oauth2 backend regression from 3.13.0.rc2 to 3.13.0 #10700
-
Describe the bugoauth2 backend not working as expected Reproduction steps
spec:
delayStartSeconds: 30
image: rabbitmq:3.13.0-rc.2-management-alpine
override: {}
persistence:
storage: 10Gi
rabbitmq:
additionalConfig: |
cluster_name = west
cluster_partition_handling = pause_minority
vm_memory_high_watermark_paging_ratio = 0.99
disk_free_limit.relative = 1.0
collect_statistics_interval = 10000
prometheus.return_per_object_metrics = true
log.console = true
log.console.level = info
auth_backends.1 = internal
auth_backends.2 = rabbit_auth_backend_oauth2
# local-cert
auth_oauth2.https.peer_verification = verify_none
additionalPlugins:
- rabbitmq_top
- rabbitmq_federation
- rabbitmq_federation_management
- rabbitmq_consistent_hash_exchange
- rabbitmq_auth_backend_oauth2
- rabbitmq_prometheus
advancedConfig: |
[
{rabbitmq_auth_backend_oauth2,
[{scope_prefix, <<>>}
,{verify_aud, false}
,{extra_scopes_source, <<"groups">>}
,{preferred_username_claims, [<<"email">>, <<"username">>, <<"user_name">>, <<"sub">>]}
,{key_config,
[{peer_verification, verify_none}
,{jwks_url, "https://dex.your.fqdn/keys"}
]
}
,{scope_aliases, #{<<"myawesomeorg:admins">> => [<<"tag:administrator">>, <<"configure:*/*/*">>, <<"write:*/*/*">>, <<"read:*/*/*">>]}}
]
}
,{rabbitmq_management,
[{oauth_enabled, true}
,{oauth_initiated_logon_type, idp_initiated}
,{oauth_provider_url, "https://dex.your.fqdn"}
]
}
].
replicas: 3
annotations:
cert-manager.io/cluster-issuer: your-cert-issuer
nginx.ingress.kubernetes.io/auth-response-headers: Authorization
nginx.ingress.kubernetes.io/auth-signin: >-
https://auth.your.fqdn/oauth2/start?rd=https://$host$request_uri$is_args$args
nginx.ingress.kubernetes.io/auth-url: https://auth.your.fqdn/oauth2/auth
nginx.ingress.kubernetes.io/configuration-snippet: |
auth_request_set $token $upstream_http_authorization;
# proxy_set_header Authorization $token;
auth_request_set $name_upstream_1 $upstream_cookie__oauth2_proxy_1;
access_by_lua_block {
if ngx.var.name_upstream_1 ~= "" then
ngx.header["Set-Cookie"] = "_oauth2_proxy_1=" .. ngx.var.name_upstream_1 .. ngx.var.auth_cookie:match("(; .*)")
end
}
nginx.ingress.kubernetes.io/enable-cors: 'true'
nginx.ingress.kubernetes.io/proxy-buffer-size: 512k
Expected behavioruser is logged in. Additional contextlogs seem to indicate that |
Beta Was this translation helpful? Give feedback.
Replies: 4 comments 13 replies
-
|
I'm afraid "deploy to Kubernetes" is not a reproduction step because there is a bajillion different Kubernetes environments, plus Nginx ingress controller is used, plus Dex (https://github.com/dexidp/dex?) is not an IDP provider we claim to support. We will see if setting up Dex may end up being reasonably straightforward, and how different it may be from other providers. The plugin supports five different IDP options (UAA, Keycloak, Auth0, Azure AD, Keycloak with OAuth 2 Proxy) and Dex is not on the list. Dex users are welcome to investigate what may be missing for Dex and contribute support for it. |
Beta Was this translation helpful? Give feedback.
-
|
dex works as expected in conjunction with oauth2-proxy. I have couchdb, dashboard and previously rabbitmq. the dex provider is not the issue, the issue is a regression from 3.13.0.rc2 to 3.13.0. oauth2_client was added and several things changed. |
Beta Was this translation helpful? Give feedback.
-
|
the new changes should not affect the existing behaviour. One of the changes were to simplify the configuration. In your configuration, you would only need to configure |
Beta Was this translation helpful? Give feedback.
-
|
d827b72 (edited) changes caused this. rc2 works rc5 doesn't. |
Beta Was this translation helpful? Give feedback.
-
|
to give more context, |
Beta Was this translation helpful? Give feedback.
-
|
I appreciate if you could add a PR to https://github.com/rabbitmq/rabbitmq-oauth2-tutorial that show case dex as another Authorization Server. This one is a good example to follow. |
Beta Was this translation helpful? Give feedback.
-
|
@lazedo |
Beta Was this translation helpful? Give feedback.
-
|
think this is the commit that changed the behaviour d827b72 (edited) |
Beta Was this translation helpful? Give feedback.
-
|
Since we added support for multiple Oauth2 resource(s), I need to decide whether we really want to support |
Beta Was this translation helpful? Give feedback.
-
|
even with resource_server_id it doesn't work. this 9f9cd9f seems like a potential fix, when is it going to be available as a release ? |
Beta Was this translation helpful? Give feedback.
-
Just keep an eye out for version 3.13.1. There is no set date for release at this time. |
Beta Was this translation helpful? Give feedback.
-
|
@lazedo as a workaround, set the |
Beta Was this translation helpful? Give feedback.
-
|
@lazedo this issue was fixed 2 weeks ago. Can you please try this image which is built straight from our CI? There is a selenium suite (https://github.com/rabbitmq/rabbitmq-server/actions/runs/8197530182/job/22419646109) which runs your setup (i.e. with If you prefer, you can run this test locally. |
Beta Was this translation helpful? Give feedback.
-
|
@MarcialRosales Hi, confirmed it's fixed with that image. |
Beta Was this translation helpful? Give feedback.
-
|
|
Beta Was this translation helpful? Give feedback.
-
|
New questions belong to new discussions. |
Beta Was this translation helpful? Give feedback.
@lazedo this issue was fixed 2 weeks ago. Can you please try this image which is built straight from our CI?
pivotalrabbitmq/rabbitmq:main-otp-max-bazel
There is a selenium suite (https://github.com/rabbitmq/rabbitmq-server/actions/runs/8197530182/job/22419646109) which runs your setup (i.e. with
verify_nonebut also withresource_server_idthough). Search forauthnz-mgt/oauth-with-keycloak-with-verify-none.shIf you prefer, you can run this test locally.