorizer createFrameworkAuthorizer(final Authorizer baseAuthorizer) {
+        if (baseAuthorizer instanceof ManagedAuthorizer) {
+            return new FrameworkManagedAuthorizer((ManagedAuthorizer) baseAuthorizer, registryService);
+        } else {
+            return new FrameworkAuthorizer(baseAuthorizer, registryService);
+        }
+    }
+
+    private void performMethodInjection(final Object instance, final Class authorizerClass) throws IllegalAccessException, IllegalArgumentException, InvocationTargetException {
         for (final Method method : authorizerClass.getMethods()) {
             if (method.isAnnotationPresent(AuthorizerContext.class)) {
                 // make the method accessible
diff --git a/nifi-registry-core/nifi-registry-framework/src/main/java/org/apache/nifi/registry/security/authorization/FrameworkAuthorizer.java b/nifi-registry-core/nifi-registry-framework/src/main/java/org/apache/nifi/registry/security/authorization/FrameworkAuthorizer.java
new file mode 100644
index 0000000..08fb8f0
--- /dev/null
+++ b/nifi-registry-core/nifi-registry-framework/src/main/java/org/apache/nifi/registry/security/authorization/FrameworkAuthorizer.java
@@ -0,0 +1,189 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.nifi.registry.security.authorization;
+
+import org.apache.nifi.registry.bucket.Bucket;
+import org.apache.nifi.registry.exception.ResourceNotFoundException;
+import org.apache.nifi.registry.security.authorization.exception.AccessDeniedException;
+import org.apache.nifi.registry.security.authorization.exception.AuthorizationAccessException;
+import org.apache.nifi.registry.security.authorization.resource.Authorizable;
+import org.apache.nifi.registry.security.authorization.resource.ResourceFactory;
+import org.apache.nifi.registry.security.authorization.resource.ResourceType;
+import org.apache.nifi.registry.security.authorization.user.NiFiUser;
+import org.apache.nifi.registry.security.authorization.user.StandardNiFiUser;
+import org.apache.nifi.registry.security.exception.SecurityProviderCreationException;
+import org.apache.nifi.registry.security.exception.SecurityProviderDestructionException;
+import org.apache.nifi.registry.service.RegistryService;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.util.List;
+import java.util.Objects;
+
+/**
+ * Wraps an Authorizer and adds framework level logic for authorizing proxies, public resources, and anything else
+ * that needs to be done on top of the regular Authorizer.
+ */
+public class FrameworkAuthorizer implements Authorizer {
+
+    public static Logger LOGGER = LoggerFactory.getLogger(FrameworkAuthorizer.class);
+
+    private static final Authorizable PROXY_AUTHORIZABLE = new Authorizable() {
+        @Override
+        public Authorizable getParentAuthorizable() {
+            return null;
+        }
+
+        @Override
+        public Resource getResource() {
+            return ResourceFactory.getProxyResource();
+        }
+    };
+
+    private final Authorizer wrappedAuthorizer;
+    private final RegistryService registryService;
+
+    public FrameworkAuthorizer(final Authorizer wrappedAuthorizer, final RegistryService registryService) {
+        this.wrappedAuthorizer = Objects.requireNonNull(wrappedAuthorizer);
+        this.registryService = Objects.requireNonNull(registryService);
+    }
+
+    @Override
+    public void initialize(final AuthorizerInitializationContext initializationContext) throws SecurityProviderCreationException {
+        wrappedAuthorizer.initialize(initializationContext);
+    }
+
+    @Override
+    public void onConfigured(final AuthorizerConfigurationContext configurationContext) throws SecurityProviderCreationException {
+        wrappedAuthorizer.onConfigured(configurationContext);
+    }
+
+    @Override
+    public AuthorizationResult authorize(final AuthorizationRequest request) throws AuthorizationAccessException {
+        final Resource resource = request.getResource();
+        final RequestAction requestAction = request.getAction();
+
+        /**
+         * If the request is for a resource that has been made public and action is READ, then it should automatically be authorized.
+         *
+         * This needs to be checked before the proxy authorizations b/c access to a public resource should always be allowed.
+         */
+
+        final boolean allowPublicAccess = isPublicAccessAllowed(resource, requestAction);
+        if (allowPublicAccess) {
+            if (LOGGER.isDebugEnabled()) {
+                LOGGER.debug("Authorizing access to public resource '{}'", new Object[]{resource.getIdentifier()});
+            }
+            return AuthorizationResult.approved();
+        }
+
+        /**
+         * Deny an anonymous user access to anything else, they should only have access to publicly readable resources checked above
+         */
+
+        if (request.isAnonymous()) {
+            return AuthorizationResult.denied("Anonymous access is not authorized");
+        }
+
+        /*
+        * If the request has a proxy chain, ensure each identity in the chain is an authorized proxy for the given action.
+        *
+        * The action comes from the original request. For example, if user1 is proxied by proxy1, and it is a WRITE request
+        * to /buckets/12345, then we need to determine if proxy1 is authorized to proxy WRITE requests.
+        */
+
+        final List<String> proxyChainIdentities = request.getProxyIdentities();
+        if (LOGGER.isDebugEnabled()) {
+            LOGGER.debug("Found {} proxy identities", new Object[]{proxyChainIdentities.size()});
+        }
+
+        for (final String proxyIdentity : proxyChainIdentities) {
+            final NiFiUser proxyNiFiUser = createProxyNiFiUser(proxyIdentity);
+            if (LOGGER.isDebugEnabled()) {
+                LOGGER.debug("Authorizing proxy [{}] for {}", new Object[]{proxyIdentity, requestAction});
+            }
+
+            try {
+                PROXY_AUTHORIZABLE.authorize(wrappedAuthorizer, requestAction, proxyNiFiUser);
+            } catch (final AccessDeniedException e) {
+                final String actionString = requestAction.toString();
+                return AuthorizationResult.denied(String.format("Untrusted proxy [%s] for %s operation.", proxyIdentity, actionString));
+            }
+        }
+
+        /**
+         * All other authorization decisions need to be delegated to the original wrapped Authorizer.
+         */
+
+        return wrappedAuthorizer.authorize(request);
+    }
+
+    /**
+     * Determines if the given Resource is considered public for the action being performed.
+     *
+     * @param resource a Resource being authorized
+     * @param action the action being performed
+     * @return true if the resource is public for the given action, false otherwise
+     */
+    private boolean isPublicAccessAllowed(final Resource resource, final RequestAction action) {
+        if (resource == null || action == null) {
+            return false;
+        }
+
+        final String resourceIdentifier = resource.getIdentifier();
+        if (resourceIdentifier == null || !resourceIdentifier.startsWith(ResourceType.Bucket.getValue() + "/")) {
+            return false;
+        }
+
+        final int lastSlashIndex = resourceIdentifier.lastIndexOf("/");
+        if (lastSlashIndex < 0 || lastSlashIndex >= resourceIdentifier.length() - 1) {
+            return false;
+        }
+
+        final String bucketId = resourceIdentifier.substring(lastSlashIndex + 1);
+        try {
+            final Bucket bucket = registryService.getBucket(bucketId);
+            return bucket.isAllowPublicRead() && action == RequestAction.READ;
+        } catch (ResourceNotFoundException rnfe) {
+            // if not found then we can't determine public access, so return false to delegate to regular authorizer
+            LOGGER.debug("Cannot determine public access, bucket not found with id [{}]", new Object[]{bucketId});
+            return false;
+        } catch (Exception e) {
+            LOGGER.error("Error checking public access to bucket with id [{}]", new Object[]{bucketId}, e);
+            return false;
+        }
+    }
+
+    /**
+     * Creates a NiFiUser for the given proxy identity.
+     *
+     * This is only intended to be used for authorizing the given proxy identity against the /proxy resource, so we
+     * don't need to populate the rest of the info on this user.
+     *
+     * @param proxyIdentity the proxy identity
+     * @return the NiFiUser
+     */
+    private NiFiUser createProxyNiFiUser(final String proxyIdentity) {
+        return new StandardNiFiUser.Builder().identity(proxyIdentity).build();
+    }
+
+    @Override
+    public void preDestruction() throws SecurityProviderDestructionException {
+        wrappedAuthorizer.preDestruction();
+    }
+
+}
diff --git a/nifi-registry-core/nifi-registry-framework/src/main/java/org/apache/nifi/registry/security/authorization/FrameworkManagedAuthorizer.java b/nifi-registry-core/nifi-registry-framework/src/main/java/org/apache/nifi/registry/security/authorization/FrameworkManagedAuthorizer.java
new file mode 100644
index 0000000..478482e
--- /dev/null
+++ b/nifi-registry-core/nifi-registry-framework/src/main/java/org/apache/nifi/registry/security/authorization/FrameworkManagedAuthorizer.java
@@ -0,0 +1,54 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.nifi.registry.security.authorization;
+
+import org.apache.nifi.registry.security.authorization.exception.AuthorizationAccessException;
+import org.apache.nifi.registry.security.authorization.exception.UninheritableAuthorizationsException;
+import org.apache.nifi.registry.service.RegistryService;
+
+/**
+ * Similar to FrameworkAuthorizer, but specifically for wrapping a ManagedAuthorizer.
+ */
+public class FrameworkManagedAuthorizer extends FrameworkAuthorizer implements ManagedAuthorizer {
+
+    private final ManagedAuthorizer wrappedManagedAuthorizer;
+
+    public FrameworkManagedAuthorizer(final ManagedAuthorizer wrappedManagedAuthorizer, final RegistryService registryService) {
+        super(wrappedManagedAuthorizer, registryService);
+        this.wrappedManagedAuthorizer = wrappedManagedAuthorizer;
+    }
+
+    @Override
+    public String getFingerprint() throws AuthorizationAccessException {
+        return wrappedManagedAuthorizer.getFingerprint();
+    }
+
+    @Override
+    public void inheritFingerprint(final String fingerprint) throws AuthorizationAccessException {
+        wrappedManagedAuthorizer.inheritFingerprint(fingerprint);
+    }
+
+    @Override
+    public void checkInheritability(final String proposedFingerprint) throws AuthorizationAccessException, UninheritableAuthorizationsException {
+        wrappedManagedAuthorizer.checkInheritability(proposedFingerprint);
+    }
+
+    @Override
+    public AccessPolicyProvider getAccessPolicyProvider() {
+        return wrappedManagedAuthorizer.getAccessPolicyProvider();
+    }
+}
diff --git a/nifi-registry-core/nifi-registry-framework/src/main/java/org/apache/nifi/registry/security/authorization/resource/Authorizable.java b/nifi-registry-core/nifi-registry-framework/src/main/java/org/apache/nifi/registry/security/authorization/resource/Authorizable.java
index d08467e..04cb469 100644
--- a/nifi-registry-core/nifi-registry-framework/src/main/java/org/apache/nifi/registry/security/authorization/resource/Authorizable.java
+++ b/nifi-registry-core/nifi-registry-framework/src/main/java/org/apache/nifi/registry/security/authorization/resource/Authorizable.java
@@ -16,18 +16,20 @@
  */
 package org.apache.nifi.registry.security.authorization.resource;
 
-import org.apache.nifi.registry.security.authorization.AuthorizationResult.Result;
-import org.apache.nifi.registry.security.authorization.exception.AccessDeniedException;
-import org.apache.nifi.registry.security.authorization.user.NiFiUser;
 import org.apache.nifi.registry.security.authorization.AuthorizationAuditor;
 import org.apache.nifi.registry.security.authorization.AuthorizationRequest;
 import org.apache.nifi.registry.security.authorization.AuthorizationResult;
+import org.apache.nifi.registry.security.authorization.AuthorizationResult.Result;
 import org.apache.nifi.registry.security.authorization.Authorizer;
 import org.apache.nifi.registry.security.authorization.RequestAction;
 import org.apache.nifi.registry.security.authorization.Resource;
 import org.apache.nifi.registry.security.authorization.UserContextKeys;
+import org.apache.nifi.registry.security.authorization.exception.AccessDeniedException;
+import org.apache.nifi.registry.security.authorization.user.NiFiUser;
 
+import java.util.ArrayList;
 import java.util.HashMap;
+import java.util.List;
 import java.util.Map;
 
 public interface Authorizable {
@@ -93,6 +95,10 @@
             userContext = null;
         }
 
+        // Note: We don't include the proxy identities here since this is not a direct attempt to access the resource and
+        // we just want to determine if the end user is authorized. The proxy identities will be authorized when calling
+        // Authorizable.authorize() during a direct access attempt for a resource.
+
         final Resource resource = getResource();
         final Resource requestedResource = getRequestedResource();
         final AuthorizationRequest request = new AuthorizationRequest.Builder()
@@ -205,10 +211,18 @@
             userContext = null;
         }
 
+        final List<String> proxyChain = new ArrayList<>();
+        NiFiUser proxyUser = user.getChain();
+        while (proxyUser  != null) {
+            proxyChain.add(proxyUser.getIdentity());
+            proxyUser = proxyUser.getChain();
+        }
+
         final Resource resource = getResource();
         final Resource requestedResource = getRequestedResource();
         final AuthorizationRequest request = new AuthorizationRequest.Builder()
                 .identity(user.getIdentity())
+                .proxyIdentities(proxyChain)
                 .groups(user.getGroups())
                 .anonymous(user.isAnonymous())
                 .accessAttempt(true)
diff --git a/nifi-registry-core/nifi-registry-framework/src/main/java/org/apache/nifi/registry/service/RegistryService.java b/nifi-registry-core/nifi-registry-framework/src/main/java/org/apache/nifi/registry/service/RegistryService.java
index 26057ae..8df44e8 100644
--- a/nifi-registry-core/nifi-registry-framework/src/main/java/org/apache/nifi/registry/service/RegistryService.java
+++ b/nifi-registry-core/nifi-registry-framework/src/main/java/org/apache/nifi/registry/service/RegistryService.java
@@ -160,6 +160,10 @@
             bucket.setAllowBundleRedeploy(false);
         }
 
+        if (bucket.isAllowPublicRead() == null) {
+            bucket.setAllowPublicRead(false);
+        }
+
         validate(bucket, "Cannot create Bucket");
 
         writeLock.lock();
@@ -282,6 +286,10 @@
                 existingBucketById.setAllowExtensionBundleRedeploy(bucket.isAllowBundleRedeploy());
             }
 
+            if (bucket.isAllowPublicRead() != null) {
+                existingBucketById.setAllowPublicRead(bucket.isAllowPublicRead());
+            }
+
             // perform the actual update
             final BucketEntity updatedBucket = metadataService.updateBucket(existingBucketById);
             return BucketMappings.map(updatedBucket);
diff --git a/nifi-registry-core/nifi-registry-framework/src/main/java/org/apache/nifi/registry/service/mapper/BucketMappings.java b/nifi-registry-core/nifi-registry-framework/src/main/java/org/apache/nifi/registry/service/mapper/BucketMappings.java
index 22020a6..542cc1b 100644
--- a/nifi-registry-core/nifi-registry-framework/src/main/java/org/apache/nifi/registry/service/mapper/BucketMappings.java
+++ b/nifi-registry-core/nifi-registry-framework/src/main/java/org/apache/nifi/registry/service/mapper/BucketMappings.java
@@ -33,6 +33,7 @@
         bucketEntity.setDescription(bucket.getDescription());
         bucketEntity.setCreated(new Date(bucket.getCreatedTimestamp()));
         bucketEntity.setAllowExtensionBundleRedeploy(bucket.isAllowBundleRedeploy());
+        bucketEntity.setAllowPublicRead(bucket.isAllowPublicRead());
         return bucketEntity;
     }
 
@@ -43,6 +44,7 @@
         bucket.setDescription(bucketEntity.getDescription());
         bucket.setCreatedTimestamp(bucketEntity.getCreated().getTime());
         bucket.setAllowBundleRedeploy(bucketEntity.isAllowExtensionBundleRedeploy());
+        bucket.setAllowPublicRead(bucketEntity.isAllowPublicRead());
         return bucket;
     }
 
diff --git a/nifi-registry-core/nifi-registry-framework/src/main/resources/db/migration/default/V5__AddBucketPublicFlags.sql b/nifi-registry-core/nifi-registry-framework/src/main/resources/db/migration/default/V5__AddBucketPublicFlags.sql
new file mode 100644
index 0000000..ef7478b
--- /dev/null
+++ b/nifi-registry-core/nifi-registry-framework/src/main/resources/db/migration/default/V5__AddBucketPublicFlags.sql
@@ -0,0 +1,16 @@
+-- Licensed to the Apache Software Foundation (ASF) under one or more
+-- contributor license agreements.  See the NOTICE file distributed with
+-- this work for additional information regarding copyright ownership.
+-- The ASF licenses this file to You under the Apache License, Version 2.0
+-- (the "License"); you may not use this file except in compliance with
+-- the License.  You may obtain a copy of the License at
+--
+--     http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing, software
+-- distributed under the License is distributed on an "AS IS" BASIS,
+-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+-- See the License for the specific language governing permissions and
+-- limitations under the License.
+
+ALTER TABLE BUCKET ADD ALLOW_PUBLIC_READ INT NOT NULL DEFAULT (0);
diff --git a/nifi-registry-core/nifi-registry-framework/src/main/resources/db/migration/mysql/V5__AddBucketPublicFlags.sql b/nifi-registry-core/nifi-registry-framework/src/main/resources/db/migration/mysql/V5__AddBucketPublicFlags.sql
new file mode 100644
index 0000000..9ba1b80
--- /dev/null
+++ b/nifi-registry-core/nifi-registry-framework/src/main/resources/db/migration/mysql/V5__AddBucketPublicFlags.sql
@@ -0,0 +1,16 @@
+-- Licensed to the Apache Software Foundation (ASF) under one or more
+-- contributor license agreements.  See the NOTICE file distributed with
+-- this work for additional information regarding copyright ownership.
+-- The ASF licenses this file to You under the Apache License, Version 2.0
+-- (the "License"); you may not use this file except in compliance with
+-- the License.  You may obtain a copy of the License at
+--
+--     http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing, software
+-- distributed under the License is distributed on an "AS IS" BASIS,
+-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+-- See the License for the specific language governing permissions and
+-- limitations under the License.
+
+ALTER TABLE BUCKET ADD ALLOW_PUBLIC_READ INT NOT NULL DEFAULT 0;
diff --git a/nifi-registry-core/nifi-registry-framework/src/test/groovy/org/apache/nifi/registry/security/authorization/AuthorizerFactorySpec.groovy b/nifi-registry-core/nifi-registry-framework/src/test/groovy/org/apache/nifi/registry/security/authorization/AuthorizerFactorySpec.groovy
index 932d483..34dfe6b 100644
--- a/nifi-registry-core/nifi-registry-framework/src/test/groovy/org/apache/nifi/registry/security/authorization/AuthorizerFactorySpec.groovy
+++ b/nifi-registry-core/nifi-registry-framework/src/test/groovy/org/apache/nifi/registry/security/authorization/AuthorizerFactorySpec.groovy
@@ -18,15 +18,15 @@
 
 import org.apache.nifi.registry.extension.ExtensionManager
 import org.apache.nifi.registry.properties.NiFiRegistryProperties
-import org.apache.nifi.registry.security.authorization.file.FileAccessPolicyProvider
-import org.apache.nifi.registry.security.authorization.file.FileUserGroupProvider
 import org.apache.nifi.registry.security.authorization.resource.ResourceFactory
+import org.apache.nifi.registry.service.RegistryService
 import spock.lang.Specification
 
 class AuthorizerFactorySpec extends Specification {
 
     def mockProperties = Mock(NiFiRegistryProperties)
     def mockExtensionManager = Mock(ExtensionManager)
+    def mockRegistryService = Mock(RegistryService)
 
     AuthorizerFactory authorizerFactory
 
@@ -35,7 +35,7 @@
         mockExtensionManager.getExtensionClassLoader(_) >> this.getClass().getClassLoader()
         mockProperties.getPropertyKeys() >> new HashSet<String>() // Called by IdentityMappingUtil.getIdentityMappings()
 
-        authorizerFactory = new AuthorizerFactory(mockProperties, mockExtensionManager, null)
+        authorizerFactory = new AuthorizerFactory(mockProperties, mockExtensionManager, null, mockRegistryService)
     }
 
     // runs after every feature method
@@ -88,7 +88,7 @@
 
         when: "a bad configuration is provided and getAuthorizer() is called"
         setMockPropsAuthorizersConfig(authorizersConfigFile, selectedAuthorizer)
-        authorizerFactory = new AuthorizerFactory(mockProperties, mockExtensionManager, null)
+        authorizerFactory = new AuthorizerFactory(mockProperties, mockExtensionManager, null, mockRegistryService)
         authorizerFactory.getAuthorizer()
 
         then: "expect an exception"
diff --git a/nifi-registry-core/nifi-registry-framework/src/test/groovy/org/apache/nifi/registry/service/AuthorizationServiceSpec.groovy b/nifi-registry-core/nifi-registry-framework/src/test/groovy/org/apache/nifi/registry/service/AuthorizationServiceSpec.groovy
index 4646c2f..f47e7ce 100644
--- a/nifi-registry-core/nifi-registry-framework/src/test/groovy/org/apache/nifi/registry/service/AuthorizationServiceSpec.groovy
+++ b/nifi-registry-core/nifi-registry-framework/src/test/groovy/org/apache/nifi/registry/service/AuthorizationServiceSpec.groovy
@@ -20,13 +20,8 @@
 import org.apache.nifi.registry.authorization.User
 import org.apache.nifi.registry.authorization.UserGroup
 import org.apache.nifi.registry.bucket.Bucket
+import org.apache.nifi.registry.security.authorization.*
 import org.apache.nifi.registry.security.authorization.AccessPolicy as AuthAccessPolicy
-import org.apache.nifi.registry.security.authorization.AuthorizableLookup
-import org.apache.nifi.registry.security.authorization.ConfigurableAccessPolicyProvider
-import org.apache.nifi.registry.security.authorization.ConfigurableUserGroupProvider
-import org.apache.nifi.registry.security.authorization.Group
-import org.apache.nifi.registry.security.authorization.RequestAction
-import org.apache.nifi.registry.security.authorization.StandardManagedAuthorizer
 import org.apache.nifi.registry.security.authorization.User as AuthUser
 import org.apache.nifi.registry.security.authorization.exception.AccessDeniedException
 import org.apache.nifi.registry.security.authorization.resource.Authorizable
@@ -44,8 +39,9 @@
 
     def setup() {
         accessPolicyProvider.getUserGroupProvider() >> userGroupProvider
-        def authorizer = new StandardManagedAuthorizer(accessPolicyProvider, userGroupProvider)
-        authorizationService = new AuthorizationService(authorizableLookup, authorizer, registryService)
+        def standardAuthorizer = new StandardManagedAuthorizer(accessPolicyProvider, userGroupProvider)
+        def frameworkAuthorizer = new FrameworkManagedAuthorizer(standardAuthorizer, registryService)
+        authorizationService = new AuthorizationService(authorizableLookup, frameworkAuthorizer, registryService)
     }
 
     // ----- User tests -------------------------------------------------------
@@ -566,21 +562,31 @@
                 "b1": [
                         "name": "Bucket #1",
                         "description": "An initial bucket for testing",
-                        "createdTimestamp": 1
+                        "createdTimestamp": 1,
+                        "allowPublicRead" : false
                 ],
                 "b2": [
                         "name": "Bucket #2",
                         "description": "A second bucket for testing",
-                        "createdTimestamp": 2
+                        "createdTimestamp": 2,
+                        "allowPublicRead" : true
                 ],
+                "b3": [
+                        "name": "Bucket #3",
+                        "description": "A third bucket for testing",
+                        "createdTimestamp": 3,
+                        "allowPublicRead" : false
+                ]
         ]
         def mapBucket = {
             String id -> new Bucket([
                     identifier: id,
                     name: buckets[id]["name"] as String,
-                    description: buckets[id]["description"] as String]) }
+                    description: buckets[id]["description"] as String,
+                    allowPublicRead: buckets[id]["allowPublicRead"]
+            ]) }
 
-        registryService.getBuckets() >> {[ mapBucket("b1"), mapBucket("b2") ]}
+        registryService.getBuckets() >> {[ mapBucket("b1"), mapBucket("b2"), mapBucket("b3") ]}
 
         def authorized = Mock(Authorizable)
         authorized.authorize(_, _, _) >> { return }
@@ -590,7 +596,8 @@
         authorizableLookup.getAuthorizableByResource("/actuator")   >> denied
         authorizableLookup.getAuthorizableByResource("/buckets")    >> authorized
         authorizableLookup.getAuthorizableByResource("/buckets/b1") >> authorized
-        authorizableLookup.getAuthorizableByResource("/buckets/b2") >> denied
+        authorizableLookup.getAuthorizableByResource("/buckets/b2") >> authorized
+        authorizableLookup.getAuthorizableByResource("/buckets/b3") >> denied
         authorizableLookup.getAuthorizableByResource("/policies")   >> authorized
         authorizableLookup.getAuthorizableByResource("/proxy")      >> denied
         authorizableLookup.getAuthorizableByResource("/swagger")    >> denied
@@ -602,12 +609,13 @@
 
         then:
         resources != null
-        resources.size() == 4
+        resources.size() == 5
         def sortedResources = resources.sort{it.identifier}
         sortedResources[0].identifier == "/buckets"
         sortedResources[1].identifier == "/buckets/b1"
-        sortedResources[2].identifier == "/policies"
-        sortedResources[3].identifier == "/tenants"
+        sortedResources[2].identifier == "/buckets/b2"
+        sortedResources[3].identifier == "/policies"
+        sortedResources[4].identifier == "/tenants"
 
 
         when:
@@ -615,11 +623,11 @@
 
         then:
         filteredResources != null
-        filteredResources.size() == 2
+        filteredResources.size() == 3
         def sortedFilteredResources = filteredResources.sort{it.identifier}
         sortedFilteredResources[0].identifier == "/buckets"
         sortedFilteredResources[1].identifier == "/buckets/b1"
-
+        sortedFilteredResources[2].identifier == "/buckets/b2"
     }
 
 }
diff --git a/nifi-registry-core/nifi-registry-framework/src/test/java/org/apache/nifi/registry/db/TestDatabaseMetadataService.java b/nifi-registry-core/nifi-registry-framework/src/test/java/org/apache/nifi/registry/db/TestDatabaseMetadataService.java
index 027bd3a..8c54152 100644
--- a/nifi-registry-core/nifi-registry-framework/src/test/java/org/apache/nifi/registry/db/TestDatabaseMetadataService.java
+++ b/nifi-registry-core/nifi-registry-framework/src/test/java/org/apache/nifi/registry/db/TestDatabaseMetadataService.java
@@ -105,6 +105,7 @@
         final BucketEntity bucket = metadataService.getBucketById("1");
         assertNotNull(bucket);
         assertFalse(bucket.isAllowExtensionBundleRedeploy());
+        assertFalse(bucket.isAllowPublicRead());
 
         final String updatedName = bucket.getName() + " UPDATED";
         final String updatedDesc = bucket.getDescription() + "DESC";
@@ -112,6 +113,7 @@
         bucket.setName(updatedName);
         bucket.setDescription(updatedDesc);
         bucket.setAllowExtensionBundleRedeploy(true);
+        bucket.setAllowPublicRead(true);
 
         metadataService.updateBucket(bucket);
 
@@ -120,6 +122,7 @@
         assertEquals(updatedName, updatedBucket.getName());
         assertEquals(updatedDesc, updatedBucket.getDescription());
         assertTrue(updatedBucket.isAllowExtensionBundleRedeploy());
+        assertTrue(updatedBucket.isAllowPublicRead());
     }
 
     @Test
diff --git a/nifi-registry-core/nifi-registry-framework/src/test/java/org/apache/nifi/registry/security/authorization/TestFrameworkAuthorizer.java b/nifi-registry-core/nifi-registry-framework/src/test/java/org/apache/nifi/registry/security/authorization/TestFrameworkAuthorizer.java
new file mode 100644
index 0000000..2cc03f8
--- /dev/null
+++ b/nifi-registry-core/nifi-registry-framework/src/test/java/org/apache/nifi/registry/security/authorization/TestFrameworkAuthorizer.java
@@ -0,0 +1,278 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.nifi.registry.security.authorization;
+
+import org.apache.nifi.registry.bucket.Bucket;
+import org.apache.nifi.registry.security.authorization.resource.ResourceFactory;
+import org.apache.nifi.registry.service.RegistryService;
+import org.junit.Before;
+import org.junit.Test;
+import org.mockito.ArgumentMatcher;
+
+import java.util.Arrays;
+import java.util.UUID;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.argThat;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.times;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+public class TestFrameworkAuthorizer {
+
+    private Authorizer frameworkAuthorizer;
+    private Authorizer wrappedAuthorizer;
+    private RegistryService registryService;
+
+    private Bucket bucketPublic;
+    private Bucket bucketNotPublic;
+
+    @Before
+    public void setup() {
+        wrappedAuthorizer = mock(Authorizer.class);
+        registryService = mock(RegistryService.class);
+        frameworkAuthorizer = new FrameworkAuthorizer(wrappedAuthorizer, registryService);
+
+        bucketPublic = new Bucket();
+        bucketPublic.setIdentifier(UUID.randomUUID().toString());
+        bucketPublic.setName("Public Bucket");
+        bucketPublic.setAllowPublicRead(true);
+
+        bucketNotPublic = new Bucket();
+        bucketNotPublic.setIdentifier(UUID.randomUUID().toString());
+        bucketNotPublic.setName("Non Public Bucket");
+        bucketNotPublic.setAllowPublicRead(false);
+
+        when(registryService.getBucket(bucketPublic.getIdentifier())).thenReturn(bucketPublic);
+        when(registryService.getBucket(bucketNotPublic.getIdentifier())).thenReturn(bucketNotPublic);
+    }
+
+    @Test
+    public void testReadPublicBucketWhenAnonymous() {
+        final Resource resource = ResourceFactory.getBucketResource(bucketPublic.getIdentifier(), bucketPublic.getName());
+
+        final AuthorizationRequest request = new AuthorizationRequest.Builder()
+                .resource(resource)
+                .requestedResource(resource)
+                .action(RequestAction.READ)
+                .accessAttempt(true)
+                .identity("anonymous")
+                .anonymous(true)
+                .build();
+
+        final AuthorizationResult result = frameworkAuthorizer.authorize(request);
+        assertNotNull(result);
+        assertEquals(AuthorizationResult.Result.Approved, result.getResult());
+
+        // should never make it to wrapped authorizer
+        verify(wrappedAuthorizer, times(0)).authorize(any(AuthorizationRequest.class));
+    }
+
+    @Test
+    public void testReadNonPublicBucketWhenAnonymous() {
+        final Resource resource = ResourceFactory.getBucketResource(bucketNotPublic.getIdentifier(), bucketNotPublic.getName());
+
+        final AuthorizationRequest request = new AuthorizationRequest.Builder()
+                .resource(resource)
+                .requestedResource(resource)
+                .action(RequestAction.READ)
+                .accessAttempt(true)
+                .identity("anonymous")
+                .anonymous(true)
+                .build();
+
+        final AuthorizationResult result = frameworkAuthorizer.authorize(request);
+        assertNotNull(result);
+        assertEquals(AuthorizationResult.Result.Denied, result.getResult());
+
+        // should be denied before making it to the wrapped authorizer since the user is anonymous
+        verify(wrappedAuthorizer, times(0)).authorize(any(AuthorizationRequest.class));
+    }
+
+    @Test
+    public void testWritePublicBucketWhenAnonymous() {
+        final Resource resource = ResourceFactory.getBucketResource(bucketPublic.getIdentifier(), bucketPublic.getName());
+
+        final AuthorizationRequest request = new AuthorizationRequest.Builder()
+                .resource(resource)
+                .requestedResource(resource)
+                .action(RequestAction.WRITE)
+                .accessAttempt(true)
+                .identity("anonymous")
+                .anonymous(true)
+                .build();
+
+        final AuthorizationResult result = frameworkAuthorizer.authorize(request);
+        assertNotNull(result);
+        assertEquals(AuthorizationResult.Result.Denied, result.getResult());
+
+        // should be denied before making it to wrapped authorizer since request is anonymous
+        verify(wrappedAuthorizer, times(0)).authorize(any(AuthorizationRequest.class));
+    }
+
+    @Test
+    public void testReadPublicBucketWhenNotAnonymous() {
+        final Resource resource = ResourceFactory.getBucketResource(bucketPublic.getIdentifier(), bucketPublic.getName());
+
+        final AuthorizationRequest request = new AuthorizationRequest.Builder()
+                .resource(resource)
+                .requestedResource(resource)
+                .action(RequestAction.READ)
+                .accessAttempt(true)
+                .identity("user1")
+                .anonymous(false)
+                .proxyIdentities(Arrays.asList("proxy1", "proxy2"))
+                .build();
+
+        final AuthorizationResult result = frameworkAuthorizer.authorize(request);
+        assertNotNull(result);
+        assertEquals(AuthorizationResult.Result.Approved, result.getResult());
+
+        // should never make it to wrapped authorizer
+        verify(wrappedAuthorizer, times(0)).authorize(any(AuthorizationRequest.class));
+    }
+
+    @Test
+    public void testReadNonPublicBucketWhenNotAnonymousAndAuthorizedProxies() {
+        final Resource resource = ResourceFactory.getBucketResource(bucketNotPublic.getIdentifier(), bucketNotPublic.getName());
+
+        final AuthorizationRequest request = new AuthorizationRequest.Builder()
+                .resource(resource)
+                .requestedResource(resource)
+                .action(RequestAction.READ)
+                .accessAttempt(true)
+                .identity("user1")
+                .anonymous(false)
+                .proxyIdentities(Arrays.asList("proxy1", "proxy2"))
+                .build();
+
+        // since the bucket is not public it will fall through to the wrapped authorizer
+        when(wrappedAuthorizer.authorize(any(AuthorizationRequest.class)))
+                .thenReturn(AuthorizationResult.approved());
+
+        final AuthorizationResult result = frameworkAuthorizer.authorize(request);
+        assertNotNull(result);
+        assertEquals(AuthorizationResult.Result.Approved, result.getResult());
+
+        // should make 3 calls to the wrapped authorizer to authorize user1, proxy1, proxy2
+        verify(wrappedAuthorizer, times(3)).authorize(any(AuthorizationRequest.class));
+    }
+
+    @Test
+    public void testReadNonPublicBucketWhenNotAnonymousAndUnauthorizedProxy() {
+        final Resource resource = ResourceFactory.getBucketResource(bucketNotPublic.getIdentifier(), bucketNotPublic.getName());
+
+        final AuthorizationRequest request = new AuthorizationRequest.Builder()
+                .resource(resource)
+                .requestedResource(resource)
+                .action(RequestAction.READ)
+                .accessAttempt(true)
+                .identity("user1")
+                .anonymous(false)
+                .proxyIdentities(Arrays.asList("proxy1", "proxy2"))
+                .build();
+
+        // since the bucket is not public and the user is not anonymous, it will continue to proxy authorization
+
+        // simulate the first proxy being authorized for READ actions
+        final AuthorizationRequestMatcher proxy1Matcher = new AuthorizationRequestMatcher(
+                "proxy1", ResourceFactory.getProxyResource(), request.getAction());
+        when(wrappedAuthorizer.authorize(argThat(proxy1Matcher))).thenReturn(AuthorizationResult.approved());
+
+        // simulate the second proxy being unauthorized for READ actions
+        final AuthorizationRequestMatcher proxy2Matcher = new AuthorizationRequestMatcher(
+                "proxy2", ResourceFactory.getProxyResource(), request.getAction());
+        when(wrappedAuthorizer.authorize(argThat(proxy2Matcher))).thenReturn(AuthorizationResult.denied("denied"));
+
+        final AuthorizationResult result = frameworkAuthorizer.authorize(request);
+        assertNotNull(result);
+        assertEquals(AuthorizationResult.Result.Denied, result.getResult());
+
+        // should make 2 calls to the wrapped authorizer for the two proxies
+        verify(wrappedAuthorizer, times(2)).authorize(any(AuthorizationRequest.class));
+    }
+
+    @Test
+    public void testReadNonPublicBucketWhenNotAnonymousAndUnauthorizedEndUser() {
+        final Resource resource = ResourceFactory.getBucketResource(bucketNotPublic.getIdentifier(), bucketNotPublic.getName());
+
+        final AuthorizationRequest request = new AuthorizationRequest.Builder()
+                .resource(resource)
+                .requestedResource(resource)
+                .action(RequestAction.READ)
+                .accessAttempt(true)
+                .identity("user1")
+                .anonymous(false)
+                .proxyIdentities(Arrays.asList("proxy1", "proxy2"))
+                .build();
+
+        // since the bucket is not public and the user is not anonymous, it will continue to proxy authorization
+
+        // simulate the first proxy being authorized for READ actions
+        final AuthorizationRequestMatcher proxy1Matcher = new AuthorizationRequestMatcher(
+                "proxy1", ResourceFactory.getProxyResource(), request.getAction());
+        when(wrappedAuthorizer.authorize(argThat(proxy1Matcher))).thenReturn(AuthorizationResult.approved());
+
+        // simulate the second proxy being authorized for READ actions
+        final AuthorizationRequestMatcher proxy2Matcher = new AuthorizationRequestMatcher(
+                "proxy2", ResourceFactory.getProxyResource(), request.getAction());
+        when(wrappedAuthorizer.authorize(argThat(proxy2Matcher))).thenReturn(AuthorizationResult.approved());
+
+        // simulate the end user being unauthorized for READ actions
+        final AuthorizationRequestMatcher user1Matcher = new AuthorizationRequestMatcher(
+                "user1", resource, request.getAction());
+        when(wrappedAuthorizer.authorize(argThat(user1Matcher))).thenReturn(AuthorizationResult.denied("denied"));
+
+        final AuthorizationResult result = frameworkAuthorizer.authorize(request);
+        assertNotNull(result);
+        assertEquals(AuthorizationResult.Result.Denied, result.getResult());
+
+        // should make 3 calls to the wrapped authorizer for the two proxies and end user
+        verify(wrappedAuthorizer, times(3)).authorize(any(AuthorizationRequest.class));
+    }
+
+
+    /**
+     * Matcher for matching Authorization requests.
+     */
+    private static class AuthorizationRequestMatcher implements ArgumentMatcher<AuthorizationRequest> {
+
+        private final String identity;
+        private final Resource resource;
+        private final RequestAction action;
+
+        public AuthorizationRequestMatcher(final String identity, final Resource resource, final RequestAction action) {
+            this.identity = identity;
+            this.resource = resource;
+            this.action = action;
+        }
+
+        @Override
+        public boolean matches(final AuthorizationRequest request) {
+            if (request == null) {
+                return false;
+            }
+
+            return identity.equals(request.getIdentity())
+                    && resource.getIdentifier().equals(request.getResource().getIdentifier())
+                    && action == request.getAction();
+        }
+    }
+}
diff --git a/nifi-registry-core/nifi-registry-security-api/src/main/java/org/apache/nifi/registry/security/authorization/AuthorizationRequest.java b/nifi-registry-core/nifi-registry-security-api/src/main/java/org/apache/nifi/registry/security/authorization/AuthorizationRequest.java
index 1eb99f9..56b7b45 100644
--- a/nifi-registry-core/nifi-registry-security-api/src/main/java/org/apache/nifi/registry/security/authorization/AuthorizationRequest.java
+++ b/nifi-registry-core/nifi-registry-security-api/src/main/java/org/apache/nifi/registry/security/authorization/AuthorizationRequest.java
@@ -18,6 +18,7 @@
 
 import java.util.Collections;
 import java.util.HashMap;
+import java.util.List;
 import java.util.Map;
 import java.util.Objects;
 import java.util.Set;
@@ -33,6 +34,7 @@
     private final Resource resource;
     private final Resource requestedResource;
     private final String identity;
+    private final List<String> proxyIdentities;
     private final Set<String> groups;
     private final RequestAction action;
     private final boolean isAccessAttempt;
@@ -49,6 +51,7 @@
 
         this.resource = builder.resource;
         this.identity = builder.identity;
+        this.proxyIdentities = builder.proxyIdentities == null ? Collections.emptyList() : Collections.unmodifiableList(builder.proxyIdentities);
         this.groups = builder.groups == null ? null : Collections.unmodifiableSet(builder.groups);
         this.action = builder.action;
         this.isAccessAttempt = builder.isAccessAttempt;
@@ -103,6 +106,15 @@
     }
 
     /**
+     * The identities in the proxy chain for the request. Will be empty if the request was not proxied.
+     *
+     * @return The identities in the proxy chain
+     */
+    public List<String> getProxyIdentities() {
+        return proxyIdentities;
+    }
+
+    /**
      * The groups the user making this request belongs to. May be null if this NiFi is not configured to load user
      * groups or empty if the user has no groups
      *
@@ -174,6 +186,7 @@
         private Resource resource;
         private Resource requestedResource;
         private String identity;
+        private List<String> proxyIdentities;
         private Set<String> groups;
         private Boolean isAnonymous;
         private Boolean isAccessAttempt;
@@ -197,6 +210,11 @@
             return this;
         }
 
+        public Builder proxyIdentities(final List<String> proxyIdentities) {
+            this.proxyIdentities = proxyIdentities;
+            return this;
+        }
+
         public Builder groups(final Set<String> groups) {
             this.groups = groups;
             return this;
diff --git a/nifi-registry-core/nifi-registry-web-api/src/main/java/org/apache/nifi/registry/web/api/AccessResource.java b/nifi-registry-core/nifi-registry-web-api/src/main/java/org/apache/nifi/registry/web/api/AccessResource.java
index 2cf3116..30374f0 100644
--- a/nifi-registry-core/nifi-registry-web-api/src/main/java/org/apache/nifi/registry/web/api/AccessResource.java
+++ b/nifi-registry-core/nifi-registry-web-api/src/main/java/org/apache/nifi/registry/web/api/AccessResource.java
@@ -124,6 +124,7 @@
         }
 
         final CurrentUser currentUser = authorizationService.getCurrentUser();
+        currentUser.setLoginSupported(httpServletRequest.isSecure() && identityProvider != null);
 
         return generateOkResponse(currentUser).build();
     }
diff --git a/nifi-registry-core/nifi-registry-web-api/src/main/java/org/apache/nifi/registry/web/security/NiFiRegistrySecurityConfig.java b/nifi-registry-core/nifi-registry-web-api/src/main/java/org/apache/nifi/registry/web/security/NiFiRegistrySecurityConfig.java
index a2a6ea9..20a6e0d 100644
--- a/nifi-registry-core/nifi-registry-web-api/src/main/java/org/apache/nifi/registry/web/security/NiFiRegistrySecurityConfig.java
+++ b/nifi-registry-core/nifi-registry-web-api/src/main/java/org/apache/nifi/registry/web/security/NiFiRegistrySecurityConfig.java
@@ -22,7 +22,6 @@
 import org.apache.nifi.registry.web.security.authentication.AnonymousIdentityFilter;
 import org.apache.nifi.registry.web.security.authentication.IdentityAuthenticationProvider;
 import org.apache.nifi.registry.web.security.authentication.IdentityFilter;
-import org.apache.nifi.registry.web.security.authentication.exception.UntrustedProxyException;
 import org.apache.nifi.registry.web.security.authentication.jwt.JwtIdentityProvider;
 import org.apache.nifi.registry.web.security.authentication.x509.X509IdentityAuthenticationProvider;
 import org.apache.nifi.registry.web.security.authentication.x509.X509IdentityProvider;
@@ -110,13 +109,9 @@
         // otp
         // todo, if needed one-time password auth filter goes here
 
-        if (properties.getSslPort() == null) {
-            // If we are running an unsecured NiFi Registry server, add an
-            // anonymous authentication filter that will populate the
-            // authenticated, anonymous user if no other user identity
-            // is detected earlier in the Spring filter chain.
-            http.anonymous().authenticationFilter(anonymousAuthenticationFilter);
-        }
+        // add an anonymous authentication filter that will populate the authenticated,
+        // anonymous user if no other user identity is detected earlier in the Spring filter chain
+        http.anonymous().authenticationFilter(anonymousAuthenticationFilter);
 
         // After Spring Security filter chain is complete (so authentication is done),
         // but before the Jersey application endpoints get the request,
@@ -182,20 +177,9 @@
                                  AuthenticationException authenticationException)
                     throws IOException, ServletException {
 
-                final int status;
-
-                // See X509IdentityAuthenticationProvider.buildAuthenticatedToken(...)
-                if (authenticationException instanceof UntrustedProxyException) {
-                    // return a 403 response
-                    status = HttpServletResponse.SC_FORBIDDEN;
-                    logger.info("Identity in proxy chain not trusted to act as a proxy: {} Returning 403 response.", authenticationException.toString());
-
-                } else {
-                    // return a 401 response
-                    status = HttpServletResponse.SC_UNAUTHORIZED;
-                    logger.info("Client could not be authenticated due to: {} Returning 401 response.", authenticationException.toString());
-                }
-
+                // return a 401 response
+                final int status = HttpServletResponse.SC_UNAUTHORIZED;
+                logger.info("Client could not be authenticated due to: {} Returning 401 response.", authenticationException.toString());
                 logger.debug("", authenticationException);
 
                 if (!response.isCommitted()) {
diff --git a/nifi-registry-core/nifi-registry-web-api/src/main/java/org/apache/nifi/registry/web/security/authentication/exception/UntrustedProxyException.java b/nifi-registry-core/nifi-registry-web-api/src/main/java/org/apache/nifi/registry/web/security/authentication/exception/UntrustedProxyException.java
deleted file mode 100644
index 82570a3..0000000
--- a/nifi-registry-core/nifi-registry-web-api/src/main/java/org/apache/nifi/registry/web/security/authentication/exception/UntrustedProxyException.java
+++ /dev/null
@@ -1,31 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one or more
- * contributor license agreements.  See the NOTICE file distributed with
- * this work for additional information regarding copyright ownership.
- * The ASF licenses this file to You under the Apache License, Version 2.0
- * (the "License"); you may not use this file except in compliance with
- * the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.nifi.registry.web.security.authentication.exception;
-
-import org.springframework.security.core.AuthenticationException;
-
-public class UntrustedProxyException extends AuthenticationException {
-
-    public UntrustedProxyException(String msg) {
-        super(msg);
-    }
-
-    public UntrustedProxyException(String msg, Throwable t) {
-        super(msg, t);
-    }
-
-}
diff --git a/nifi-registry-core/nifi-registry-web-api/src/main/java/org/apache/nifi/registry/web/security/authentication/x509/X509IdentityAuthenticationProvider.java b/nifi-registry-core/nifi-registry-web-api/src/main/java/org/apache/nifi/registry/web/security/authentication/x509/X509IdentityAuthenticationProvider.java
index 9d724ac..6571177 100644
--- a/nifi-registry-core/nifi-registry-web-api/src/main/java/org/apache/nifi/registry/web/security/authentication/x509/X509IdentityAuthenticationProvider.java
+++ b/nifi-registry-core/nifi-registry-web-api/src/main/java/org/apache/nifi/registry/web/security/authentication/x509/X509IdentityAuthenticationProvider.java
@@ -19,25 +19,16 @@
 import org.apache.commons.lang3.StringUtils;
 import org.apache.nifi.registry.properties.NiFiRegistryProperties;
 import org.apache.nifi.registry.security.authentication.AuthenticationRequest;
-import org.apache.nifi.registry.web.security.authentication.AuthenticationRequestToken;
 import org.apache.nifi.registry.security.authentication.AuthenticationResponse;
 import org.apache.nifi.registry.security.authentication.IdentityProvider;
-import org.apache.nifi.registry.web.security.authentication.IdentityAuthenticationProvider;
-import org.apache.nifi.registry.web.security.authentication.AuthenticationSuccessToken;
 import org.apache.nifi.registry.security.authorization.Authorizer;
-import org.apache.nifi.registry.security.authorization.RequestAction;
-import org.apache.nifi.registry.security.authorization.Resource;
-import org.apache.nifi.registry.security.authorization.exception.AccessDeniedException;
-import org.apache.nifi.registry.security.authorization.resource.Authorizable;
-import org.apache.nifi.registry.security.authorization.resource.ResourceFactory;
 import org.apache.nifi.registry.security.authorization.user.NiFiUser;
 import org.apache.nifi.registry.security.authorization.user.NiFiUserDetails;
 import org.apache.nifi.registry.security.authorization.user.StandardNiFiUser;
 import org.apache.nifi.registry.security.util.ProxiedEntitiesUtils;
-import org.apache.nifi.registry.web.security.authentication.exception.UntrustedProxyException;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-import org.springframework.http.HttpMethod;
+import org.apache.nifi.registry.web.security.authentication.AuthenticationRequestToken;
+import org.apache.nifi.registry.web.security.authentication.AuthenticationSuccessToken;
+import org.apache.nifi.registry.web.security.authentication.IdentityAuthenticationProvider;
 
 import java.util.List;
 import java.util.ListIterator;
@@ -45,20 +36,6 @@
 
 public class X509IdentityAuthenticationProvider extends IdentityAuthenticationProvider {
 
-    private static final Logger LOGGER = LoggerFactory.getLogger(X509IdentityAuthenticationProvider.class);
-
-    private static final Authorizable PROXY_AUTHORIZABLE = new Authorizable() {
-        @Override
-        public Authorizable getParentAuthorizable() {
-            return null;
-        }
-
-        @Override
-        public Resource getResource() {
-            return ResourceFactory.getProxyResource();
-        }
-    };
-
     public X509IdentityAuthenticationProvider(NiFiRegistryProperties properties, Authorizer authorizer, IdentityProvider identityProvider) {
         super(properties, authorizer, identityProvider);
     }
@@ -86,10 +63,6 @@
         final List<String> proxyChain = ProxiedEntitiesUtils.tokenizeProxiedEntitiesChain(proxiedEntitiesChain);
         proxyChain.add(response.getIdentity());
 
-        final String httpMethodStr = x509RequestDetails.getHttpMethod().toUpperCase();
-        final HttpMethod httpMethod = HttpMethod.resolve(httpMethodStr);
-        LOGGER.debug("HTTP method is {}", new Object[]{httpMethod});
-
         // add the chain as appropriate to each proxy
         NiFiUser proxy = null;
         for (final ListIterator<String> chainIter = proxyChain.listIterator(proxyChain.size()); chainIter.hasPrevious(); ) {
@@ -108,51 +81,13 @@
             // Only set the client address for client making the request because we don't know the clientAddress of the proxied entities
             String clientAddress = (proxy == null) ? requestToken.getClientAddress() : null;
             proxy = createUser(identity, groups, proxy, clientAddress, isAnonymous);
-
-            if (chainIter.hasPrevious()) {
-                switch (httpMethod) {
-                    case POST:
-                    case PUT:
-                    case PATCH:
-                        authorizeWrite(proxy);
-                        break;
-                    case DELETE:
-                        authorizeDelete(proxy);
-                        break;
-                    default:
-                        authorizeRead(proxy);
-                        break;
-                }
-            }
         }
 
+        // Defer authorization of proxy until later in FrameworkAuthorizer
+
         return new AuthenticationSuccessToken(new NiFiUserDetails(proxy));
     }
 
-    private void authorizeRead(final NiFiUser proxy) {
-        try {
-            PROXY_AUTHORIZABLE.authorize(authorizer, RequestAction.READ, proxy);
-        } catch (final AccessDeniedException e) {
-            throw new UntrustedProxyException(String.format("Untrusted proxy for read operation [%s].", proxy.getIdentity()));
-        }
-    }
-
-    private void authorizeWrite(final NiFiUser proxy) {
-        try {
-            PROXY_AUTHORIZABLE.authorize(authorizer, RequestAction.WRITE, proxy);
-        } catch (final AccessDeniedException e) {
-            throw new UntrustedProxyException(String.format("Untrusted proxy for write operation [%s].", proxy.getIdentity()));
-        }
-    }
-
-    private void authorizeDelete(final NiFiUser proxy) {
-        try {
-            PROXY_AUTHORIZABLE.authorize(authorizer, RequestAction.DELETE, proxy);
-        } catch (final AccessDeniedException e) {
-            throw new UntrustedProxyException(String.format("Untrusted proxy for delete operation [%s].", proxy.getIdentity()));
-        }
-    }
-
     /**
      * Returns a regular user populated with the provided values, or if the user should be anonymous, a well-formed instance of the anonymous user with the provided values.
      *
@@ -170,6 +105,4 @@
         }
     }
 
-
-
 }
diff --git a/nifi-registry-core/nifi-registry-web-api/src/test/java/org/apache/nifi/registry/web/api/SecureLdapIT.java b/nifi-registry-core/nifi-registry-web-api/src/test/java/org/apache/nifi/registry/web/api/SecureLdapIT.java
index 11d7b33..c6172a1 100644
--- a/nifi-registry-core/nifi-registry-web-api/src/test/java/org/apache/nifi/registry/web/api/SecureLdapIT.java
+++ b/nifi-registry-core/nifi-registry-web-api/src/test/java/org/apache/nifi/registry/web/api/SecureLdapIT.java
@@ -32,6 +32,7 @@
 import org.apache.nifi.registry.security.authorization.AuthorizerFactory;
 import org.apache.nifi.registry.security.crypto.BootstrapFileCryptoKeyProvider;
 import org.apache.nifi.registry.security.crypto.CryptoKeyProvider;
+import org.apache.nifi.registry.service.RegistryService;
 import org.junit.After;
 import org.junit.Before;
 import org.junit.Test;
@@ -94,9 +95,9 @@
         @Primary
         @Bean
         @DependsOn({"directoryServer"}) // Can't load LdapUserGroupProvider until the embedded LDAP server, which creates the "directoryServer" bean, is running
-        public static Authorizer getAuthorizer(@Autowired NiFiRegistryProperties properties, ExtensionManager extensionManager) throws Exception {
+        public static Authorizer getAuthorizer(@Autowired NiFiRegistryProperties properties, ExtensionManager extensionManager, RegistryService registryService) throws Exception {
             if (authorizerFactory == null) {
-                authorizerFactory = new AuthorizerFactory(properties, extensionManager, sensitivePropertyProvider());
+                authorizerFactory = new AuthorizerFactory(properties, extensionManager, sensitivePropertyProvider(), registryService);
             }
             return authorizerFactory.getAuthorizer();
         }
@@ -231,7 +232,18 @@
     @Test
     public void testGetCurrentUserFailsForAnonymous() throws Exception {
 
-        // Given: the client is connected to an unsecured NiFi Registry
+        // Given: the client is connected to an secured NiFi Registry
+        final String expectedJson = "{" +
+                "\"anonymous\":true," +
+                "\"identity\":\"anonymous\"," +
+                "\"loginSupported\":true," +
+                "\"resourcePermissions\":{" +
+                "\"anyTopLevelResource\":{\"canDelete\":false,\"canRead\":false,\"canWrite\":false}," +
+                "\"buckets\":{\"canDelete\":false,\"canRead\":false,\"canWrite\":false}," +
+                "\"policies\":{\"canDelete\":false,\"canRead\":false,\"canWrite\":false}," +
+                "\"proxy\":{\"canDelete\":false,\"canRead\":false,\"canWrite\":false}," +
+                "\"tenants\":{\"canDelete\":false,\"canRead\":false,\"canWrite\":false}}" +
+                "}";
 
         // When: the /access endpoint is queried with no credentials
         final Response response = client
@@ -240,8 +252,10 @@
                 .get(Response.class);
 
         // Then: the server returns a 200 OK with the expected current user
-        assertEquals(401, response.getStatus());
+        assertEquals(200, response.getStatus());
 
+        final String actualJson = response.readEntity(String.class);
+        JSONAssert.assertEquals(expectedJson, actualJson, false);
     }
 
     @Test
diff --git a/nifi-registry-core/nifi-registry-web-ui/src/main/webapp/components/administration/workflow/dialogs/create-bucket/nf-registry-create-bucket.html b/nifi-registry-core/nifi-registry-web-ui/src/main/webapp/components/administration/workflow/dialogs/create-bucket/nf-registry-create-bucket.html
index 32ee01a..19f7663 100644
--- a/nifi-registry-core/nifi-registry-web-ui/src/main/webapp/components/administration/workflow/dialogs/create-bucket/nf-registry-create-bucket.html
+++ b/nifi-registry-core/nifi-registry-web-ui/src/main/webapp/components/administration/workflow/dialogs/create-bucket/nf-registry-create-bucket.html
@@ -28,6 +28,10 @@
                 <input #newBucketInput matInput floatPlaceholder="always" placeholder="Bucket Name">
             </mat-input-container>
         </div>
+        <mat-checkbox #newBucketPublicReadCheckbox [disabled]="protocol === 'http:'" >
+            Make publicly visible<i matTooltip="Allows read access to items in this bucket by unauthenticated users. Overrides any specific policies granting read access."
+                                    class="pad-left-sm fa fa-question-circle-o help-icon"></i>
+        </mat-checkbox>
         <mat-checkbox [(ngModel)]="keepDialogOpen">
             Keep this dialog open after creating bucket
         </mat-checkbox>
@@ -38,8 +42,8 @@
                 i18n="Cancel creation of new bucket|A button for cancelling the creation of a new bucket in the registry.@@nf-admin-workflow-cancel-create-bucket-button">
             Cancel
         </button>
-        <button [disabled]="newBucketInput.value.length === 0" class="push-left-sm" data-automation-id="create-new-bucket-button" (click)="createBucket(newBucketInput)" color="fds-primary" mat-raised-button
-                i18n="Create new bucket button|A button for creating a new bucket in the registry.@@nf-admin-workflow-create-bucket-button">
+        <button [disabled]="newBucketInput.value.length === 0" class="push-left-sm" data-automation-id="create-new-bucket-button" (click)="createBucket(newBucketInput,newBucketPublicReadCheckbox)"
+                color="fds-primary" mat-raised-button i18n="Create new bucket button|A button for creating a new bucket in the registry.@@nf-admin-workflow-create-bucket-button">
             Create
         </button>
     </div>
diff --git a/nifi-registry-core/nifi-registry-web-ui/src/main/webapp/components/administration/workflow/dialogs/create-bucket/nf-registry-create-bucket.js b/nifi-registry-core/nifi-registry-web-ui/src/main/webapp/components/administration/workflow/dialogs/create-bucket/nf-registry-create-bucket.js
index abaaa59..f529285 100644
--- a/nifi-registry-core/nifi-registry-web-ui/src/main/webapp/components/administration/workflow/dialogs/create-bucket/nf-registry-create-bucket.js
+++ b/nifi-registry-core/nifi-registry-web-ui/src/main/webapp/components/administration/workflow/dialogs/create-bucket/nf-registry-create-bucket.js
@@ -38,6 +38,7 @@
     this.dialogRef = matDialogRef;
     // local state
     this.keepDialogOpen = false;
+    this.protocol = location.protocol;
 }
 
 NfRegistryCreateBucket.prototype = {
@@ -46,11 +47,12 @@
     /**
      * Create a new bucket.
      *
-     * @param newBucketInput     The newBucketInput element.
+     * @param newBucketInput                The newBucketInput element.
+     * @param newBucketPublicReadCheckbox   The newBucketPublicReadCheckbox element.
      */
-    createBucket: function (newBucketInput) {
+    createBucket: function (newBucketInput, newBucketPublicReadCheckbox) {
         var self = this;
-        this.nfRegistryApi.createBucket(newBucketInput.value).subscribe(function (bucket) {
+        this.nfRegistryApi.createBucket(newBucketInput.value, newBucketPublicReadCheckbox.checked).subscribe(function (bucket) {
             if (!bucket.error) {
                 self.nfRegistryService.buckets.push(bucket);
                 self.nfRegistryService.filterBuckets();
diff --git a/nifi-registry-core/nifi-registry-web-ui/src/main/webapp/components/administration/workflow/dialogs/create-bucket/nf-registry-create-bucket.spec.js b/nifi-registry-core/nifi-registry-web-ui/src/main/webapp/components/administration/workflow/dialogs/create-bucket/nf-registry-create-bucket.spec.js
index 3cb59d7..5b14455 100644
--- a/nifi-registry-core/nifi-registry-web-ui/src/main/webapp/components/administration/workflow/dialogs/create-bucket/nf-registry-create-bucket.spec.js
+++ b/nifi-registry-core/nifi-registry-web-ui/src/main/webapp/components/administration/workflow/dialogs/create-bucket/nf-registry-create-bucket.spec.js
@@ -46,7 +46,7 @@
 
     it('should create a new bucket and close the dialog', function () {
         // The function to test
-        comp.createBucket({value: 'NewBucket'});
+        comp.createBucket({value: 'NewBucket'}, {checked: false});
 
         //assertions
         expect(comp).toBeDefined();
@@ -61,7 +61,7 @@
         comp.keepDialogOpen = true;
 
         // The function to test
-        comp.createBucket({value: 'NewBucket'});
+        comp.createBucket({value: 'NewBucket'}, {checked: false});
 
         //assertions
         expect(comp).toBeDefined();
diff --git a/nifi-registry-core/nifi-registry-web-ui/src/main/webapp/components/administration/workflow/sidenav/manage-bucket/nf-registry-manage-bucket.html b/nifi-registry-core/nifi-registry-web-ui/src/main/webapp/components/administration/workflow/sidenav/manage-bucket/nf-registry-manage-bucket.html
index 9d3cdbe..126aaa7 100644
--- a/nifi-registry-core/nifi-registry-web-ui/src/main/webapp/components/administration/workflow/sidenav/manage-bucket/nf-registry-manage-bucket.html
+++ b/nifi-registry-core/nifi-registry-web-ui/src/main/webapp/components/administration/workflow/sidenav/manage-bucket/nf-registry-manage-bucket.html
@@ -42,6 +42,15 @@
                 Save
             </button>
         </div>
+        <div class="pad-left-md pad-right-md pad-bottom-sm">
+            <mat-checkbox #bundlePublicReadCheckbox
+                          [disabled]="!nfRegistryService.currentUser.resourcePermissions.buckets.canWrite || protocol === 'http:'"
+                          [(ngModel)]="allowPublicRead"
+                          (change)="toggleBucketPublicRead($event)">
+                Make publicly visible<i matTooltip="Allows read access to items in this bucket by unauthenticated users. Overrides any specific policies granting read access."
+                                    class="pad-left-sm fa fa-question-circle-o help-icon"></i>
+            </mat-checkbox>
+        </div>
         <div class="pad-top-md pad-left-md pad-right-md">
             <div class="pad-bottom-sm">
                 <span class="md-card-title">Bundle Settings</span>
diff --git a/nifi-registry-core/nifi-registry-web-ui/src/main/webapp/components/administration/workflow/sidenav/manage-bucket/nf-registry-manage-bucket.js b/nifi-registry-core/nifi-registry-web-ui/src/main/webapp/components/administration/workflow/sidenav/manage-bucket/nf-registry-manage-bucket.js
index 1d6a71b..367129c 100644
--- a/nifi-registry-core/nifi-registry-web-ui/src/main/webapp/components/administration/workflow/sidenav/manage-bucket/nf-registry-manage-bucket.js
+++ b/nifi-registry-core/nifi-registry-web-ui/src/main/webapp/components/administration/workflow/sidenav/manage-bucket/nf-registry-manage-bucket.js
@@ -63,6 +63,7 @@
     this.userPermsSearchTerms = [];
     this.bucketname = '';
     this.allowBundleRedeploy = false;
+    this.allowPublicRead = false;
     this.bucketPolicies = [];
     this.userPerms = {};
     this.groupPerms = {};
@@ -80,6 +81,7 @@
     this.dialogService = fdsDialogService;
     this.snackBarService = fdsSnackBarService;
     this.dataTableService = tdDataTableService;
+    this.protocol = location.protocol;
 }
 
 NfRegistryManageBucket.prototype = {
@@ -104,6 +106,7 @@
                     self.nfRegistryService.bucket = bucket;
                     self.bucketname = bucket.name;
                     self.allowBundleRedeploy = bucket.allowBundleRedeploy;
+                    self.allowPublicRead = bucket.allowPublicRead;
                     if (!self.nfRegistryService.currentUser.anonymous) {
                         if (!response[1].status || response[1].status === 200) {
                             var policies = response[1];
@@ -163,6 +166,7 @@
                     self.nfRegistryService.bucket = response;
                     self.bucketname = response.name;
                     self.allowBundleRedeploy = response.allowBundleRedeploy;
+                    self.allowPublicRead = response.allowPublicRead;
 
                     if (dialogResult) {
                         if (dialogResult.userOrGroup.type === 'user') {
@@ -201,6 +205,7 @@
                     self.nfRegistryService.bucket = response;
                     self.bucketname = response.name;
                     self.allowBundleRedeploy = response.allowBundleRedeploy;
+                    self.allowPublicRead = response.allowPublicRead;
 
                     if (dialogResult) {
                         if (dialogResult.userOrGroup.type === 'user') {
@@ -424,6 +429,8 @@
             } else if (response.status === 409) {
                 self.bucketname = self.nfRegistryService.bucket.name;
                 self.allowBundleRedeploy = self.nfRegistryService.bucket.allowBundleRedeploy;
+                self.allowPublicRead = self.nfRegistryService.bucket.allowPublicRead;
+
                 self.dialogService.openConfirm({
                     title: 'Error',
                     message: 'This bucket already exists. Please enter a different identity/bucket name.',
@@ -433,6 +440,8 @@
             } else if (response.status === 400) {
                 self.bucketname = self.nfRegistryService.bucket.name;
                 self.allowBundleRedeploy = self.nfRegistryService.bucket.allowBundleRedeploy;
+                self.allowPublicRead = self.nfRegistryService.bucket.allowPublicRead;
+
                 self.dialogService.openConfirm({
                     title: 'Error',
                     message: response.error,
@@ -478,6 +487,40 @@
     },
 
     /**
+     * Update allowPublicRead flag.
+     *
+     * @param the checkbox change event
+     */
+    toggleBucketPublicRead: function (event) {
+        var self = this;
+        this.nfRegistryApi.updateBucket({
+            'identifier': this.nfRegistryService.bucket.identifier,
+            'allowPublicRead': event.checked,
+        }).subscribe(function (response) {
+            if (!response.status || response.status === 200) {
+                self.nfRegistryService.bucket = response;
+                self.snackBarService.openCoaster({
+                    title: 'Success',
+                    message: 'Bucket settings have been updated.',
+                    verticalPosition: 'bottom',
+                    horizontalPosition: 'right',
+                    icon: 'fa fa-check-circle-o',
+                    color: '#1EB475',
+                    duration: 3000
+                });
+            } else if (response.status === 400) {
+                self.allowPublicRead = !event.checked;
+                self.dialogService.openConfirm({
+                    title: 'Error',
+                    message: response.error,
+                    acceptButton: 'Ok',
+                    acceptButtonColor: 'fds-warn'
+                });
+            }
+        });
+    },
+
+    /**
      * Determine if bucket policies can be edited.
      * @returns {boolean}
      */
diff --git a/nifi-registry-core/nifi-registry-web-ui/src/main/webapp/components/login/dialogs/nf-registry-user-login.html b/nifi-registry-core/nifi-registry-web-ui/src/main/webapp/components/login/dialogs/nf-registry-user-login.html
index 343b319..986e7b3 100644
--- a/nifi-registry-core/nifi-registry-web-ui/src/main/webapp/components/login/dialogs/nf-registry-user-login.html
+++ b/nifi-registry-core/nifi-registry-web-ui/src/main/webapp/components/login/dialogs/nf-registry-user-login.html
@@ -18,6 +18,9 @@
 <div id="nifi-registry-user-login-dialog">
     <div class="pad-bottom-md" fxLayout="row" fxLayoutAlign="space-between center">
         <span class="md-card-title">Log In</span>
+        <button mat-icon-button (click)="cancel()">
+            <mat-icon color="primary">close</mat-icon>
+        </button>
     </div>
     <div fxLayout="column" fxLayoutAlign="space-between start" class="pad-bottom-md">
         <div class="pad-bottom-md fill-available-width">
@@ -33,13 +36,13 @@
     </div>
     <div fxLayout="row">
         <span fxFlex></span>
-        <button (click)="usernameInput.value='';passwordInput.value=''" color="fds-regular" mat-raised-button
-                i18n="Clear log in form|A button for clearing the login form.@@nf-clear-user-login-button">
-            Clear
+        <button (click)="cancel()" color="fds-regular" mat-raised-button
+                i18n="Cancel log in|A button for cancelling the login form.@@nf-cancel-user-login-button">
+            Cancel
         </button>
         <button [disabled]="usernameInput.value.length === 0 || passwordInput.value.length === 0" class="push-left-sm" (click)="login(usernameInput, passwordInput)" color="fds-primary" mat-raised-button
                 i18n="Log in|A button for attempting to authenticate with the registry.@@nf-user-login-button">
             Log In
         </button>
     </div>
-</div>
\ No newline at end of file
+</div>
diff --git a/nifi-registry-core/nifi-registry-web-ui/src/main/webapp/components/login/dialogs/nf-registry-user-login.js b/nifi-registry-core/nifi-registry-web-ui/src/main/webapp/components/login/dialogs/nf-registry-user-login.js
index 6412e65..d4da84c 100644
--- a/nifi-registry-core/nifi-registry-web-ui/src/main/webapp/components/login/dialogs/nf-registry-user-login.js
+++ b/nifi-registry-core/nifi-registry-web-ui/src/main/webapp/components/login/dialogs/nf-registry-user-login.js
@@ -20,6 +20,7 @@
 import NfRegistryApi from 'services/nf-registry.api';
 import { MatDialogRef } from '@angular/material';
 import { NfRegistryLoginAuthGuard } from 'services/nf-registry.auth-guard.service';
+import { Router } from '@angular/router';
 
 /**
  * NfRegistryUserLogin constructor.
@@ -28,13 +29,15 @@
  * @param nfRegistryService                 The nf-registry.service module.
  * @param matDialogRef                      The angular material dialog ref.
  * @param nfRegistryLoginAuthGuard          The login auth guard.
+ * @param router                    The angular router module.
  * @constructor
  */
-function NfRegistryUserLogin(nfRegistryApi, nfRegistryService, matDialogRef, nfRegistryLoginAuthGuard) {
+function NfRegistryUserLogin(nfRegistryApi, nfRegistryService, matDialogRef, nfRegistryLoginAuthGuard, router) {
     this.nfRegistryService = nfRegistryService;
     this.nfRegistryApi = nfRegistryApi;
     this.dialogRef = matDialogRef;
     this.nfRegistryLoginAuthGuard = nfRegistryLoginAuthGuard;
+    this.router = router;
 }
 
 NfRegistryUserLogin.prototype = {
@@ -56,6 +59,12 @@
                 self.nfRegistryLoginAuthGuard.checkLogin(self.nfRegistryService.redirectUrl);
             }
         });
+    },
+
+    cancel: function () {
+        var self = this;
+        self.dialogRef.close();
+        self.router.navigateByUrl('/nifi-registry');
     }
 };
 
@@ -69,7 +78,8 @@
     NfRegistryApi,
     NfRegistryService,
     MatDialogRef,
-    NfRegistryLoginAuthGuard
+    NfRegistryLoginAuthGuard,
+    Router
 ];
 
 export default NfRegistryUserLogin;
diff --git a/nifi-registry-core/nifi-registry-web-ui/src/main/webapp/nf-registry.html b/nifi-registry-core/nifi-registry-web-ui/src/main/webapp/nf-registry.html
index ac4e569..9d1e849 100644
--- a/nifi-registry-core/nifi-registry-web-ui/src/main/webapp/nf-registry.html
+++ b/nifi-registry-core/nifi-registry-web-ui/src/main/webapp/nf-registry.html
@@ -74,6 +74,7 @@
             <div *ngIf="nfRegistryService.currentUser.identity && nfRegistryService.perspective !== 'login' && nfRegistryService.perspective !== 'not-found'" fxLayout="column" fxLayoutAlign="space-around end" class="push-right-sm">
                 <div id="current-user" matTooltip="{{nfRegistryService.currentUser.identity}}">{{nfRegistryService.currentUser.identity}}</div>
                 <a id="logout-link-container" *ngIf="nfRegistryService.currentUser.canLogout" class="link" (click)="logout()">logout</a>
+                <a id="logout-link-container" *ngIf="!nfRegistryService.currentUser.canLogout && nfRegistryService.currentUser.anonymous && nfRegistryService.currentUser.loginSupported" class="link" (click)="login()">login</a>
             </div>
             <div id="nifi-registry-documentation" *ngIf="nfRegistryService.perspective !== 'login'" class="pad-right-sm">
                 <a matTooltip="Help" href="{{nfRegistryService.documentation.link}}" target="_blank"><i class="fa fa-question-circle help-icon" aria-hidden="true"></i></a>
diff --git a/nifi-registry-core/nifi-registry-web-ui/src/main/webapp/nf-registry.js b/nifi-registry-core/nifi-registry-web-ui/src/main/webapp/nf-registry.js
index bea77d0..24702cf 100644
--- a/nifi-registry-core/nifi-registry-web-ui/src/main/webapp/nf-registry.js
+++ b/nifi-registry-core/nifi-registry-web-ui/src/main/webapp/nf-registry.js
@@ -75,6 +75,13 @@
         delete this.nfRegistryService.currentUser.anonymous;
         this.nfStorage.removeItem('jwt');
         this.router.navigateByUrl('/nifi-registry/login');
+    },
+
+    /**
+     * Navigate to login route.
+     */
+    login: function () {
+        this.router.navigateByUrl('/nifi-registry/login');
     }
 };
 
diff --git a/nifi-registry-core/nifi-registry-web-ui/src/main/webapp/services/nf-registry.api.js b/nifi-registry-core/nifi-registry-web-ui/src/main/webapp/services/nf-registry.api.js
index 28c79c1..2d2da8e 100644
--- a/nifi-registry-core/nifi-registry-web-ui/src/main/webapp/services/nf-registry.api.js
+++ b/nifi-registry-core/nifi-registry-web-ui/src/main/webapp/services/nf-registry.api.js
@@ -155,9 +155,9 @@
      * @param {string} name  The name of the bucket.
      * @returns {*}
      */
-    createBucket: function (name) {
+    createBucket: function (name, allowPublicRead) {
         var self = this;
-        return this.http.post('/nifi-registry-api/buckets', {'name': name}, headers)
+        return this.http.post('/nifi-registry-api/buckets', {'name': name, 'allowPublicRead': allowPublicRead}, headers)
             .map(function (response) {
                 return response;
             })
diff --git a/nifi-registry-core/nifi-registry-web-ui/src/main/webapp/services/nf-registry.api.spec.js b/nifi-registry-core/nifi-registry-web-ui/src/main/webapp/services/nf-registry.api.spec.js
index 2036eae..adf88ff 100644
--- a/nifi-registry-core/nifi-registry-web-ui/src/main/webapp/services/nf-registry.api.spec.js
+++ b/nifi-registry-core/nifi-registry-web-ui/src/main/webapp/services/nf-registry.api.spec.js
@@ -578,10 +578,13 @@
         nfRegistryApi.updateBucket({
             'identifier': '2f7f9e54-dc09-4ceb-aa58-9fe581319cdc',
             'name': 'Bucket #1',
-            'allowBundleRedeploy': false
+            'allowBundleRedeploy': true,
+            'allowPublicRead': true
         }).subscribe(function (response) {
             expect(response[0].identifier).toEqual('2f7f9e54-dc09-4ceb-aa58-9fe581319cdc');
             expect(response[0].name).toEqual('Bucket #1');
+            expect(response[0].allowBundleRedeploy).toEqual(true);
+            expect(response[0].allowPublicRead).toEqual(true);
         });
         // the request it made
         req = httpMock.expectOne('/nifi-registry-api/buckets/2f7f9e54-dc09-4ceb-aa58-9fe581319cdc');
@@ -590,7 +593,9 @@
         // Next, fulfill the request by transmitting a response.
         req.flush([{
             'identifier': '2f7f9e54-dc09-4ceb-aa58-9fe581319cdc',
-            'name': 'Bucket #1'
+            'name': 'Bucket #1',
+            'allowBundleRedeploy': true,
+            'allowPublicRead': true
         }]);
 
         // Finally, assert that there are no outstanding requests.
diff --git a/nifi-registry-core/nifi-registry-web-ui/src/main/webapp/services/nf-registry.auth-guard.service.js b/nifi-registry-core/nifi-registry-web-ui/src/main/webapp/services/nf-registry.auth-guard.service.js
index cc94c60..f003e80 100644
--- a/nifi-registry-core/nifi-registry-web-ui/src/main/webapp/services/nf-registry.auth-guard.service.js
+++ b/nifi-registry-core/nifi-registry-web-ui/src/main/webapp/services/nf-registry.auth-guard.service.js
@@ -96,8 +96,8 @@
                             });
                             self.router.navigateByUrl('/nifi-registry/explorer');
                         }
-                    } else {
-                        // registry security not configured, redirect to workflow perspective
+                    } else if (location.protocol === 'http:') {
+                        // user is anonymous and we are NOT secure, redirect to workflow perspective
                         self.dialogService.openConfirm({
                             title: 'Not Applicable',
                             message: 'User administration is not configured for this registry.',
@@ -105,6 +105,15 @@
                             acceptButtonColor: 'fds-warn'
                         });
                         self.router.navigateByUrl('/nifi-registry/administration/workflow');
+                    } else {
+                        // user is anonymous and we are secure so don't allow the url, navigate to the main page
+                        self.dialogService.openConfirm({
+                            title: 'Access denied',
+                            message: 'Please contact your system administrator.',
+                            acceptButton: 'Ok',
+                            acceptButtonColor: 'fds-warn'
+                        });
+                        self.router.navigateByUrl('/nifi-registry/explorer');
                     }
                 }
             });
@@ -155,7 +164,7 @@
 
     checkLogin: function (url) {
         var self = this;
-        if (this.nfRegistryService.currentUser.resourcePermissions.buckets.canRead || this.nfRegistryService.currentUser.anonymous) { return true; }
+        if (this.nfRegistryService.currentUser.resourcePermissions.buckets.canRead) { return true; }
 
         // Store the attempted URL for redirecting
         this.nfRegistryService.redirectUrl = url;
@@ -197,9 +206,18 @@
                             });
                             self.router.navigateByUrl('/nifi-registry/administration/users');
                         }
-                    } else {
-                        // registry security not configured, allow access to workflow perspective
+                    } else if (location.protocol === 'http:') {
+                        // user is anonymous and we are NOT secure so allow the url
                         self.router.navigateByUrl(url);
+                    } else {
+                        // user is anonymous and we are secure so don't allow the url, navigate to the main page
+                        self.dialogService.openConfirm({
+                            title: 'Access denied',
+                            message: 'Please contact your system administrator.',
+                            acceptButton: 'Ok',
+                            acceptButtonColor: 'fds-warn'
+                        });
+                        self.router.navigateByUrl('/nifi-registry/explorer');
                     }
                 }
             });
@@ -260,7 +278,7 @@
                     }
                     self.nfRegistryService.currentUser.canActivateResourcesAuthGuard = true;
                     self.router.navigateByUrl(self.nfRegistryService.redirectUrl);
-                } else if (self.nfRegistryService.currentUser.anonymous) {
+                } else if (self.nfRegistryService.currentUser.anonymous && !self.nfRegistryService.currentUser.loginSupported) {
                     self.router.navigateByUrl('/nifi-registry');
                 } else {
                     self.nfRegistryService.currentUser.anonymous = true;
diff --git a/nifi-registry-core/nifi-registry-web-ui/src/main/webapp/services/nf-registry.service.js b/nifi-registry-core/nifi-registry-web-ui/src/main/webapp/services/nf-registry.service.js
index 060c8dd..33c41cc 100644
--- a/nifi-registry-core/nifi-registry-web-ui/src/main/webapp/services/nf-registry.service.js
+++ b/nifi-registry-core/nifi-registry-web-ui/src/main/webapp/services/nf-registry.service.js
@@ -206,6 +206,7 @@
     this.breadCrumbState = 'out';
     this.explorerViewType = '';
     this.currentUser = {
+        loginSupported: false,
         resourcePermissions: {
             anyTopLevelResource: {
                 canRead: false,