RabbitMQ + OAuth = MQTT login failed for user

Question

I'm having trouble configuring RabbitMQ to use JWT for client access (for exemple with Paho to access MQTT)

I have use this recomended plugin rabbitmq_auth_backend_oauth2

I'm generating my JWT access_token using Keycloak

Sample :

{
    "exp": 1617886910,
    "iat": 1617872510,
    "jti": "e720xxxxxxad0",
    "iss": "https://xxxxxxxxxxx",
    "aud": [
        "kanban",
        "rabbitmq",
        "account"
    ],
    "sub": "ec27xxxxxxx92fc",
    "typ": "Bearer",
    "azp": "kanban",
    "session_state": "1bcxxxxxxx5e",
    "acr": "1",
    "allowed-origins": [
        ""
    ],
    "realm_access": {
        "roles": [
            "offline_access",
            "uma_authorization"
        ]
    },
    "scope": "email kanban.read:*/* kanban.write:*/* profile kanban.configure:*/*",
    "email_verified": false,
    "plant": "*",
    "name": "xxx xx",
    "preferred_username": "xxxx",
    "given_name": "xxxxx",
    "rabbitmq": ["kanban.read:*/*", "kanban.write:*/*"],
    "family_name": "xx",
    "email": "xxxxxxxxx"
}

And for rabbitmq config: Dockefile

RUN rabbitmq-plugins enable rabbitmq_mqtt
RUN rabbitmq-plugins enable rabbitmq_web_mqtt
RUN rabbitmq-plugins enable rabbitmq_management
RUN rabbitmq-plugins enable rabbitmq_auth_backend_oauth2
COPY ./rabbitmq/advanced.config /etc/rabbitmq/advanced.config
COPY ./rabbitmq/rabbitmq.conf /etc/rabbitmq/rabbitmq.conf
EXPOSE 1883

advanced.config

[
  {rabbit, [
    {auth_backends, [rabbit_auth_backend_oauth2, rabbit_auth_backend_internal]},
    {auth_mechanisms, ['PLAIN','AMQPPLAIN','EXTERNAL']}
  ]},
  {rabbitmq_auth_backend_oauth2, [
    {resource_server_id, <<"kanban">>},
    {key_config, [
      {default_key, <<"YoC-uSkB0wTmh39078PuzmobULDLk-1aQqDZWV4fgYc">>},
      {additional_rabbitmq_scopes, <<"rabbitmq">>}, 
      {jwks_url, <<"https://XXXXX/auth/realms/XXXXX/protocol/openid-connect/certs">>},
      {signing_key, 
          #{<<"YoC-uSkB0wTmh39078PuzmobULDLk-1aQqDZWV4fgYc">> => {pem, <<"-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArXL0WnwckscW5XeCofcG65Fhdy/FJhvvuQkFOUu2erzPfI1Tq35yijikcAG4Qp+nnpUaKXw6juWXdRwebAEuX6ZsCZ5T75dJlXErov3jqOb47U5V0g2B2nNWOzeNGLsPDBOVw3e1iG6zIZtVUlJBM7hkAQuKj6w9R4mu5JEisGCw3onjrF97/E1oOvTw3v+tDYxwWqyLpFi5crjam3lzx4VxN8zwLCx1Q3x2a3jeMLlt0iL9F/+axrHZg45CrMq0MOsWJ3vJQh7WfKjW6hFlyDE4y/nxHds+v/nmzJC5ahEAFHixq7+0VhL0K+tSDmQjxG8gBfyaPsQsPCLC4Zzv/wIDAQAB
-----END PUBLIC KEY-----">>}
         }
     }]
    }
  ]}
].

When I test using Paho, providing my JWT on PASSWORD field (and user empty or anythign else), I have the error.

What I have tried :

Check if advanced.config is loaded by providing stupid key => generate parse error
Check authbackend is loaded => displayed in log at startup
Check with different username or empty in my paho script
Check with/without signing key field in advanced.config
Check with or without << >> around JKWS => nothing happend

What can cause the error or what is missconfigured in my configfiles ?

RabbitMQ + OAuth => MQTT login failed for user

0 Answers