diff --git a/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-api/src/main/java/org/apache/nifi/web/NiFiWebApiSecurityConfiguration.java b/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-api/src/main/java/org/apache/nifi/web/NiFiWebApiSecurityConfiguration.java
index c4e6304..359a03f 100644
--- a/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-api/src/main/java/org/apache/nifi/web/NiFiWebApiSecurityConfiguration.java
+++ b/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-api/src/main/java/org/apache/nifi/web/NiFiWebApiSecurityConfiguration.java
@@ -25,15 +25,11 @@
 import org.apache.nifi.web.security.knox.KnoxAuthenticationFilter;
 import org.apache.nifi.web.security.knox.KnoxAuthenticationProvider;
 import org.apache.nifi.web.security.oidc.OIDCEndpoints;
-import org.apache.nifi.web.security.otp.OtpAuthenticationFilter;
-import org.apache.nifi.web.security.otp.OtpAuthenticationProvider;
 import org.apache.nifi.web.security.saml.SAMLEndpoints;
 import org.apache.nifi.web.security.x509.X509AuthenticationFilter;
 import org.apache.nifi.web.security.x509.X509AuthenticationProvider;
 import org.apache.nifi.web.security.x509.X509CertificateExtractor;
 import org.apache.nifi.web.security.x509.X509IdentityProvider;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
@@ -63,8 +59,6 @@
 @EnableWebSecurity
 @EnableGlobalMethodSecurity(prePostEnabled = true)
 public class NiFiWebApiSecurityConfiguration extends WebSecurityConfigurerAdapter {
-    private static final Logger logger = LoggerFactory.getLogger(NiFiWebApiSecurityConfiguration.class);
-
     private NiFiProperties properties;
 
     private X509AuthenticationFilter x509AuthenticationFilter;
@@ -76,9 +70,6 @@
     private JwtAuthenticationFilter jwtAuthenticationFilter;
     private JwtAuthenticationProvider jwtAuthenticationProvider;
 
-    private OtpAuthenticationFilter otpAuthenticationFilter;
-    private OtpAuthenticationProvider otpAuthenticationProvider;
-
     private KnoxAuthenticationFilter knoxAuthenticationFilter;
     private KnoxAuthenticationProvider knoxAuthenticationProvider;
 
@@ -89,11 +80,13 @@
         super(true); // disable defaults
     }
 
+    /**
+     * Configure Web Security with ignoring matchers for authentication requests
+     *
+     * @param webSecurity Spring Web Security Configuration
+     */
     @Override
-    public void configure(WebSecurity webSecurity) throws Exception {
-        // ignore the access endpoints for obtaining the access config, the access token
-        // granting, and access status for a given user (note: we are not ignoring the
-        // the /access/download-token and /access/ui-extension-token endpoints
+    public void configure(final WebSecurity webSecurity) {
         webSecurity
                 .ignoring()
                     .antMatchers(
@@ -138,9 +131,6 @@
         // jwt
         http.addFilterBefore(jwtFilterBean(), AnonymousAuthenticationFilter.class);
 
-        // otp
-        http.addFilterBefore(otpFilterBean(), AnonymousAuthenticationFilter.class);
-
         // knox
         http.addFilterBefore(knoxFilterBean(), AnonymousAuthenticationFilter.class);
 
@@ -173,7 +163,6 @@
         auth
                 .authenticationProvider(x509AuthenticationProvider)
                 .authenticationProvider(jwtAuthenticationProvider)
-                .authenticationProvider(otpAuthenticationProvider)
                 .authenticationProvider(knoxAuthenticationProvider)
                 .authenticationProvider(anonymousAuthenticationProvider);
     }
@@ -189,16 +178,6 @@
     }
 
     @Bean
-    public OtpAuthenticationFilter otpFilterBean() throws Exception {
-        if (otpAuthenticationFilter == null) {
-            otpAuthenticationFilter = new OtpAuthenticationFilter();
-            otpAuthenticationFilter.setProperties(properties);
-            otpAuthenticationFilter.setAuthenticationManager(authenticationManager());
-        }
-        return otpAuthenticationFilter;
-    }
-
-    @Bean
     public KnoxAuthenticationFilter knoxFilterBean() throws Exception {
         if (knoxAuthenticationFilter == null) {
             knoxAuthenticationFilter = new KnoxAuthenticationFilter();
@@ -241,11 +220,6 @@
     }
 
     @Autowired
-    public void setOtpAuthenticationProvider(OtpAuthenticationProvider otpAuthenticationProvider) {
-        this.otpAuthenticationProvider = otpAuthenticationProvider;
-    }
-
-    @Autowired
     public void setKnoxAuthenticationProvider(KnoxAuthenticationProvider knoxAuthenticationProvider) {
         this.knoxAuthenticationProvider = knoxAuthenticationProvider;
     }
diff --git a/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-api/src/main/java/org/apache/nifi/web/api/AccessResource.java b/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-api/src/main/java/org/apache/nifi/web/api/AccessResource.java
index 6dd1c26..bc19f3f 100644
--- a/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-api/src/main/java/org/apache/nifi/web/api/AccessResource.java
+++ b/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-api/src/main/java/org/apache/nifi/web/api/AccessResource.java
@@ -51,10 +51,8 @@
 import org.apache.nifi.web.security.knox.KnoxService;
 import org.apache.nifi.web.security.logout.LogoutRequest;
 import org.apache.nifi.web.security.logout.LogoutRequestManager;
-import org.apache.nifi.web.security.otp.OtpService;
 import org.apache.nifi.web.security.token.LoginAuthenticationToken;
 import org.apache.nifi.web.security.token.NiFiAuthenticationToken;
-import org.apache.nifi.web.security.token.OtpAuthenticationToken;
 import org.apache.nifi.web.security.x509.X509AuthenticationProvider;
 import org.apache.nifi.web.security.x509.X509AuthenticationRequestToken;
 import org.apache.nifi.web.security.x509.X509CertificateExtractor;
@@ -106,7 +104,6 @@
     private LoginIdentityProvider loginIdentityProvider;
     private JwtAuthenticationProvider jwtAuthenticationProvider;
     private JwtService jwtService;
-    private OtpService otpService;
     private KnoxService knoxService;
     private KerberosService kerberosService;
     protected LogoutRequestManager logoutRequestManager;
@@ -311,96 +308,6 @@
     }
 
     /**
-     * Creates a single use access token for downloading FlowFile content.
-     *
-     * @param httpServletRequest the servlet request
-     * @return A token (string)
-     */
-    @POST
-    @Consumes(MediaType.APPLICATION_FORM_URLENCODED)
-    @Produces(MediaType.TEXT_PLAIN)
-    @Path("/download-token")
-    @ApiOperation(
-            value = "Creates a single use access token for downloading FlowFile content.",
-            notes = "The token returned is a base64 encoded string. It is valid for a single request up to five minutes from being issued. " +
-                    "It is used as a query parameter name 'access_token'.",
-            response = String.class
-    )
-    @ApiResponses(
-            value = {
-                    @ApiResponse(code = 403, message = "Client is not authorized to make this request."),
-                    @ApiResponse(code = 409, message = "Unable to create the download token because NiFi is not in the appropriate state. " +
-                            "(i.e. may not have any tokens to grant or be configured to support username/password login)"),
-                    @ApiResponse(code = 500, message = "Unable to create download token because an unexpected error occurred.")
-            }
-    )
-    public Response createDownloadToken(@Context HttpServletRequest httpServletRequest) {
-        // only support access tokens when communicating over HTTPS
-        if (!httpServletRequest.isSecure()) {
-            throw new IllegalStateException("Download tokens are only issued over HTTPS.");
-        }
-
-        final NiFiUser user = NiFiUserUtils.getNiFiUser();
-        if (user == null) {
-            throw new AccessDeniedException("No user authenticated in the request.");
-        }
-
-        final OtpAuthenticationToken authenticationToken = new OtpAuthenticationToken(user.getIdentity());
-
-        // generate otp for response
-        final String token = otpService.generateDownloadToken(authenticationToken);
-
-        // build the response
-        final URI uri = URI.create(generateResourceUri("access", "download-token"));
-        return generateCreatedResponse(uri, token).build();
-    }
-
-    /**
-     * Creates a single use access token for accessing a NiFi UI extension.
-     *
-     * @param httpServletRequest the servlet request
-     * @return A token (string)
-     */
-    @POST
-    @Consumes(MediaType.APPLICATION_FORM_URLENCODED)
-    @Produces(MediaType.TEXT_PLAIN)
-    @Path("/ui-extension-token")
-    @ApiOperation(
-            value = "Creates a single use access token for accessing a NiFi UI extension.",
-            notes = "The token returned is a base64 encoded string. It is valid for a single request up to five minutes from being issued. " +
-                    "It is used as a query parameter name 'access_token'.",
-            response = String.class
-    )
-    @ApiResponses(
-            value = {
-                    @ApiResponse(code = 403, message = "Client is not authorized to make this request."),
-                    @ApiResponse(code = 409, message = "Unable to create the download token because NiFi is not in the appropriate state. " +
-                            "(i.e. may not have any tokens to grant or be configured to support username/password login)"),
-                    @ApiResponse(code = 500, message = "Unable to create download token because an unexpected error occurred.")
-            }
-    )
-    public Response createUiExtensionToken(@Context HttpServletRequest httpServletRequest) {
-        // only support access tokens when communicating over HTTPS
-        if (!httpServletRequest.isSecure()) {
-            throw new AuthenticationNotSupportedException("UI extension access tokens are only issued over HTTPS.");
-        }
-
-        final NiFiUser user = NiFiUserUtils.getNiFiUser();
-        if (user == null) {
-            throw new AccessDeniedException("No user authenticated in the request.");
-        }
-
-        final OtpAuthenticationToken authenticationToken = new OtpAuthenticationToken(user.getIdentity());
-
-        // generate otp for response
-        final String token = otpService.generateUiExtensionToken(authenticationToken);
-
-        // build the response
-        final URI uri = URI.create(generateResourceUri("access", "ui-extension-token"));
-        return generateCreatedResponse(uri, token).build();
-    }
-
-    /**
      * Creates a token for accessing the REST API via Kerberos ticket exchange / SPNEGO negotiation.
      *
      * @param httpServletRequest the servlet request
@@ -705,10 +612,6 @@
         this.certificateExtractor = certificateExtractor;
     }
 
-    public void setOtpService(OtpService otpService) {
-        this.otpService = otpService;
-    }
-
     public void setKnoxService(KnoxService knoxService) {
         this.knoxService = knoxService;
     }
diff --git a/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-api/src/main/resources/nifi-web-api-context.xml b/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-api/src/main/resources/nifi-web-api-context.xml
index 7f678b5..1934239 100644
--- a/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-api/src/main/resources/nifi-web-api-context.xml
+++ b/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-api/src/main/resources/nifi-web-api-context.xml
@@ -583,7 +583,6 @@
         <property name="principalExtractor" ref="principalExtractor"/>
         <property name="jwtAuthenticationProvider" ref="jwtAuthenticationProvider"/>
         <property name="jwtService" ref="jwtService"/>
-        <property name="otpService" ref="otpService"/>
         <property name="kerberosService" ref="kerberosService"/>
         <property name="properties" ref="nifiProperties"/>
         <property name="clusterCoordinator" ref="clusterCoordinator"/>
diff --git a/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-content-viewer/src/main/webapp/WEB-INF/jsp/header.jsp b/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-content-viewer/src/main/webapp/WEB-INF/jsp/header.jsp
index 5f5210d..f7dbd66 100644
--- a/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-content-viewer/src/main/webapp/WEB-INF/jsp/header.jsp
+++ b/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-content-viewer/src/main/webapp/WEB-INF/jsp/header.jsp
@@ -107,38 +107,12 @@
 
                         // if the selection has changesd, reload the page
                         if (currentLocation !== option.value) {
-                            // get an access token if necessary
-                            var getAccessToken = $$.Deferred(function (deferred) {
-                                if (nf.Storage.hasItem('jwt')) {
-                                    $$.ajax({
-                                        type: 'POST',
-                                        url: '../nifi-api/access/ui-extension-token'
-                                    }).done(function (token) {
-                                        deferred.resolve(token);
-                                    }).fail(function () {
-                                        $$('#content-viewer-message').text('Unable to generate a token to view the content.');
-                                        $$('#content-viewer-message-dialog').modal('show');
-                                        deferred.reject();
-                                    })
-                                } else {
-                                    deferred.resolve('');
-                                }
-                            }).promise();
+                            var contentParameter = {
+                                mode: option.value
+                            };
 
-                            // reload as appropriate
-                            getAccessToken.done(function (uiExtensionToken) {
-                                var contentParameter = {
-                                    mode: option.value
-                                };
-
-                                // include the download token if applicable
-                                if (typeof uiExtensionToken !== 'undefined' && uiExtensionToken !== null && $$.trim(uiExtensionToken) !== '') {
-                                    contentParameter['access_token'] = uiExtensionToken;
-                                }
-
-                                var url = window.location.origin + window.location.pathname;
-                                window.location.href = url + '?' + $$.param($$.extend(contentParameter, params));
-                            });
+                            var url = window.location.origin + window.location.pathname;
+                            window.location.href = url + '?' + $$.param($$.extend(contentParameter, params));
                         }
                     }
                 });
diff --git a/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-security/src/main/java/org/apache/nifi/web/security/oidc/OidcService.java b/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-security/src/main/java/org/apache/nifi/web/security/oidc/OidcService.java
index 5502ab5..4ac2552 100644
--- a/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-security/src/main/java/org/apache/nifi/web/security/oidc/OidcService.java
+++ b/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-security/src/main/java/org/apache/nifi/web/security/oidc/OidcService.java
@@ -42,7 +42,7 @@
     private Cache<CacheKey, String> jwtLookupForCompletedRequests; // identifier from cookie -> jwt or identity (and generate jwt on retrieval)
 
     /**
-     * Creates a new OtpService with an expiration of 1 minute.
+     * Creates a new OIDC with an expiration of 1 minute.
      *
      * @param identityProvider          The identity provider
      */
@@ -51,7 +51,7 @@
     }
 
     /**
-     * Creates a new OtpService.
+     * Creates a new OIDC Service.
      *
      * @param identityProvider          The identity provider
      * @param duration                  The expiration duration
diff --git a/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-security/src/main/java/org/apache/nifi/web/security/otp/OtpAuthenticationException.java b/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-security/src/main/java/org/apache/nifi/web/security/otp/OtpAuthenticationException.java
deleted file mode 100644
index ee2d573..0000000
--- a/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-security/src/main/java/org/apache/nifi/web/security/otp/OtpAuthenticationException.java
+++ /dev/null
@@ -1,34 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one or more
- * contributor license agreements.  See the NOTICE file distributed with
- * this work for additional information regarding copyright ownership.
- * The ASF licenses this file to You under the Apache License, Version 2.0
- * (the "License"); you may not use this file except in compliance with
- * the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.nifi.web.security.otp;
-
-import org.springframework.security.core.AuthenticationException;
-
-/**
- * Thrown if a one time use token fails authentication.
- */
-public class OtpAuthenticationException extends AuthenticationException {
-
-    public OtpAuthenticationException(String msg) {
-        super(msg);
-    }
-
-    public OtpAuthenticationException(String msg, Throwable t) {
-        super(msg, t);
-    }
-
-}
diff --git a/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-security/src/main/java/org/apache/nifi/web/security/otp/OtpAuthenticationFilter.java b/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-security/src/main/java/org/apache/nifi/web/security/otp/OtpAuthenticationFilter.java
deleted file mode 100644
index c09a4bb..0000000
--- a/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-security/src/main/java/org/apache/nifi/web/security/otp/OtpAuthenticationFilter.java
+++ /dev/null
@@ -1,81 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one or more
- * contributor license agreements.  See the NOTICE file distributed with
- * this work for additional information regarding copyright ownership.
- * The ASF licenses this file to You under the Apache License, Version 2.0
- * (the "License"); you may not use this file except in compliance with
- * the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.nifi.web.security.otp;
-
-import java.util.regex.Pattern;
-import javax.servlet.http.HttpServletRequest;
-import org.apache.nifi.web.security.NiFiAuthenticationFilter;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-import org.springframework.security.core.Authentication;
-
-/**
- * This filter is used to capture one time passwords (OTP) from requests made to download files through the browser.
- * It's required because when we initiate a download in the browser, it must be opened in a new tab. The new tab
- * cannot be initialized with authentication headers, so we must add a token as a query parameter instead. As
- * tokens in URL strings are visible in various places, this must only be used once - hence our OTP.
- */
-public class OtpAuthenticationFilter extends NiFiAuthenticationFilter {
-
-    private static final Logger logger = LoggerFactory.getLogger(OtpAuthenticationFilter.class);
-
-    private static final Pattern PROVENANCE_DOWNLOAD_PATTERN =
-        Pattern.compile("/provenance-events/([0-9]+)/content/((?:input)|(?:output))");
-    private static final Pattern QUEUE_DOWNLOAD_PATTERN =
-        Pattern.compile("/flowfile-queues/([a-f0-9\\-]{36})/flowfiles/([a-f0-9\\-]{36})/content");
-    private static final Pattern TEMPLATE_DOWNLOAD_PATTERN =
-        Pattern.compile("/templates/[a-f0-9\\-]{36}/download");
-    private static final Pattern FLOW_DOWNLOAD_PATTERN =
-        Pattern.compile("/process-groups/[a-f0-9\\-]{36}/download");
-
-    protected static final String ACCESS_TOKEN = "access_token";
-
-    @Override
-    public Authentication attemptAuthentication(final HttpServletRequest request) {
-        // only support otp login when running securely
-        if (!request.isSecure()) {
-            return null;
-        }
-
-        // get the accessToken out of the query string
-        final String accessToken = request.getParameter(ACCESS_TOKEN);
-
-        // if there is no authorization header, we don't know the user
-        if (accessToken == null) {
-            return null;
-        } else {
-            if (request.getContextPath().equals("/nifi-api")) {
-                if (isDownloadRequest(request.getPathInfo())) {
-                    // handle download requests
-                    return new OtpAuthenticationRequestToken(accessToken, true, request.getRemoteAddr());
-                }
-            } else {
-                // handle requests to other context paths (other UI extensions)
-                return new OtpAuthenticationRequestToken(accessToken, false, request.getRemoteAddr());
-            }
-
-            // the path is a support path for otp tokens
-            return null;
-        }
-    }
-
-    private boolean isDownloadRequest(final String pathInfo) {
-        return PROVENANCE_DOWNLOAD_PATTERN.matcher(pathInfo).matches() || QUEUE_DOWNLOAD_PATTERN.matcher(pathInfo).matches()
-                || TEMPLATE_DOWNLOAD_PATTERN.matcher(pathInfo).matches() || FLOW_DOWNLOAD_PATTERN.matcher(pathInfo).matches();
-    }
-
-}
diff --git a/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-security/src/main/java/org/apache/nifi/web/security/otp/OtpAuthenticationProvider.java b/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-security/src/main/java/org/apache/nifi/web/security/otp/OtpAuthenticationProvider.java
deleted file mode 100644
index 0b89b4b..0000000
--- a/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-security/src/main/java/org/apache/nifi/web/security/otp/OtpAuthenticationProvider.java
+++ /dev/null
@@ -1,87 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one or more
- * contributor license agreements.  See the NOTICE file distributed with
- * this work for additional information regarding copyright ownership.
- * The ASF licenses this file to You under the Apache License, Version 2.0
- * (the "License"); you may not use this file except in compliance with
- * the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.nifi.web.security.otp;
-
-import org.apache.nifi.admin.service.IdpUserGroupService;
-import org.apache.nifi.authorization.Authorizer;
-import org.apache.nifi.authorization.user.NiFiUser;
-import org.apache.nifi.authorization.user.NiFiUserDetails;
-import org.apache.nifi.authorization.user.StandardNiFiUser.Builder;
-import org.apache.nifi.util.NiFiProperties;
-import org.apache.nifi.web.security.InvalidAuthenticationException;
-import org.apache.nifi.web.security.NiFiAuthenticationProvider;
-import org.apache.nifi.web.security.token.NiFiAuthenticationToken;
-import org.springframework.security.core.Authentication;
-import org.springframework.security.core.AuthenticationException;
-
-import java.util.Set;
-import java.util.stream.Collectors;
-
-/**
- * This provider will be used when the request is attempting to authenticate with a download or ui extension OTP/token.
- */
-public class OtpAuthenticationProvider extends NiFiAuthenticationProvider {
-
-    private OtpService otpService;
-    private final IdpUserGroupService idpUserGroupService;
-
-    public OtpAuthenticationProvider(OtpService otpService, NiFiProperties nifiProperties, Authorizer authorizer, IdpUserGroupService idpUserGroupService) {
-        super(nifiProperties, authorizer);
-        this.otpService = otpService;
-        this.idpUserGroupService = idpUserGroupService;
-    }
-
-    @Override
-    public Authentication authenticate(Authentication authentication) throws AuthenticationException {
-        final OtpAuthenticationRequestToken request = (OtpAuthenticationRequestToken) authentication;
-
-        try {
-            final String otpPrincipal;
-            if (request.isDownloadToken()) {
-                otpPrincipal = otpService.getAuthenticationFromDownloadToken(request.getToken());
-            } else {
-                otpPrincipal = otpService.getAuthenticationFromUiExtensionToken(request.getToken());
-            }
-            final String mappedIdentity = mapIdentity(otpPrincipal);
-            final Set<String> userGroupProviderGroups = getUserGroups(mappedIdentity);
-            final Set<String> idpUserGroups = getIdpUserGroups(mappedIdentity);
-
-            final NiFiUser user = new Builder()
-                    .identity(mappedIdentity)
-                    .groups(userGroupProviderGroups)
-                    .identityProviderGroups(idpUserGroups)
-                    .clientAddress(request.getClientAddress())
-                    .build();
-
-            return new NiFiAuthenticationToken(new NiFiUserDetails(user));
-        } catch (OtpAuthenticationException e) {
-            throw new InvalidAuthenticationException(e.getMessage(), e);
-        }
-    }
-
-    @Override
-    public boolean supports(Class<?> authentication) {
-        return OtpAuthenticationRequestToken.class.isAssignableFrom(authentication);
-    }
-
-    private Set<String> getIdpUserGroups(final String mappedIdentity) {
-        return idpUserGroupService.getUserGroups(mappedIdentity).stream()
-                .map(ug -> ug.getGroupName())
-                .collect(Collectors.toSet());
-    }
-
-}
diff --git a/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-security/src/main/java/org/apache/nifi/web/security/otp/OtpAuthenticationRequestToken.java b/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-security/src/main/java/org/apache/nifi/web/security/otp/OtpAuthenticationRequestToken.java
deleted file mode 100644
index bad7c94..0000000
--- a/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-security/src/main/java/org/apache/nifi/web/security/otp/OtpAuthenticationRequestToken.java
+++ /dev/null
@@ -1,66 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one or more
- * contributor license agreements.  See the NOTICE file distributed with
- * this work for additional information regarding copyright ownership.
- * The ASF licenses this file to You under the Apache License, Version 2.0
- * (the "License"); you may not use this file except in compliance with
- * the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.nifi.web.security.otp;
-
-import org.apache.nifi.web.security.NiFiAuthenticationRequestToken;
-
-/**
- * This is an authentication request with a given OTP token.
- */
-public class OtpAuthenticationRequestToken extends NiFiAuthenticationRequestToken {
-
-    private final String token;
-    private final boolean isDownloadToken;
-
-    /**
-     * Creates a representation of the otp authentication request for a user.
-     *
-     * @param token   The unique token for this user
-     * @param isDownloadToken Whether or not this represents a download token
-     * @param clientAddress the address of the client making the request
-     */
-    public OtpAuthenticationRequestToken(final String token, final boolean isDownloadToken, final String clientAddress) {
-        super(clientAddress);
-        setAuthenticated(false);
-        this.token = token;
-        this.isDownloadToken = isDownloadToken;
-    }
-
-    @Override
-    public Object getCredentials() {
-        return null;
-    }
-
-    @Override
-    public Object getPrincipal() {
-        return token;
-    }
-
-    public String getToken() {
-        return token;
-    }
-
-    public boolean isDownloadToken() {
-        return isDownloadToken;
-    }
-
-    @Override
-    public String toString() {
-        return "<OTP token>";
-    }
-
-}
diff --git a/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-security/src/main/java/org/apache/nifi/web/security/otp/OtpService.java b/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-security/src/main/java/org/apache/nifi/web/security/otp/OtpService.java
deleted file mode 100644
index e8d96ae..0000000
--- a/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-security/src/main/java/org/apache/nifi/web/security/otp/OtpService.java
+++ /dev/null
@@ -1,190 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one or more
- * contributor license agreements.  See the NOTICE file distributed with
- * this work for additional information regarding copyright ownership.
- * The ASF licenses this file to You under the Apache License, Version 2.0
- * (the "License"); you may not use this file except in compliance with
- * the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.nifi.web.security.otp;
-
-import java.nio.charset.StandardCharsets;
-import java.security.InvalidKeyException;
-import java.security.NoSuchAlgorithmException;
-import java.security.SecureRandom;
-import java.util.concurrent.TimeUnit;
-import javax.crypto.Mac;
-import javax.crypto.spec.SecretKeySpec;
-import org.apache.commons.codec.binary.Base64;
-import org.apache.nifi.web.security.token.OtpAuthenticationToken;
-import org.apache.nifi.web.security.util.CacheKey;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-/**
- * OtpService is a service for generating and verifying one time password tokens.
- */
-public class OtpService {
-
-    private static final Logger logger = LoggerFactory.getLogger(OtpService.class);
-
-    private static final String HMAC_SHA256 = "HmacSHA256";
-
-    // protected for testing purposes
-    protected static final int MAX_CACHE_SOFT_LIMIT = 100;
-
-    private final TokenCache downloadTokens;
-    private final TokenCache uiExtensionTokens;
-
-    /**
-     * Creates a new OtpService with an expiration of 5 minutes.
-     */
-    public OtpService() {
-        this(5, TimeUnit.MINUTES);
-    }
-
-    /**
-     * Creates a new OtpService.
-     *
-     * @param duration                  The expiration duration
-     * @param units                     The expiration units
-     * @throws NullPointerException     If units is null
-     * @throws IllegalArgumentException If duration is negative
-     */
-    public OtpService(final int duration, final TimeUnit units) {
-        downloadTokens = new TokenCache("download tokens", duration, units);
-        uiExtensionTokens = new TokenCache("UI extension tokens", duration, units);
-    }
-
-    /**
-     * Generates a download token for the specified authentication.
-     *
-     * @param authenticationToken       The authentication
-     * @return                          The one time use download token
-     */
-    public String generateDownloadToken(final OtpAuthenticationToken authenticationToken) {
-        return generateToken(downloadTokens, authenticationToken);
-    }
-
-    /**
-     * Gets the authenticated identity from the specified one time use download token. This method will not return null.
-     *
-     * @param token                     The one time use download token
-     * @return                          The authenticated identity
-     * @throws OtpAuthenticationException   When the specified token does not correspond to an authenticated identity
-     */
-    public String getAuthenticationFromDownloadToken(final String token) throws OtpAuthenticationException {
-        return getAuthenticationFromToken(downloadTokens, token);
-    }
-
-    /**
-     * Generates a UI extension token for the specified authentication.
-     *
-     * @param authenticationToken       The authentication
-     * @return                          The one time use UI extension token
-     */
-    public String generateUiExtensionToken(final OtpAuthenticationToken authenticationToken) {
-        return generateToken(uiExtensionTokens, authenticationToken);
-    }
-
-    /**
-     * Gets the authenticated identity from the specified one time use UI extension token. This method will not return null.
-     *
-     * @param token                     The one time use UI extension token
-     * @return                          The authenticated identity
-     * @throws OtpAuthenticationException   When the specified token does not correspond to an authenticated identity
-     */
-    public String getAuthenticationFromUiExtensionToken(final String token) throws OtpAuthenticationException {
-        return getAuthenticationFromToken(uiExtensionTokens, token);
-    }
-
-    /**
-     * Generates a token and stores it in the specified cache.
-     *
-     * @param tokenCache                A cache that maps tokens to users
-     * @param authenticationToken       The authentication
-     * @return                          The one time use token
-     */
-    private String generateToken(final TokenCache tokenCache, final OtpAuthenticationToken authenticationToken) {
-        final String userId = (String) authenticationToken.getPrincipal();
-
-        // If the user has a token already, return it
-        if(tokenCache.containsValue(userId)) {
-            return (tokenCache.getKeyForValue(userId)).getKey();
-        } else {
-            // Otherwise, generate a token
-            if (tokenCache.size() >= MAX_CACHE_SOFT_LIMIT) {
-                throw new IllegalStateException("The maximum number of single use tokens have been issued.");
-            }
-
-            // Hash the authentication and build a cache key
-            final CacheKey cacheKey = new CacheKey(hash(authenticationToken));
-
-            // Store the token and user in the cache
-            tokenCache.put(cacheKey, userId);
-
-            // Return the token
-            return cacheKey.getKey();
-        }
-    }
-
-    /**
-     * Gets the corresponding authentication for the specified one time use token. The specified token will be removed
-     * from the token cache.
-     *
-     * @param tokenCache                A cache that maps tokens to users
-     * @param token                     The one time use token
-     * @return                          The authenticated identity
-     */
-    private String getAuthenticationFromToken(final TokenCache tokenCache, final String token) throws OtpAuthenticationException {
-        final CacheKey cacheKey = new CacheKey(token);
-        final String authenticatedUser = (String) tokenCache.getIfPresent(cacheKey);
-
-        if (authenticatedUser == null) {
-            throw new OtpAuthenticationException("Unable to validate the access token.");
-        } else {
-            tokenCache.invalidate(cacheKey);
-        }
-
-        return authenticatedUser;
-    }
-
-    /**
-     * Hashes the specified authentication token. The resulting value will be used as the one time use token.
-     *
-     * @param authenticationToken   the authentication token
-     * @return                      the one time use token
-     */
-    private String hash(final OtpAuthenticationToken authenticationToken) {
-        try {
-            // input is the user identity and timestamp
-            final String input = authenticationToken.getName() + "-" + System.nanoTime();
-
-            // create the secret using secure random
-            final SecureRandom secureRandom = new SecureRandom();
-            final byte[] randomBytes = new byte[32];
-            secureRandom.nextBytes(randomBytes);
-            final SecretKeySpec secret = new SecretKeySpec(randomBytes, HMAC_SHA256); // 256 bit
-
-            // hash the input
-            final Mac hmacSha256 = Mac.getInstance(HMAC_SHA256);
-            hmacSha256.init(secret);
-            final byte[] output = hmacSha256.doFinal(input.getBytes(StandardCharsets.UTF_8));
-
-            // return the result as a base 64 string
-            return Base64.encodeBase64URLSafeString(output);
-        } catch (final NoSuchAlgorithmException | InvalidKeyException e) {
-            final String errorMessage = "There was an error generating the OTP";
-            logger.error(errorMessage, e);
-            throw new IllegalStateException("Unable to generate single use token.");
-        }
-    }
-}
diff --git a/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-security/src/main/java/org/apache/nifi/web/security/otp/TokenCache.java b/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-security/src/main/java/org/apache/nifi/web/security/otp/TokenCache.java
deleted file mode 100644
index a19efe2..0000000
--- a/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-security/src/main/java/org/apache/nifi/web/security/otp/TokenCache.java
+++ /dev/null
@@ -1,144 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one or more
- * contributor license agreements.  See the NOTICE file distributed with
- * this work for additional information regarding copyright ownership.
- * The ASF licenses this file to You under the Apache License, Version 2.0
- * (the "License"); you may not use this file except in compliance with
- * the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.nifi.web.security.otp;
-
-import com.google.common.cache.AbstractCache;
-import com.google.common.cache.Cache;
-import com.google.common.cache.CacheBuilder;
-import com.google.common.cache.CacheStats;
-import java.util.Map;
-import java.util.concurrent.ConcurrentMap;
-import java.util.concurrent.TimeUnit;
-import org.apache.nifi.web.security.util.CacheKey;
-import org.checkerframework.checker.nullness.qual.Nullable;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-/**
- * This class provides a specific wrapper implementation based on the Guava {@link Cache} but with
- * reverse-index capability because of the special use case (a user [the cache value] can only have
- * one active token [the cache key] at a time). This allows reverse lookup semantics.
- */
-public class TokenCache extends AbstractCache<CacheKey, String> {
-    private static final Logger logger = LoggerFactory.getLogger(TokenCache.class);
-
-    private final String contentsDescription;
-    private final Cache<CacheKey, String> internalCache;
-
-    public TokenCache(String contentsDescription, final int duration, final TimeUnit units) {
-        this.contentsDescription = contentsDescription;
-        internalCache = CacheBuilder.newBuilder().expireAfterWrite(duration, units).build();
-    }
-
-    /**
-     * Returns the value associated with {@code key} in this cache, or {@code null} if there is no
-     * cached value for {@code key}.
-     *
-     * @param key the (wrapped) {@code token}
-     * @since 11.0
-     * @return the retrieved value ({@code user})
-     */
-    @Override
-    public @Nullable String getIfPresent(Object key) {
-        return internalCache.getIfPresent(key);
-    }
-
-    /**
-     * Puts the provided value ({@code user}) in the cache at the provided key (wrapped {@code token}).
-     *
-     * @param key the cache key
-     * @param value the value to insert
-     * @since 11.0
-     */
-    @Override
-    public void put(CacheKey key, String value) {
-            internalCache.put(key, value);
-    }
-
-    /**
-     * Returns {@code true} if the cache contains the provided value.
-     *
-     * @param value the value ({@code user}) to look for
-     * @return true if the user exists in the cache
-     */
-    public boolean containsValue(String value) {
-        return internalCache.asMap().containsValue(value);
-    }
-
-    /**
-     * Returns the {@link CacheKey} representing the key ({@code token}) associated with the provided value ({@code user}).
-     *
-     * @param value the value ({@code user}) to look for
-     * @return the CacheKey ({@code token}) associated with this user, or {@code null} if the user has no tokens in this cache
-     */
-    @Nullable
-    public CacheKey getKeyForValue(String value) {
-        if (containsValue(value)) {
-            Map<CacheKey, String> cacheMap = internalCache.asMap();
-            for (Map.Entry<CacheKey, String> e : cacheMap.entrySet()) {
-                if (e.getValue().equals(value)) {
-                    return e.getKey();
-                }
-            }
-            throw new IllegalStateException("The value existed in the cache but expired during retrieval");
-        } else {
-            return null;
-        }
-    }
-
-    // Override the unsupported abstract methods from the parent
-
-    @Override
-    public void invalidate(Object key) {
-        internalCache.invalidate(key);
-    }
-
-    @Override
-    public void invalidateAll() {
-        internalCache.invalidateAll(internalCache.asMap().keySet());
-    }
-
-    @Override
-    public long size() {
-        return internalCache.size();
-    }
-
-    @Override
-    public CacheStats stats() {
-        return internalCache.stats();
-    }
-
-    @Override
-    public ConcurrentMap<CacheKey, String> asMap() {
-        return internalCache.asMap();
-    }
-
-    /**
-     * Returns a string representation of the cache.
-     *
-     * @return a string representation of the cache
-     */
-    @Override
-    public String toString() {
-        return new StringBuilder("TokenCache for ")
-                .append(contentsDescription)
-                .append(" with ")
-                .append(internalCache.size())
-                .append(" elements")
-                .toString();
-    }
-}
diff --git a/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-security/src/main/java/org/apache/nifi/web/security/token/OtpAuthenticationToken.java b/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-security/src/main/java/org/apache/nifi/web/security/token/OtpAuthenticationToken.java
deleted file mode 100644
index fc51912..0000000
--- a/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-security/src/main/java/org/apache/nifi/web/security/token/OtpAuthenticationToken.java
+++ /dev/null
@@ -1,56 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one or more
- * contributor license agreements.  See the NOTICE file distributed with
- * this work for additional information regarding copyright ownership.
- * The ASF licenses this file to You under the Apache License, Version 2.0
- * (the "License"); you may not use this file except in compliance with
- * the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.nifi.web.security.token;
-
-import org.springframework.security.authentication.AbstractAuthenticationToken;
-
-/**
- * This is an Authentication Token for logging in. Once a user is authenticated, they can be issued an ID token.
- */
-public class OtpAuthenticationToken extends AbstractAuthenticationToken {
-
-    private final String identity;
-
-    /**
-     * Creates a representation of the otp authentication token for a user.
-     *
-     * @param identity   The unique identifier for this user
-     */
-    public OtpAuthenticationToken(final String identity) {
-        super(null);
-        setAuthenticated(true);
-        this.identity = identity;
-    }
-
-    @Override
-    public Object getCredentials() {
-        return null;
-    }
-
-    @Override
-    public Object getPrincipal() {
-        return identity;
-    }
-
-    @Override
-    public String toString() {
-        return new StringBuilder("OtpAuthenticationToken for ")
-                .append(getName())
-                .toString();
-    }
-
-}
diff --git a/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-security/src/main/resources/nifi-web-security-context.xml b/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-security/src/main/resources/nifi-web-security-context.xml
index 0405dc5..fe9d59f 100644
--- a/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-security/src/main/resources/nifi-web-security-context.xml
+++ b/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-security/src/main/resources/nifi-web-security-context.xml
@@ -39,7 +39,7 @@
         <property name="certificateValidator" ref="certificateValidator"/>
     </bean>
 
-    <!-- otp authentication provider -->
+    <!-- x509 authentication provider -->
     <bean id="x509AuthenticationProvider" class="org.apache.nifi.web.security.x509.X509AuthenticationProvider">
         <constructor-arg ref="certificateIdentityProvider" index="0"/>
         <constructor-arg ref="authorizer" index="1"/>
@@ -59,17 +59,6 @@
         <constructor-arg ref="idpUserGroupService" index="3"/>
     </bean>
 
-    <!-- otp service -->
-    <bean id="otpService" class="org.apache.nifi.web.security.otp.OtpService"/>
-
-    <!-- otp authentication provider -->
-    <bean id="otpAuthenticationProvider" class="org.apache.nifi.web.security.otp.OtpAuthenticationProvider">
-        <constructor-arg ref="otpService" index="0"/>
-        <constructor-arg ref="nifiProperties" index="1"/>
-        <constructor-arg ref="authorizer" index="2"/>
-        <constructor-arg ref="idpUserGroupService" index="3"/>
-    </bean>
-
     <!-- knox service -->
     <bean id="knoxService" class="org.apache.nifi.web.security.knox.KnoxServiceFactoryBean">
         <property name="properties" ref="nifiProperties"/>
diff --git a/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-security/src/test/groovy/org/apache/nifi/web/security/otp/TokenCacheTest.groovy b/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-security/src/test/groovy/org/apache/nifi/web/security/otp/TokenCacheTest.groovy
deleted file mode 100644
index 64f8b6e..0000000
--- a/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-security/src/test/groovy/org/apache/nifi/web/security/otp/TokenCacheTest.groovy
+++ /dev/null
@@ -1,249 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one or more
- * contributor license agreements.  See the NOTICE file distributed with
- * this work for additional information regarding copyright ownership.
- * The ASF licenses this file to You under the Apache License, Version 2.0
- * (the "License"); you may not use this file except in compliance with
- * the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.nifi.web.security.otp
-
-
-import org.apache.nifi.web.security.token.OtpAuthenticationToken
-import org.apache.nifi.web.security.util.CacheKey
-import org.bouncycastle.jce.provider.BouncyCastleProvider
-import org.junit.After
-import org.junit.Before
-import org.junit.BeforeClass
-import org.junit.Test
-import org.junit.runner.RunWith
-import org.junit.runners.JUnit4
-import org.slf4j.Logger
-import org.slf4j.LoggerFactory
-
-import java.security.Security
-import java.util.concurrent.TimeUnit
-
-@RunWith(JUnit4.class)
-class TokenCacheTest extends GroovyTestCase {
-    private static final Logger logger = LoggerFactory.getLogger(TokenCache.class)
-
-    private static final String andy = "alopresto"
-    private static final String nathan = "ngough"
-    private static final String matt = "mgilman"
-
-    private static final int LONG_CACHE_EXPIRATION = 10
-    private static final int SHORT_CACHE_EXPIRATION = 1
-
-    @BeforeClass
-    static void setUpOnce() throws Exception {
-        Security.addProvider(new BouncyCastleProvider())
-
-        logger.metaClass.methodMissing = { String name, args ->
-            logger.info("[${name?.toUpperCase()}] ${(args as List).join(" ")}")
-        }
-    }
-
-    @Before
-    void setUp() throws Exception {
-
-    }
-
-    @After
-    void tearDown() throws Exception {
-
-    }
-
-    /**
-     * Returns a simple "hash" of the provided principal (for test purposes, simply reverses the String).
-     *
-     * @param principal the token principal
-     * @return the hashed token output
-     */
-    private static String hash(def principal) {
-        principal.toString().reverse()
-    }
-
-    /**
-     * Returns the {@link CacheKey} constructed from the provided token.
-     *
-     * @param token the authentication token
-     * @return the cache key
-     */
-    private static CacheKey buildCacheKey(OtpAuthenticationToken token) {
-        new CacheKey(hash(token.principal))
-    }
-
-    @Test
-    void testShouldCheckIfContainsValue() throws Exception {
-        // Arrange
-        TokenCache tokenCache = new TokenCache("test tokens", LONG_CACHE_EXPIRATION, TimeUnit.SECONDS)
-
-        OtpAuthenticationToken andyToken = new OtpAuthenticationToken(andy)
-        OtpAuthenticationToken nathanToken = new OtpAuthenticationToken(nathan)
-
-        tokenCache.put(buildCacheKey(andyToken), andy)
-        tokenCache.put(buildCacheKey(nathanToken), nathan)
-
-        logger.info(tokenCache.toString())
-
-        // Act
-        boolean containsAndyToken = tokenCache.containsValue(andy)
-        boolean containsNathanToken = tokenCache.containsValue(nathan)
-        boolean containsMattToken = tokenCache.containsValue(matt)
-
-        // Assert
-        assert containsAndyToken
-        assert containsNathanToken
-        assert !containsMattToken
-    }
-
-    @Test
-    void testShouldGetKeyByValue() throws Exception {
-        // Arrange
-        TokenCache tokenCache = new TokenCache("test tokens", LONG_CACHE_EXPIRATION, TimeUnit.SECONDS)
-
-        OtpAuthenticationToken andyToken = new OtpAuthenticationToken(andy)
-        OtpAuthenticationToken nathanToken = new OtpAuthenticationToken(nathan)
-
-        tokenCache.put(buildCacheKey(andyToken), andy)
-        tokenCache.put(buildCacheKey(nathanToken), nathan)
-
-        logger.info(tokenCache.toString())
-
-        // Act
-        CacheKey keyForAndyToken = tokenCache.getKeyForValue(andy)
-        CacheKey keyForNathanToken = tokenCache.getKeyForValue(nathan)
-        CacheKey keyForMattToken = tokenCache.getKeyForValue(matt)
-
-        def tokens = [keyForAndyToken, keyForNathanToken, keyForMattToken]
-        logger.info("Retrieved tokens: ${tokens}")
-
-        // Assert
-        assert keyForAndyToken.getKey() == hash(andyToken.principal)
-        assert keyForNathanToken.getKey() == hash(nathanToken.principal)
-        assert !keyForMattToken
-    }
-
-    @Test
-    void testShouldNotGetKeyByValueAfterExpiration() throws Exception {
-        // Arrange
-        TokenCache tokenCache = new TokenCache("test tokens", SHORT_CACHE_EXPIRATION, TimeUnit.SECONDS)
-
-        OtpAuthenticationToken andyToken = new OtpAuthenticationToken(andy)
-        OtpAuthenticationToken nathanToken = new OtpAuthenticationToken(nathan)
-
-        tokenCache.put(buildCacheKey(andyToken), andy)
-        tokenCache.put(buildCacheKey(nathanToken), nathan)
-
-        logger.info(tokenCache.toString())
-
-        // Sleep to allow the cache entries to expire (was failing on Windows JDK 8 when only sleeping for 1 second)
-        sleep(SHORT_CACHE_EXPIRATION * 2 * 1000)
-
-        // Act
-        CacheKey keyForAndyToken = tokenCache.getKeyForValue(andy)
-        CacheKey keyForNathanToken = tokenCache.getKeyForValue(nathan)
-        CacheKey keyForMattToken = tokenCache.getKeyForValue(matt)
-
-        def tokens = [keyForAndyToken, keyForNathanToken, keyForMattToken]
-        logger.info("Retrieved tokens: ${tokens}")
-
-        // Assert
-        assert !keyForAndyToken
-        assert !keyForNathanToken
-        assert !keyForMattToken
-    }
-
-    @Test
-    void testShouldInvalidateSingleKey() throws Exception {
-        // Arrange
-        TokenCache tokenCache = new TokenCache("test tokens", LONG_CACHE_EXPIRATION, TimeUnit.SECONDS)
-
-        OtpAuthenticationToken andyToken = new OtpAuthenticationToken(andy)
-        OtpAuthenticationToken nathanToken = new OtpAuthenticationToken(nathan)
-        OtpAuthenticationToken mattToken = new OtpAuthenticationToken(matt)
-
-        CacheKey andyKey = buildCacheKey(andyToken)
-        CacheKey nathanKey = buildCacheKey(nathanToken)
-        CacheKey mattKey = buildCacheKey(mattToken)
-
-        tokenCache.put(andyKey, andy)
-        tokenCache.put(nathanKey, nathan)
-        tokenCache.put(mattKey, matt)
-
-        logger.info(tokenCache.toString())
-
-        // Act
-        tokenCache.invalidate(andyKey)
-
-        // Assert
-        assert !tokenCache.containsValue(andy)
-        assert tokenCache.containsValue(nathan)
-        assert tokenCache.containsValue(matt)
-    }
-
-    @Test
-    void testShouldInvalidateMultipleKeys() throws Exception {
-        // Arrange
-        TokenCache tokenCache = new TokenCache("test tokens", LONG_CACHE_EXPIRATION, TimeUnit.SECONDS)
-
-        OtpAuthenticationToken andyToken = new OtpAuthenticationToken(andy)
-        OtpAuthenticationToken nathanToken = new OtpAuthenticationToken(nathan)
-        OtpAuthenticationToken mattToken = new OtpAuthenticationToken(matt)
-
-        CacheKey andyKey = buildCacheKey(andyToken)
-        CacheKey nathanKey = buildCacheKey(nathanToken)
-        CacheKey mattKey = buildCacheKey(mattToken)
-
-        tokenCache.put(andyKey, andy)
-        tokenCache.put(nathanKey, nathan)
-        tokenCache.put(mattKey, matt)
-
-        logger.info(tokenCache.toString())
-
-        // Act
-        tokenCache.invalidateAll([andyKey, nathanKey])
-
-        // Assert
-        assert !tokenCache.containsValue(andy)
-        assert !tokenCache.containsValue(nathan)
-        assert tokenCache.containsValue(matt)
-    }
-
-    @Test
-    void testShouldInvalidateAll() throws Exception {
-        // Arrange
-        TokenCache tokenCache = new TokenCache("test tokens", LONG_CACHE_EXPIRATION, TimeUnit.SECONDS)
-
-        OtpAuthenticationToken andyToken = new OtpAuthenticationToken(andy)
-        OtpAuthenticationToken nathanToken = new OtpAuthenticationToken(nathan)
-        OtpAuthenticationToken mattToken = new OtpAuthenticationToken(matt)
-
-        CacheKey andyKey = buildCacheKey(andyToken)
-        CacheKey nathanKey = buildCacheKey(nathanToken)
-        CacheKey mattKey = buildCacheKey(mattToken)
-
-        tokenCache.put(andyKey, andy)
-        tokenCache.put(nathanKey, nathan)
-        tokenCache.put(mattKey, matt)
-
-        logger.info(tokenCache.toString())
-
-        // Act
-        tokenCache.invalidateAll()
-
-        // Assert
-        assert !tokenCache.containsValue(andy)
-        assert !tokenCache.containsValue(nathan)
-        assert !tokenCache.containsValue(matt)
-    }
-}
diff --git a/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-security/src/test/java/org/apache/nifi/web/security/otp/OtpAuthenticationFilterTest.java b/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-security/src/test/java/org/apache/nifi/web/security/otp/OtpAuthenticationFilterTest.java
deleted file mode 100644
index 8027b8f..0000000
--- a/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-security/src/test/java/org/apache/nifi/web/security/otp/OtpAuthenticationFilterTest.java
+++ /dev/null
@@ -1,141 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one or more
- * contributor license agreements.  See the NOTICE file distributed with
- * this work for additional information regarding copyright ownership.
- * The ASF licenses this file to You under the Apache License, Version 2.0
- * (the "License"); you may not use this file except in compliance with
- * the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.nifi.web.security.otp;
-
-import org.junit.Before;
-import org.junit.Test;
-
-import javax.servlet.http.HttpServletRequest;
-import java.util.UUID;
-
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertNull;
-import static org.junit.Assert.assertTrue;
-import static org.mockito.Mockito.mock;
-import static org.mockito.Mockito.when;
-
-public class OtpAuthenticationFilterTest {
-
-    private final static String UI_EXTENSION_AUTHENTICATED_USER = "ui-extension-token-authenticated-user";
-    private final static String UI_EXTENSION_TOKEN = "ui-extension-token";
-
-    private final static String DOWNLOAD_AUTHENTICATED_USER = "download-token-authenticated-user";
-    private final static String DOWNLOAD_TOKEN = "download-token";
-
-    private OtpAuthenticationFilter otpAuthenticationFilter;
-
-    @Before
-    public void setUp() throws Exception {
-        otpAuthenticationFilter = new OtpAuthenticationFilter();
-    }
-
-    @Test
-    public void testInsecureHttp() throws Exception {
-        final HttpServletRequest request = mock(HttpServletRequest.class);
-        when(request.isSecure()).thenReturn(false);
-        assertNull(otpAuthenticationFilter.attemptAuthentication(request));
-    }
-
-    @Test
-    public void testNoAccessToken() throws Exception {
-        final HttpServletRequest request = mock(HttpServletRequest.class);
-        when(request.isSecure()).thenReturn(true);
-        when(request.getParameter(OtpAuthenticationFilter.ACCESS_TOKEN)).thenReturn(null);
-        assertNull(otpAuthenticationFilter.attemptAuthentication(request));
-    }
-
-    @Test
-    public void testUnsupportedDownloadPath() throws Exception {
-        final HttpServletRequest request = mock(HttpServletRequest.class);
-        when(request.isSecure()).thenReturn(true);
-        when(request.getParameter(OtpAuthenticationFilter.ACCESS_TOKEN)).thenReturn("my-access-token");
-        when(request.getContextPath()).thenReturn("/nifi-api");
-        when(request.getPathInfo()).thenReturn("/flow/cluster/summary");
-
-        assertNull(otpAuthenticationFilter.attemptAuthentication(request));
-    }
-
-    @Test
-    public void testUiExtensionPath() throws Exception {
-        final HttpServletRequest request = mock(HttpServletRequest.class);
-        when(request.isSecure()).thenReturn(true);
-        when(request.getParameter(OtpAuthenticationFilter.ACCESS_TOKEN)).thenReturn(UI_EXTENSION_TOKEN);
-        when(request.getContextPath()).thenReturn("/nifi-update-attribute-ui");
-
-        final OtpAuthenticationRequestToken result = (OtpAuthenticationRequestToken) otpAuthenticationFilter.attemptAuthentication(request);
-        assertEquals(UI_EXTENSION_TOKEN, result.getToken());
-        assertFalse(result.isDownloadToken());
-    }
-
-    @Test
-    public void testProvenanceInputContentDownload() throws Exception {
-        final HttpServletRequest request = mock(HttpServletRequest.class);
-        when(request.isSecure()).thenReturn(true);
-        when(request.getParameter(OtpAuthenticationFilter.ACCESS_TOKEN)).thenReturn(DOWNLOAD_TOKEN);
-        when(request.getContextPath()).thenReturn("/nifi-api");
-        when(request.getPathInfo()).thenReturn("/provenance-events/0/content/input");
-
-        final OtpAuthenticationRequestToken result = (OtpAuthenticationRequestToken) otpAuthenticationFilter.attemptAuthentication(request);
-        assertEquals(DOWNLOAD_TOKEN, result.getToken());
-        assertTrue(result.isDownloadToken());
-    }
-
-    @Test
-    public void testProvenanceOutputContentDownload() throws Exception {
-        final HttpServletRequest request = mock(HttpServletRequest.class);
-        when(request.isSecure()).thenReturn(true);
-        when(request.getParameter(OtpAuthenticationFilter.ACCESS_TOKEN)).thenReturn(DOWNLOAD_TOKEN);
-        when(request.getContextPath()).thenReturn("/nifi-api");
-        when(request.getPathInfo()).thenReturn("/provenance-events/0/content/output");
-
-        final OtpAuthenticationRequestToken result = (OtpAuthenticationRequestToken) otpAuthenticationFilter.attemptAuthentication(request);
-        assertEquals(DOWNLOAD_TOKEN, result.getToken());
-        assertTrue(result.isDownloadToken());
-    }
-
-    @Test
-    public void testFlowFileContentDownload() throws Exception {
-        final String uuid = UUID.randomUUID().toString();
-
-        final HttpServletRequest request = mock(HttpServletRequest.class);
-        when(request.isSecure()).thenReturn(true);
-        when(request.getParameter(OtpAuthenticationFilter.ACCESS_TOKEN)).thenReturn(DOWNLOAD_TOKEN);
-        when(request.getContextPath()).thenReturn("/nifi-api");
-        when(request.getPathInfo()).thenReturn(String.format("/flowfile-queues/%s/flowfiles/%s/content", uuid, uuid));
-
-        final OtpAuthenticationRequestToken result = (OtpAuthenticationRequestToken) otpAuthenticationFilter.attemptAuthentication(request);
-        assertEquals(DOWNLOAD_TOKEN, result.getToken());
-        assertTrue(result.isDownloadToken());
-    }
-
-    @Test
-    public void testTemplateDownload() throws Exception {
-        final String uuid = UUID.randomUUID().toString();
-
-        final HttpServletRequest request = mock(HttpServletRequest.class);
-        when(request.isSecure()).thenReturn(true);
-        when(request.getParameter(OtpAuthenticationFilter.ACCESS_TOKEN)).thenReturn(DOWNLOAD_TOKEN);
-        when(request.getContextPath()).thenReturn("/nifi-api");
-        when(request.getPathInfo()).thenReturn(String.format("/templates/%s/download", uuid));
-
-        final OtpAuthenticationRequestToken result = (OtpAuthenticationRequestToken) otpAuthenticationFilter.attemptAuthentication(request);
-        assertEquals(DOWNLOAD_TOKEN, result.getToken());
-        assertTrue(result.isDownloadToken());
-    }
-
-}
diff --git a/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-security/src/test/java/org/apache/nifi/web/security/otp/OtpAuthenticationProviderTest.java b/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-security/src/test/java/org/apache/nifi/web/security/otp/OtpAuthenticationProviderTest.java
deleted file mode 100644
index 38c95a6..0000000
--- a/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-security/src/test/java/org/apache/nifi/web/security/otp/OtpAuthenticationProviderTest.java
+++ /dev/null
@@ -1,261 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one or more
- * contributor license agreements.  See the NOTICE file distributed with
- * this work for additional information regarding copyright ownership.
- * The ASF licenses this file to You under the Apache License, Version 2.0
- * (the "License"); you may not use this file except in compliance with
- * the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.nifi.web.security.otp;
-
-import org.apache.nifi.admin.service.IdpUserGroupService;
-import org.apache.nifi.authorization.AccessPolicyProvider;
-import org.apache.nifi.authorization.Authorizer;
-import org.apache.nifi.authorization.Group;
-import org.apache.nifi.authorization.ManagedAuthorizer;
-import org.apache.nifi.authorization.User;
-import org.apache.nifi.authorization.UserAndGroups;
-import org.apache.nifi.authorization.UserGroupProvider;
-import org.apache.nifi.authorization.user.NiFiUser;
-import org.apache.nifi.authorization.user.NiFiUserDetails;
-import org.apache.nifi.idp.IdpType;
-import org.apache.nifi.idp.IdpUserGroup;
-import org.apache.nifi.util.NiFiProperties;
-import org.apache.nifi.web.security.token.NiFiAuthenticationToken;
-import org.junit.Before;
-import org.junit.Test;
-import org.mockito.invocation.InvocationOnMock;
-import org.mockito.stubbing.Answer;
-
-import java.util.Arrays;
-import java.util.Collections;
-import java.util.Set;
-
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertNull;
-import static org.junit.Assert.assertTrue;
-import static org.mockito.ArgumentMatchers.anyString;
-import static org.mockito.Mockito.doAnswer;
-import static org.mockito.Mockito.mock;
-import static org.mockito.Mockito.never;
-import static org.mockito.Mockito.times;
-import static org.mockito.Mockito.verify;
-import static org.mockito.Mockito.when;
-
-public class OtpAuthenticationProviderTest {
-
-    private final static String UI_EXTENSION_AUTHENTICATED_USER = "ui-extension-token-authenticated-user";
-    private final static String UI_EXTENSION_TOKEN = "ui-extension-token";
-
-    private final static String DOWNLOAD_AUTHENTICATED_USER = "download-token-authenticated-user";
-    private final static String DOWNLOAD_TOKEN = "download-token";
-
-    private OtpService otpService;
-    private OtpAuthenticationProvider otpAuthenticationProvider;
-    private NiFiProperties nifiProperties;
-    private IdpUserGroupService idpUserGroupService;
-
-    @Before
-    public void setUp() throws Exception {
-        otpService = mock(OtpService.class);
-        doAnswer(new Answer<String>() {
-            @Override
-            public String answer(InvocationOnMock invocation) throws Throwable {
-                Object[] args = invocation.getArguments();
-                String downloadToken = (String) args[0];
-
-                if (DOWNLOAD_TOKEN.equals(downloadToken)) {
-                    return DOWNLOAD_AUTHENTICATED_USER;
-                }
-
-                throw new OtpAuthenticationException("Invalid token");
-            }
-        }).when(otpService).getAuthenticationFromDownloadToken(anyString());
-        doAnswer(new Answer<String>() {
-            @Override
-            public String answer(InvocationOnMock invocation) throws Throwable {
-                Object[] args = invocation.getArguments();
-                String uiExtensionToken = (String) args[0];
-
-                if (UI_EXTENSION_TOKEN.equals(uiExtensionToken)) {
-                    return UI_EXTENSION_AUTHENTICATED_USER;
-                }
-
-                throw new OtpAuthenticationException("Invalid token");
-            }
-        }).when(otpService).getAuthenticationFromUiExtensionToken(anyString());
-
-        idpUserGroupService = mock(IdpUserGroupService.class);
-
-        otpAuthenticationProvider = new OtpAuthenticationProvider(
-                otpService, mock(NiFiProperties.class), mock(Authorizer.class), idpUserGroupService);
-    }
-
-    @Test
-    public void testUiExtensionPath() throws Exception {
-        when(idpUserGroupService.getUserGroups(anyString())).thenReturn(Collections.emptyList());
-
-        final OtpAuthenticationRequestToken request = new OtpAuthenticationRequestToken(UI_EXTENSION_TOKEN, false, null);
-
-        final NiFiAuthenticationToken result = (NiFiAuthenticationToken) otpAuthenticationProvider.authenticate(request);
-        final NiFiUserDetails details = (NiFiUserDetails) result.getPrincipal();
-        assertEquals(UI_EXTENSION_AUTHENTICATED_USER, details.getUsername());
-        assertNotNull(details.getNiFiUser());
-
-        assertNull(details.getNiFiUser().getGroups());
-
-        assertNotNull(details.getNiFiUser().getIdentityProviderGroups());
-        assertEquals(0, details.getNiFiUser().getIdentityProviderGroups().size());
-
-        assertNotNull(details.getNiFiUser().getAllGroups());
-        assertEquals(0, details.getNiFiUser().getAllGroups().size());
-
-        verify(otpService, times(1)).getAuthenticationFromUiExtensionToken(UI_EXTENSION_TOKEN);
-        verify(otpService, never()).getAuthenticationFromDownloadToken(anyString());
-    }
-
-    @Test
-    public void testDownload() throws Exception {
-        when(idpUserGroupService.getUserGroups(anyString())).thenReturn(Collections.emptyList());
-
-        final OtpAuthenticationRequestToken request = new OtpAuthenticationRequestToken(DOWNLOAD_TOKEN, true, null);
-
-        final NiFiAuthenticationToken result = (NiFiAuthenticationToken) otpAuthenticationProvider.authenticate(request);
-        final NiFiUserDetails details = (NiFiUserDetails) result.getPrincipal();
-        assertEquals(DOWNLOAD_AUTHENTICATED_USER, details.getUsername());
-        assertNotNull(details.getNiFiUser());
-
-        assertNull(details.getNiFiUser().getGroups());
-
-        assertNotNull(details.getNiFiUser().getIdentityProviderGroups());
-        assertEquals(0, details.getNiFiUser().getIdentityProviderGroups().size());
-
-        assertNotNull(details.getNiFiUser().getAllGroups());
-        assertEquals(0, details.getNiFiUser().getAllGroups().size());
-
-        verify(otpService, never()).getAuthenticationFromUiExtensionToken(anyString());
-        verify(otpService, times(1)).getAuthenticationFromDownloadToken(DOWNLOAD_TOKEN);
-    }
-
-    @Test
-    public void testWhenIdpUserGroupsArePresent() {
-        final String groupName1 = "group1";
-        final IdpUserGroup idpUserGroup1 = createIdpUserGroup(1, DOWNLOAD_AUTHENTICATED_USER, groupName1, IdpType.SAML);
-
-        final String groupName2 = "group2";
-        final IdpUserGroup idpUserGroup2 = createIdpUserGroup(2, DOWNLOAD_AUTHENTICATED_USER, groupName2, IdpType.SAML);
-
-        when(idpUserGroupService.getUserGroups(DOWNLOAD_AUTHENTICATED_USER)).thenReturn(Arrays.asList(idpUserGroup1, idpUserGroup2));
-
-        final OtpAuthenticationRequestToken request = new OtpAuthenticationRequestToken(DOWNLOAD_TOKEN, true, null);
-
-        final NiFiAuthenticationToken result = (NiFiAuthenticationToken) otpAuthenticationProvider.authenticate(request);
-        final NiFiUserDetails details = (NiFiUserDetails) result.getPrincipal();
-        assertEquals(DOWNLOAD_AUTHENTICATED_USER, details.getUsername());
-
-        final NiFiUser returnedUser = details.getNiFiUser();
-        assertNotNull(returnedUser);
-
-        // user-group-provider groups are null
-        assertNull(returnedUser.getGroups());
-
-        // identity-provider group contain the two groups
-        assertNotNull(returnedUser.getIdentityProviderGroups());
-        assertEquals(2, returnedUser.getIdentityProviderGroups().size());
-        assertTrue(returnedUser.getIdentityProviderGroups().contains(groupName1));
-        assertTrue(returnedUser.getIdentityProviderGroups().contains(groupName1));
-
-        verify(otpService, never()).getAuthenticationFromUiExtensionToken(anyString());
-        verify(otpService, times(1)).getAuthenticationFromDownloadToken(DOWNLOAD_TOKEN);
-    }
-
-    @Test
-    public void testWhenUserGroupProviderGroupsAndIdpUserGroupsArePresent() {
-        // setup idp user group service...
-
-        final String groupName1 = "group1";
-        final IdpUserGroup idpUserGroup1 = createIdpUserGroup(1, DOWNLOAD_AUTHENTICATED_USER, groupName1, IdpType.SAML);
-
-        final String groupName2 = "group2";
-        final IdpUserGroup idpUserGroup2 = createIdpUserGroup(2, DOWNLOAD_AUTHENTICATED_USER, groupName2, IdpType.SAML);
-
-        when(idpUserGroupService.getUserGroups(DOWNLOAD_AUTHENTICATED_USER)).thenReturn(Arrays.asList(idpUserGroup1, idpUserGroup2));
-
-        // setup managed authorizer...
-
-        final String groupName3 = "group3";
-        final Group group3 = new Group.Builder().identifierGenerateRandom().name(groupName3).build();
-
-        final UserGroupProvider userGroupProvider = mock(UserGroupProvider.class);
-        when(userGroupProvider.getUserAndGroups(DOWNLOAD_AUTHENTICATED_USER)).thenReturn(new UserAndGroups() {
-            @Override
-            public User getUser() {
-                return new User.Builder().identifier(DOWNLOAD_AUTHENTICATED_USER).identity(DOWNLOAD_AUTHENTICATED_USER).build();
-            }
-
-            @Override
-            public Set<Group> getGroups() {
-                return Collections.singleton(group3);
-            }
-        });
-
-        final AccessPolicyProvider accessPolicyProvider = mock(AccessPolicyProvider.class);
-        when(accessPolicyProvider.getUserGroupProvider()).thenReturn(userGroupProvider);
-
-        final ManagedAuthorizer managedAuthorizer = mock(ManagedAuthorizer.class);
-        when(managedAuthorizer.getAccessPolicyProvider()).thenReturn(accessPolicyProvider);
-
-        // create OTP auth provider using mocks from above
-
-        otpAuthenticationProvider = new OtpAuthenticationProvider(
-                otpService, mock(NiFiProperties.class), managedAuthorizer, idpUserGroupService);
-
-        // test...
-
-        final OtpAuthenticationRequestToken request = new OtpAuthenticationRequestToken(DOWNLOAD_TOKEN, true, null);
-
-        final NiFiAuthenticationToken result = (NiFiAuthenticationToken) otpAuthenticationProvider.authenticate(request);
-        final NiFiUserDetails details = (NiFiUserDetails) result.getPrincipal();
-        assertEquals(DOWNLOAD_AUTHENTICATED_USER, details.getUsername());
-
-        final NiFiUser returnedUser = details.getNiFiUser();
-        assertNotNull(returnedUser);
-
-        // Assert user-group-provider groups are correct
-        assertEquals(1, returnedUser.getGroups().size());
-        assertTrue(returnedUser.getGroups().contains(groupName3));
-
-        // Assert identity-provider groups are correct
-        assertEquals(2, returnedUser.getIdentityProviderGroups().size());
-        assertTrue(returnedUser.getIdentityProviderGroups().contains(groupName1));
-        assertTrue(returnedUser.getIdentityProviderGroups().contains(groupName2));
-
-        // Assert combined groups are correct
-        assertEquals(3, returnedUser.getAllGroups().size());
-        assertTrue(returnedUser.getAllGroups().contains(groupName1));
-        assertTrue(returnedUser.getAllGroups().contains(groupName2));
-        assertTrue(returnedUser.getAllGroups().contains(groupName3));
-
-        verify(otpService, never()).getAuthenticationFromUiExtensionToken(anyString());
-        verify(otpService, times(1)).getAuthenticationFromDownloadToken(DOWNLOAD_TOKEN);
-    }
-
-    private IdpUserGroup createIdpUserGroup(int id, String identity, String groupName, IdpType idpType) {
-        final IdpUserGroup userGroup = new IdpUserGroup();
-        userGroup.setId(id);
-        userGroup.setIdentity(identity);
-        userGroup.setGroupName(groupName);
-        userGroup.setType(idpType);
-        return userGroup;
-    }
-
-}
diff --git a/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-security/src/test/java/org/apache/nifi/web/security/otp/OtpServiceTest.java b/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-security/src/test/java/org/apache/nifi/web/security/otp/OtpServiceTest.java
deleted file mode 100644
index 6ff920d..0000000
--- a/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-security/src/test/java/org/apache/nifi/web/security/otp/OtpServiceTest.java
+++ /dev/null
@@ -1,291 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one or more
- * contributor license agreements.  See the NOTICE file distributed with
- * this work for additional information regarding copyright ownership.
- * The ASF licenses this file to You under the Apache License, Version 2.0
- * (the "License"); you may not use this file except in compliance with
- * the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.nifi.web.security.otp;
-
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNotEquals;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.fail;
-
-import java.util.concurrent.TimeUnit;
-import org.apache.nifi.web.security.token.OtpAuthenticationToken;
-import org.junit.Before;
-import org.junit.Test;
-
-public class OtpServiceTest {
-
-    private final static String USER_1 = "user-identity-1";
-    private final static int CACHE_EXPIRY_TIME = 1;
-    private final static int WAIT_TIME = 2000;
-
-    private OtpService otpService;
-
-    @Before
-    public void setUp() throws Exception {
-        otpService = new OtpService();
-    }
-
-    @Test
-    public void testGetAuthenticationForValidDownloadToken() throws Exception {
-        final OtpAuthenticationToken authenticationToken = new OtpAuthenticationToken(USER_1);
-        final String downloadToken = otpService.generateDownloadToken(authenticationToken);
-        final String authenticatedUser = otpService.getAuthenticationFromDownloadToken(downloadToken);
-
-        assertNotNull(authenticatedUser);
-        assertEquals(USER_1, authenticatedUser);
-
-        try {
-            // ensure the token is no longer valid
-            otpService.getAuthenticationFromDownloadToken(downloadToken);
-            fail();
-        } catch (final OtpAuthenticationException oae) {}
-    }
-
-    @Test
-    public void testGetAuthenticationForValidUiExtensionToken() throws Exception {
-        final OtpAuthenticationToken authenticationToken = new OtpAuthenticationToken(USER_1);
-        final String uiExtensionToken = otpService.generateUiExtensionToken(authenticationToken);
-        final String authenticatedUser = otpService.getAuthenticationFromUiExtensionToken(uiExtensionToken);
-
-        assertNotNull(authenticatedUser);
-        assertEquals(USER_1, authenticatedUser);
-
-        try {
-            // ensure the token is no longer valid
-            otpService.getAuthenticationFromUiExtensionToken(uiExtensionToken);
-            fail();
-        } catch (final OtpAuthenticationException oae) {}
-    }
-
-    @Test(expected = OtpAuthenticationException.class)
-    public void testGetNonExistentDownloadToken() throws Exception {
-        otpService.getAuthenticationFromDownloadToken("Not a real download token");
-    }
-
-    @Test(expected = OtpAuthenticationException.class)
-    public void testGetNonExistentUiExtensionToken() throws Exception {
-        otpService.getAuthenticationFromUiExtensionToken("Not a real ui extension token");
-    }
-
-    @Test(expected = IllegalStateException.class)
-    public void testMaxDownloadTokenLimit() throws Exception {
-        // ensure we'll try to loop past the limit
-        for (int i = 1; i < OtpService.MAX_CACHE_SOFT_LIMIT + 10; i++) {
-            try {
-                final OtpAuthenticationToken authenticationToken = new OtpAuthenticationToken("user-identity-" + i);
-                otpService.generateDownloadToken(authenticationToken);
-            } catch (final IllegalStateException iae) {
-                // ensure we failed when we've passed the limit
-                assertEquals(OtpService.MAX_CACHE_SOFT_LIMIT + 1, i);
-                throw iae;
-            }
-        }
-    }
-
-    @Test(expected = IllegalStateException.class)
-    public void testMaxUiExtensionTokenLimit() throws Exception {
-        // ensure we'll try to loop past the limit
-        for (int i = 1; i < OtpService.MAX_CACHE_SOFT_LIMIT + 10; i++) {
-            try {
-                final OtpAuthenticationToken authenticationToken = new OtpAuthenticationToken("user-identity-" + i);
-                otpService.generateUiExtensionToken(authenticationToken);
-            } catch (final IllegalStateException iae) {
-                // ensure we failed when we've passed the limit
-                assertEquals(OtpService.MAX_CACHE_SOFT_LIMIT + 1, i);
-                throw iae;
-            }
-        }
-    }
-
-    @Test(expected = NullPointerException.class)
-    public void testNullTimeUnits() throws Exception {
-        new OtpService(0, null);
-    }
-
-    @Test(expected = IllegalArgumentException.class)
-    public void testNegativeExpiration() throws Exception {
-        new OtpService(-1, TimeUnit.MINUTES);
-    }
-
-    @Test(expected = OtpAuthenticationException.class)
-    public void testUiExtensionTokenExpiration() throws Exception {
-        final OtpService otpServiceWithTightExpiration = new OtpService(CACHE_EXPIRY_TIME, TimeUnit.SECONDS);
-
-        final OtpAuthenticationToken authenticationToken = new OtpAuthenticationToken(USER_1);
-        final String downloadToken = otpServiceWithTightExpiration.generateUiExtensionToken(authenticationToken);
-
-        // sleep for 2 seconds which should sufficiently expire the valid token
-        Thread.sleep(WAIT_TIME);
-
-        // attempt to get the token now that it's expired
-        otpServiceWithTightExpiration.getAuthenticationFromUiExtensionToken(downloadToken);
-    }
-
-    @Test(expected = OtpAuthenticationException.class)
-    public void testDownloadTokenExpiration() throws Exception {
-        final OtpService otpServiceWithTightExpiration = new OtpService(CACHE_EXPIRY_TIME, TimeUnit.SECONDS);
-
-        final OtpAuthenticationToken authenticationToken = new OtpAuthenticationToken(USER_1);
-        final String downloadToken = otpServiceWithTightExpiration.generateDownloadToken(authenticationToken);
-
-        // sleep for 2 seconds which should sufficiently expire the valid token
-        Thread.sleep(WAIT_TIME);
-
-        // attempt to get the token now that it's expired
-        otpServiceWithTightExpiration.getAuthenticationFromDownloadToken(downloadToken);
-    }
-
-    @Test
-    public void testDownloadTokenIsTheSameForSubsequentRequests() {
-        final OtpAuthenticationToken authenticationToken = new OtpAuthenticationToken(USER_1);
-        final String downloadToken = otpService.generateDownloadToken(authenticationToken);
-        final String secondDownloadToken = otpService.generateDownloadToken(authenticationToken);
-
-        assertEquals(downloadToken, secondDownloadToken);
-    }
-
-    @Test
-    public void testDownloadTokenIsTheSameForSubsequentRequestsUntilUsed() {
-        final OtpAuthenticationToken authenticationToken = new OtpAuthenticationToken(USER_1);
-
-        // generate two tokens
-        final String downloadToken = otpService.generateDownloadToken(authenticationToken);
-        final String secondDownloadToken = otpService.generateDownloadToken(authenticationToken);
-
-        assertEquals(downloadToken, secondDownloadToken);
-
-        // use the token
-        otpService.getAuthenticationFromDownloadToken(downloadToken);
-
-        // make sure the next token is now different
-        final String thirdDownloadToken = otpService.generateDownloadToken(authenticationToken);
-        assertNotEquals(downloadToken, thirdDownloadToken);
-    }
-
-    @Test
-    public void testDownloadTokenIsValidForSubsequentGenerateAndUse() {
-        final OtpAuthenticationToken authenticationToken = new OtpAuthenticationToken(USER_1);
-
-        // generate a token
-        final String downloadToken = otpService.generateDownloadToken(authenticationToken);
-
-        // use the token
-        final String auth = otpService.getAuthenticationFromDownloadToken(downloadToken);
-        assertEquals(USER_1, auth);
-
-        // generate a new token, make sure it's different, then authenticate with it
-        final String secondDownloadToken = otpService.generateDownloadToken(authenticationToken);
-        assertNotEquals(downloadToken, secondDownloadToken);
-        final String secondAuth = otpService.getAuthenticationFromDownloadToken(secondDownloadToken);
-        assertEquals(USER_1, secondAuth);
-    }
-
-    @Test
-    public void testSingleUserCannotGenerateTooManyUIExtensionTokens() throws Exception {
-        // ensure we'll try to loop past the limit
-        for (int i = 1; i < OtpService.MAX_CACHE_SOFT_LIMIT + 10; i++) {
-            final OtpAuthenticationToken authenticationToken = new OtpAuthenticationToken("user-identity-1");
-            otpService.generateUiExtensionToken(authenticationToken);
-
-        }
-
-        // make sure other users can still generate tokens
-        final OtpAuthenticationToken anotherAuthenticationToken = new OtpAuthenticationToken("user-identity-2");
-        final String auth = otpService.generateUiExtensionToken(anotherAuthenticationToken);
-        assertNotNull(auth);
-    }
-
-    @Test
-    public void testSingleUserCannotGenerateTooManyDownloadTokens() throws Exception {
-        // ensure we'll try to loop past the limit
-        for (int i = 1; i < OtpService.MAX_CACHE_SOFT_LIMIT + 10; i++) {
-            final OtpAuthenticationToken authenticationToken = new OtpAuthenticationToken("user-identity-1");
-            otpService.generateDownloadToken(authenticationToken);
-
-        }
-
-        // make sure other users can still generate tokens
-        final OtpAuthenticationToken anotherAuthenticationToken = new OtpAuthenticationToken("user-identity-2");
-        final String auth = otpService.generateDownloadToken(anotherAuthenticationToken);
-        assertNotNull(auth);
-    }
-
-    @Test(expected = OtpAuthenticationException.class)
-    public void testDownloadTokenNotValidAfterUse() throws Exception {
-        final OtpAuthenticationToken authenticationToken = new OtpAuthenticationToken(USER_1);
-        final String downloadToken = otpService.generateDownloadToken(authenticationToken);
-
-        // use the token
-        final String authenticatedUser = otpService.getAuthenticationFromDownloadToken(downloadToken);
-
-        // check we authenticated successfully
-        assertNotNull(authenticatedUser);
-        assertEquals(USER_1, authenticatedUser);
-
-        // check authentication fails with the used token
-        final String failedAuthentication = otpService.getAuthenticationFromDownloadToken(downloadToken);
-    }
-
-    @Test(expected = OtpAuthenticationException.class)
-    public void testUIExtensionTokenNotValidAfterUse() throws Exception {
-        final OtpAuthenticationToken authenticationToken = new OtpAuthenticationToken(USER_1);
-        final String downloadToken = otpService.generateDownloadToken(authenticationToken);
-
-        // use the token
-        final String authenticatedUser = otpService.getAuthenticationFromUiExtensionToken(downloadToken);
-
-        // check we authenticated successfully
-        assertNotNull(authenticatedUser);
-        assertEquals(USER_1, authenticatedUser);
-
-        // check authentication fails with the used token
-        final String failedAuthentication = otpService.getAuthenticationFromUiExtensionToken(downloadToken);
-    }
-
-    @Test
-    public void testShouldGenerateNewDownloadTokenAfterExpiration() throws Exception {
-        final OtpService otpServiceWithTightExpiration = new OtpService(CACHE_EXPIRY_TIME, TimeUnit.SECONDS);
-
-        final OtpAuthenticationToken authenticationToken = new OtpAuthenticationToken(USER_1);
-        final String downloadToken = otpServiceWithTightExpiration.generateDownloadToken(authenticationToken);
-
-        // sleep for 2 seconds which should sufficiently expire the valid token
-        Thread.sleep(WAIT_TIME);
-
-        // get a new token and make sure the previous one had expired
-        final String secondDownloadToken = otpServiceWithTightExpiration.generateDownloadToken(authenticationToken);
-        assertNotEquals(downloadToken, secondDownloadToken);
-    }
-
-    @Test
-    public void testDownloadTokenRemainsTheSameBeforeExpirationButNotAfter() throws Exception {
-        final OtpService otpServiceWithTightExpiration = new OtpService(CACHE_EXPIRY_TIME, TimeUnit.SECONDS);
-
-        final OtpAuthenticationToken authenticationToken = new OtpAuthenticationToken(USER_1);
-        final String downloadToken = otpServiceWithTightExpiration.generateDownloadToken(authenticationToken);
-        final String secondDownloadToken = otpServiceWithTightExpiration.generateDownloadToken(authenticationToken);
-
-        assertEquals(downloadToken, secondDownloadToken);
-
-        // sleep for 2 seconds which should sufficiently expire the valid token
-        Thread.sleep(WAIT_TIME);
-
-        // get a new token and make sure the previous one had expired
-        final String thirdDownloadToken = otpServiceWithTightExpiration.generateDownloadToken(authenticationToken);
-        assertNotEquals(downloadToken, thirdDownloadToken);
-    }
-}
\ No newline at end of file
diff --git a/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-ui/src/main/webapp/js/nf/canvas/nf-actions.js b/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-ui/src/main/webapp/js/nf/canvas/nf-actions.js
index 5ae7945..a7ee61f 100644
--- a/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-ui/src/main/webapp/js/nf/canvas/nf-actions.js
+++ b/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-ui/src/main/webapp/js/nf/canvas/nf-actions.js
@@ -151,7 +151,6 @@
             api: '../nifi-api',
             controller: '../nifi-api/controller',
             parameterContexts: '../nifi-api/parameter-contexts',
-            downloadToken: '../nifi-api/access/download-token'
         }
     };
 
@@ -1648,26 +1647,11 @@
             }
 
             if (processGroupId !== null) {
-                nfCommon.getAccessToken(config.urls.downloadToken).done(function (downloadToken) {
-                    var parameters = {};
+                var parameters = {};
 
-                    // conditionally include the download token
-                    if (!nfCommon.isBlank(downloadToken)) {
-                        parameters['access_token'] = downloadToken;
-                    }
-
-                    // open the url
-                    var uri = '../nifi-api/process-groups/' + encodeURIComponent(processGroupId) + '/download';
-                    if (!$.isEmptyObject(parameters)) {
-                        uri += ('?' + $.param(parameters));
-                    }
-                    window.open(uri);
-                }).fail(function () {
-                    nfDialog.showOkDialog({
-                        headerText: 'Download Flow Definition',
-                        dialogContent: 'Unable to generate access token for downloading content.'
-                    });
-                });
+                // open the url
+                var uri = '../nifi-api/process-groups/' + encodeURIComponent(processGroupId) + '/download';
+                window.open(uri);
             }
         },
 
diff --git a/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-ui/src/main/webapp/js/nf/canvas/nf-custom-ui.js b/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-ui/src/main/webapp/js/nf/canvas/nf-custom-ui.js
index de26b1f..d10cc3c 100644
--- a/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-ui/src/main/webapp/js/nf/canvas/nf-custom-ui.js
+++ b/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-ui/src/main/webapp/js/nf/canvas/nf-custom-ui.js
@@ -55,35 +55,22 @@
          */
         showCustomUi: function (entity, uri, editable) {
             return $.Deferred(function (deferred) {
-                nfCommon.getAccessToken('../nifi-api/access/ui-extension-token').done(function (uiExtensionToken) {
-                    // record the processor id
-                    $('#shell-close-button');
+                // record the processor id
+                $('#shell-close-button');
 
-                    var revision = nfClient.getRevision(entity);
+                var revision = nfClient.getRevision(entity);
 
-                    // build the customer ui params
-                    var customUiParams = {
-                        'id': entity.id,
-                        'revision': revision.version,
-                        'clientId': revision.clientId,
-                        'editable': editable,
-                        'disconnectedNodeAcknowledged': nfStorage.isDisconnectionAcknowledged()
-                    };
+                // build the customer ui params
+                var customUiParams = {
+                    'id': entity.id,
+                    'revision': revision.version,
+                    'clientId': revision.clientId,
+                    'editable': editable,
+                    'disconnectedNodeAcknowledged': nfStorage.isDisconnectionAcknowledged()
+                };
 
-                    // conditionally include the ui extension token
-                    if (!nfCommon.isBlank(uiExtensionToken)) {
-                        customUiParams['access_token'] = uiExtensionToken;
-                    }
-
-                    // show the shell
-                    nfShell.showPage('..' + uri + '?' + $.param(customUiParams), false).done(function () {
-                        deferred.resolve();
-                    });
-                }).fail(function () {
-                    nfDialog.showOkDialog({
-                        headerText: 'Advanced Configuration',
-                        dialogContent: 'Unable to generate access token for accessing the advanced configuration dialog.'
-                    });
+                // show the shell
+                nfShell.showPage('..' + uri + '?' + $.param(customUiParams), false).done(function () {
                     deferred.resolve();
                 });
             }).promise();
diff --git a/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-ui/src/main/webapp/js/nf/canvas/nf-queue-listing.js b/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-ui/src/main/webapp/js/nf/canvas/nf-queue-listing.js
index 89131bd..7aeb3e5 100644
--- a/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-ui/src/main/webapp/js/nf/canvas/nf-queue-listing.js
+++ b/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-ui/src/main/webapp/js/nf/canvas/nf-queue-listing.js
@@ -67,8 +67,6 @@
      */
     var config = {
         urls: {
-            uiExtensionToken: '../nifi-api/access/ui-extension-token',
-            downloadToken: '../nifi-api/access/download-token'
         }
     };
 
@@ -247,33 +245,20 @@
     var downloadContent = function (flowFileSummary) {
         var dataUri = ((nfCommon.isDefinedAndNotNull(flowFileSummary.uri))?flowFileSummary.uri:$('#flowfile-uri').text())+ '/content';
 
-        // perform the request once we've received a token
-        nfCommon.getAccessToken(config.urls.downloadToken).done(function (downloadToken) {
-            var parameters = {};
+        var parameters = {};
 
-            // conditionally include the ui extension token
-            if (!nfCommon.isBlank(downloadToken)) {
-                parameters['access_token'] = downloadToken;
-            }
+        // conditionally include the cluster node id
+        var clusterNodeId = (nfCommon.isDefinedAndNotNull(flowFileSummary.clusterNodeId))?flowFileSummary.clusterNodeId:$('#flowfile-cluster-node-id').text();
+        if (!nfCommon.isBlank(clusterNodeId)) {
+            parameters['clusterNodeId'] = clusterNodeId;
+        }
 
-            // conditionally include the cluster node id
-            var clusterNodeId = (nfCommon.isDefinedAndNotNull(flowFileSummary.clusterNodeId))?flowFileSummary.clusterNodeId:$('#flowfile-cluster-node-id').text();
-            if (!nfCommon.isBlank(clusterNodeId)) {
-                parameters['clusterNodeId'] = clusterNodeId;
-            }
-
-            // open the url
-            if ($.isEmptyObject(parameters)) {
-                window.open(dataUri);
-            } else {
-                window.open(dataUri + '?' + $.param(parameters));
-            }
-        }).fail(function () {
-            nfDialog.showOkDialog({
-                headerText: 'Queue Listing',
-                dialogContent: 'Unable to generate access token for downloading content.'
-            });
-        });
+        // open the url
+        if ($.isEmptyObject(parameters)) {
+            window.open(dataUri);
+        } else {
+            window.open(dataUri + '?' + $.param(parameters));
+        }
     };
 
     /**
@@ -285,80 +270,37 @@
 
         var dataUri = ((nfCommon.isDefinedAndNotNull(flowFileSummary.uri))?flowFileSummary.uri:$('#flowfile-uri').text())+ '/content';
 
-        // generate tokens as necessary
-        var getAccessTokens = $.Deferred(function (deferred) {
-            if (nfStorage.hasItem('jwt')) {
-                // generate a token for the ui extension and another for the callback
-                var uiExtensionToken = $.ajax({
-                    type: 'POST',
-                    url: config.urls.uiExtensionToken
-                });
-                var downloadToken = $.ajax({
-                    type: 'POST',
-                    url: config.urls.downloadToken
-                });
+        var dataUriParameters = {};
 
-                // wait for each token
-                $.when(uiExtensionToken, downloadToken).done(function (uiExtensionTokenResult, downloadTokenResult) {
-                    var uiExtensionToken = uiExtensionTokenResult[0];
-                    var downloadToken = downloadTokenResult[0];
-                    deferred.resolve(uiExtensionToken, downloadToken);
-                }).fail(function () {
-                    nfDialog.showOkDialog({
-                        headerText: 'Queue Listing',
-                        dialogContent: 'Unable to generate access token for viewing content.'
-                    });
-                    deferred.reject();
-                });
-            } else {
-                deferred.resolve('', '');
-            }
-        }).promise();
+        // conditionally include the cluster node id
+        var clusterNodeId = (nfCommon.isDefinedAndNotNull(flowFileSummary.clusterNodeId))?flowFileSummary.clusterNodeId:$('#flowfile-cluster-node-id').text();
+        if (!nfCommon.isBlank(clusterNodeId)) {
+            dataUriParameters['clusterNodeId'] = clusterNodeId;
+        }
 
-        // perform the request after we've received the tokens
-        getAccessTokens.done(function (uiExtensionToken, downloadToken) {
-            var dataUriParameters = {};
+        // include parameters if necessary
+        if ($.isEmptyObject(dataUriParameters) === false) {
+            dataUri = dataUri + '?' + $.param(dataUriParameters);
+        }
 
-            // conditionally include the cluster node id
-            var clusterNodeId = (nfCommon.isDefinedAndNotNull(flowFileSummary.clusterNodeId))?flowFileSummary.clusterNodeId:$('#flowfile-cluster-node-id').text();
-            if (!nfCommon.isBlank(clusterNodeId)) {
-                dataUriParameters['clusterNodeId'] = clusterNodeId;
-            }
+        // open the content viewer
+        var contentViewerUrl = $('#nifi-content-viewer-url').text();
 
-            // include the download token if applicable
-            if (!nfCommon.isBlank(downloadToken)) {
-                dataUriParameters['access_token'] = downloadToken;
-            }
+        // if there's already a query string don't add another ?... this assumes valid
+        // input meaning that if the url has already included a ? it also contains at
+        // least one query parameter
+        if (contentViewerUrl.indexOf('?') === -1) {
+            contentViewerUrl += '?';
+        } else {
+            contentViewerUrl += '&';
+        }
 
-            // include parameters if necessary
-            if ($.isEmptyObject(dataUriParameters) === false) {
-                dataUri = dataUri + '?' + $.param(dataUriParameters);
-            }
+        var contentViewerParameters = {
+            'ref': dataUri
+        };
 
-            // open the content viewer
-            var contentViewerUrl = $('#nifi-content-viewer-url').text();
-
-            // if there's already a query string don't add another ?... this assumes valid
-            // input meaning that if the url has already included a ? it also contains at
-            // least one query parameter
-            if (contentViewerUrl.indexOf('?') === -1) {
-                contentViewerUrl += '?';
-            } else {
-                contentViewerUrl += '&';
-            }
-
-            var contentViewerParameters = {
-                'ref': dataUri
-            };
-
-            // include the download token if applicable
-            if (!nfCommon.isBlank(uiExtensionToken)) {
-                contentViewerParameters['access_token'] = uiExtensionToken;
-            }
-
-            // open the content viewer
-            window.open(contentViewerUrl + $.param(contentViewerParameters));
-        });
+        // open the content viewer
+        window.open(contentViewerUrl + $.param(contentViewerParameters));
     };
 
     /**
diff --git a/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-ui/src/main/webapp/js/nf/nf-common.js b/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-ui/src/main/webapp/js/nf/nf-common.js
index 2b79896..3d46d8b 100644
--- a/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-ui/src/main/webapp/js/nf/nf-common.js
+++ b/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-ui/src/main/webapp/js/nf/nf-common.js
@@ -1196,29 +1196,6 @@
         },
 
         /**
-         * Gets an access token from the specified url.
-         *
-         * @param accessTokenUrl    The access token
-         * @returns the access token as a deferred
-         */
-        getAccessToken: function (accessTokenUrl) {
-            return $.Deferred(function (deferred) {
-                if (nfStorage.hasItem('jwt')) {
-                    $.ajax({
-                        type: 'POST',
-                        url: accessTokenUrl
-                    }).done(function (token) {
-                        deferred.resolve(token);
-                    }).fail(function () {
-                        deferred.reject();
-                    })
-                } else {
-                    deferred.resolve('');
-                }
-            }).promise();
-        },
-
-        /**
          * Constants for time duration formatting.
          */
         MILLIS_PER_DAY: 86400000,
diff --git a/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-ui/src/main/webapp/js/nf/provenance/nf-provenance-table.js b/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-ui/src/main/webapp/js/nf/provenance/nf-provenance-table.js
index 2ca9abc..6973691 100644
--- a/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-ui/src/main/webapp/js/nf/provenance/nf-provenance-table.js
+++ b/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-ui/src/main/webapp/js/nf/provenance/nf-provenance-table.js
@@ -70,9 +70,7 @@
                 provenanceEvents: '../nifi-api/provenance-events/',
                 clusterSearch: '../nifi-api/flow/cluster/search-results',
                 d3Script: 'js/d3/build/d3.min.js',
-                lineageScript: 'js/nf/provenance/nf-provenance-lineage.js',
-                uiExtensionToken: '../nifi-api/access/ui-extension-token',
-                downloadToken: '../nifi-api/access/download-token'
+                lineageScript: 'js/nf/provenance/nf-provenance-lineage.js'
             }
         };
 
@@ -92,33 +90,20 @@
             // build the url
             var dataUri = config.urls.provenanceEvents + encodeURIComponent(eventId) + '/content/' + encodeURIComponent(direction);
 
-            // perform the request once we've received a token
-            nfCommon.getAccessToken(config.urls.downloadToken).done(function (downloadToken) {
-                var parameters = {};
+            var parameters = {};
 
-                // conditionally include the ui extension token
-                if (!nfCommon.isBlank(downloadToken)) {
-                    parameters['access_token'] = downloadToken;
-                }
+            // conditionally include the cluster node id
+            var clusterNodeId = $('#provenance-event-cluster-node-id').text();
+            if (!nfCommon.isBlank(clusterNodeId)) {
+                parameters['clusterNodeId'] = clusterNodeId;
+            }
 
-                // conditionally include the cluster node id
-                var clusterNodeId = $('#provenance-event-cluster-node-id').text();
-                if (!nfCommon.isBlank(clusterNodeId)) {
-                    parameters['clusterNodeId'] = clusterNodeId;
-                }
-
-                // open the url
-                if ($.isEmptyObject(parameters)) {
-                    window.open(dataUri);
-                } else {
-                    window.open(dataUri + '?' + $.param(parameters));
-                }
-            }).fail(function () {
-                nfDialog.showOkDialog({
-                    headerText: 'Provenance',
-                    dialogContent: 'Unable to generate access token for downloading content.'
-                });
-            });
+            // open the url
+            if ($.isEmptyObject(parameters)) {
+                window.open(dataUri);
+            } else {
+                window.open(dataUri + '?' + $.param(parameters));
+            }
         };
 
         /**
@@ -133,80 +118,37 @@
             // build the uri to the data
             var dataUri = controllerUri + 'provenance-events/' + encodeURIComponent(eventId) + '/content/' + encodeURIComponent(direction);
 
-            // generate tokens as necessary
-            var getAccessTokens = $.Deferred(function (deferred) {
-                if (nfStorage.hasItem('jwt')) {
-                    // generate a token for the ui extension and another for the callback
-                    var uiExtensionToken = $.ajax({
-                        type: 'POST',
-                        url: config.urls.uiExtensionToken
-                    });
-                    var downloadToken = $.ajax({
-                        type: 'POST',
-                        url: config.urls.downloadToken
-                    });
+            var dataUriParameters = {};
 
-                    // wait for each token
-                    $.when(uiExtensionToken, downloadToken).done(function (uiExtensionTokenResult, downloadTokenResult) {
-                        var uiExtensionToken = uiExtensionTokenResult[0];
-                        var downloadToken = downloadTokenResult[0];
-                        deferred.resolve(uiExtensionToken, downloadToken);
-                    }).fail(function () {
-                        nfDialog.showOkDialog({
-                            headerText: 'Provenance',
-                            dialogContent: 'Unable to generate access token for viewing content.'
-                        });
-                        deferred.reject();
-                    });
-                } else {
-                    deferred.resolve('', '');
-                }
-            }).promise();
+            // conditionally include the cluster node id
+            var clusterNodeId = $('#provenance-event-cluster-node-id').text();
+            if (!nfCommon.isBlank(clusterNodeId)) {
+                dataUriParameters['clusterNodeId'] = clusterNodeId;
+            }
 
-            // perform the request after we've received the tokens
-            getAccessTokens.done(function (uiExtensionToken, downloadToken) {
-                var dataUriParameters = {};
+            // include parameters if necessary
+            if ($.isEmptyObject(dataUriParameters) === false) {
+                dataUri = dataUri + '?' + $.param(dataUriParameters);
+            }
 
-                // conditionally include the cluster node id
-                var clusterNodeId = $('#provenance-event-cluster-node-id').text();
-                if (!nfCommon.isBlank(clusterNodeId)) {
-                    dataUriParameters['clusterNodeId'] = clusterNodeId;
-                }
+            // open the content viewer
+            var contentViewerUrl = $('#nifi-content-viewer-url').text();
 
-                // include the download token if applicable
-                if (!nfCommon.isBlank(downloadToken)) {
-                    dataUriParameters['access_token'] = downloadToken;
-                }
+            // if there's already a query string don't add another ?... this assumes valid
+            // input meaning that if the url has already included a ? it also contains at
+            // least one query parameter
+            if (contentViewerUrl.indexOf('?') === -1) {
+                contentViewerUrl += '?';
+            } else {
+                contentViewerUrl += '&';
+            }
 
-                // include parameters if necessary
-                if ($.isEmptyObject(dataUriParameters) === false) {
-                    dataUri = dataUri + '?' + $.param(dataUriParameters);
-                }
+            var contentViewerParameters = {
+                'ref': dataUri
+            };
 
-                // open the content viewer
-                var contentViewerUrl = $('#nifi-content-viewer-url').text();
-
-                // if there's already a query string don't add another ?... this assumes valid
-                // input meaning that if the url has already included a ? it also contains at
-                // least one query parameter
-                if (contentViewerUrl.indexOf('?') === -1) {
-                    contentViewerUrl += '?';
-                } else {
-                    contentViewerUrl += '&';
-                }
-
-                var contentViewerParameters = {
-                    'ref': dataUri
-                };
-
-                // include the download token if applicable
-                if (!nfCommon.isBlank(uiExtensionToken)) {
-                    contentViewerParameters['access_token'] = uiExtensionToken;
-                }
-
-                // open the content viewer
-                window.open(contentViewerUrl + $.param(contentViewerParameters));
-            });
+            // open the content viewer
+            window.open(contentViewerUrl + $.param(contentViewerParameters));
         };
 
         /**
diff --git a/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-ui/src/main/webapp/js/nf/templates/nf-templates-table.js b/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-ui/src/main/webapp/js/nf/templates/nf-templates-table.js
index 4bd0c31..19919bc 100644
--- a/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-ui/src/main/webapp/js/nf/templates/nf-templates-table.js
+++ b/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-ui/src/main/webapp/js/nf/templates/nf-templates-table.js
@@ -51,8 +51,7 @@
      */
     var config = {
         urls: {
-            templates: '../nifi-api/flow/templates',
-            downloadToken: '../nifi-api/access/download-token'
+            templates: '../nifi-api/flow/templates'
         }
     };
 
@@ -204,26 +203,7 @@
      * @param {object} templateEntity     The template
      */
     var downloadTemplate = function (templateEntity) {
-        nfCommon.getAccessToken(config.urls.downloadToken).done(function (downloadToken) {
-            var parameters = {};
-
-            // conditionally include the download token
-            if (!nfCommon.isBlank(downloadToken)) {
-                parameters['access_token'] = downloadToken;
-            }
-
-            // open the url
-            if ($.isEmptyObject(parameters)) {
-                window.open(templateEntity.template.uri + '/download');
-            } else {
-                window.open(templateEntity.template.uri + '/download' + '?' + $.param(parameters));
-            }
-        }).fail(function () {
-            nfDialog.showOkDialog({
-                headerText: 'Download Template',
-                dialogContent: 'Unable to generate access token for downloading content.'
-            });
-        });
+        window.open(templateEntity.template.uri + '/download');
     };
 
     return {
diff --git a/nifi-registry/nifi-registry-core/nifi-registry-web-api/src/main/java/org/apache/nifi/registry/web/security/authentication/oidc/OidcService.java b/nifi-registry/nifi-registry-core/nifi-registry-web-api/src/main/java/org/apache/nifi/registry/web/security/authentication/oidc/OidcService.java
index 65b160b..1dd3cfb 100644
--- a/nifi-registry/nifi-registry-core/nifi-registry-web-api/src/main/java/org/apache/nifi/registry/web/security/authentication/oidc/OidcService.java
+++ b/nifi-registry/nifi-registry-core/nifi-registry-web-api/src/main/java/org/apache/nifi/registry/web/security/authentication/oidc/OidcService.java
@@ -45,7 +45,7 @@
     private Cache<CacheKey, String> jwtLookupForCompletedRequests; // identifier from cookie -> jwt or identity (and generate jwt on retrieval)
 
     /**
-     * Creates a new OtpService with an expiration of 1 minute.
+     * Creates a new OIDC Service with an expiration of 1 minute.
      *
      * @param identityProvider          The identity provider
      */
@@ -55,7 +55,7 @@
     }
 
     /**
-     * Creates a new OtpService.
+     * Creates a new OIDC Service.
      *
      * @param identityProvider          The identity provider
      * @param duration                  The expiration duration