Replies: 5 comments 6 replies
-
|
I will convert this issue to a GitHub discussion. Currently GitHub will automatically close and lock the issue even though your question will be transferred and responded to elsewhere. This is to let you know that we do not intend to ignore this but this is how the current GitHub conversion mechanism makes it seem for the users :( |
Beta Was this translation helpful? Give feedback.
-
|
We cannot suggest much without seeing your client code. The token must be provided in the password field. AMQP 1.0 plugin is unlikely to be particularly creative about how it extract that, and actual authentication happens outside of it. |
Beta Was this translation helpful? Give feedback.
-
|
Client code is as simple as it gets (using AMQP.Net Lite). A token is created separately by an Oauth2 authorization server. The token is of course a rather long password (around 860 characters). It appears to me that the AMQP 1.0 plugin does not receive the password (token) correctly when initialised? public static void AmqpNetLiteTest(string token)
{
Address address = new("localhost", 5671, "token", token, "/", "AMQPS");
Console.WriteLine("Connecting...");
Connection connection = new Connection(address);
Console.WriteLine("Creating a session...");
Session session = new Session(connection);
Message message = new Message("Hello AMQP!");
Console.WriteLine("Sending a message...");
SenderLink sender = new SenderLink(session, "sender-link", "q1");
sender.Send(message);
Console.WriteLine("Sent Hello AMQP!");
sender.Close();
session.Close();
connection.Close();
}The failure is discovered by the client during the call to sender.Send |
Beta Was this translation helpful? Give feedback.
-
|
The OAuth 2 plugin was tested with MQTT IIRC. We will try to reproduce with Shovel, although I can't promise any ETA. |
Beta Was this translation helpful? Give feedback.
-
suggests the operation was rejected as a genuine authentication failure. So my best guess is that the plugin makes assumptions about credentials that do not hold true in this case :/ |
Beta Was this translation helpful? Give feedback.
-
|
I have attempted to work around this problem by using the http backend instead of the oauth2 backend, and validating the token in the http endpoint instead. I encounter a very similar issue in this case, that when the AMQP 1.0 plugin is used, my endpoint is called with a correct username, but the password field is missing (completely absent from the http POST made to my endpoint). Before that POST, I have already received a first POST with both username and password (the complete token). The relevant part of my configuration is: The first request I get on my http endpoint is this one: And the second one: My HTTP endpoint is based on the sample from the http plugin. This might be the same underlying problem, or a different one - should I create a separate discussion for this issue? |
Beta Was this translation helpful? Give feedback.
-
|
What exactly was done to generate the first and second requests to your HTTP auth backend? Was it your test code here? |
Beta Was this translation helpful? Give feedback.
-
|
Yes, that was done with the same test code. It is also possible to reproduce this with a shovel with the following settings: When this shovel starts (or restarts) you will see a first request with the username and password (guest/guest) and assuming this was allowed (in my case by the second authentication mechanism, internal) you will immediately get the second request with only a username Currently my http auth backend denies the guest/guest login as well as the guest/null login so both falls back to the internal auth mechanism, which allows them. I wonder how the 'internal' mechanism can authenticate the guest/null - does it have more context than the http backend? |
Beta Was this translation helpful? Give feedback.
-
|
The first request is authentication, the second is authorization https://www.rabbitmq.com/access-control.html |
Beta Was this translation helpful? Give feedback.
-
|
I have the same problem any solutions? |
Beta Was this translation helpful? Give feedback.
-
|
It was fixed in #6909 |
Beta Was this translation helpful? Give feedback.
-
We are using rabbitmq (3.9.12) with oauth2 token authentication and authorization. This works fine when using an AMQP 0.9.1 client. However then using an AMQP 1.0 client (after enabling the amqp 1.0 plugin) the authentication fails. We tried both using a C# client based on AMQP.Net Lite, but also see the same failure when we simply create a shovel authenticating with an oauth2 token (works fine when the shovel is using 0.9.1, but fails when set to connect with 1.0).
Initially discussed here: https://groups.google.com/g/rabbitmq-users/c/WPGuiIDSh_Q
The rabbitmq configuration:
JWT token payload:
And finally the logging of rabbitmq (edited a bit for readability). Note the initial "authenticated successfully" followed by "Authentication using an OAuth 2/JWT token failed":
Beta Was this translation helpful? Give feedback.
All reactions