Skip to content

rabbit_access_control: Check configured auth backends are enabled at boot time #14359

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Aug 12, 2025

Conversation

dumbbell
Copy link
Collaborator

@dumbbell dumbbell commented Aug 11, 2025

Why

If a user configures an auth backend module, but doesn't enabled the plugin that provides it, it will get a crash and a stacktrace when authentication is performed. The error is not helpful to understand what the problem is.

How

We add a boot step that go through the configured auth backends and query the core of RabbitMQ and the plugins. If an auth backend is provided by a plugin, the plugin must be enabled to consider the auth backend to be valid.

In the end, at least one auth backend must be valid, otherwise the boot is aborted.

If only some of the configured auth backends were filtered out, but there are still some valid auth backends, we store the filtered list in the application environment variable so that authentication/authorization doesn't try to use them later.

We also report invalid auth backends in the logs:

  • Info message for a single invalid auth backend:

    [info] <0.213.0> The `rabbit_auth_backend_ldap` auth backend module is configured. However, the `rabbitmq_auth_backend_ldap` plugin must be enabled in order to use this auth backend. Until then it will be skipped during authentication/authorization
    
  • Warning message when some auth backends were filtered out:

    [warning] <0.213.0> Some configured backends were dropped because their corresponding plugins are disabled. Please look at the info messages above to learn which plugin(s) should be enabled. Here is the list of auth backends kept after filering:
    [warning] <0.213.0> [rabbit_auth_backend_internal]
    
  • Error message when no auth backends are valid:

    [error] <0.213.0> None of the configured auth backends are usable because their corresponding plugins were not enabled. Please look at the info messages above to learn which plugin(s) should be enabled.
    

Fixes #13783.

@dumbbell dumbbell self-assigned this Aug 11, 2025
@dumbbell dumbbell changed the title Verify auth plugin is enabled rabbit_access_control: Check configured auth backends are enabled at boot time Aug 11, 2025
@dumbbell dumbbell force-pushed the verify-auth-plugin-is-enabled branch from f886f30 to 31b1637 Compare August 11, 2025 14:28
@dumbbell
Copy link
Collaborator Author

While adding a testsuite, I discovered that the definition of what an "enabled plugin" is varies from function to function in rabbit_plugins… Sometimes, it means the plugin was enabled by a user (e.g. using the CLI), sometimes, it means the plugin is running regardless of whether it was enabled or not.

rabbit_plugins:is_enabled/1 uses the latter definition unfortunately. I need to modily the patch to use rabbit_plugins:enabled_plugins/0 instead. The drawback is that if an auth backend is enabled implicitly because it is a dependency of another explicitly enabled plugin, the broken won’t start because the new check will consider that the plugin is disabled.

@dumbbell dumbbell force-pushed the verify-auth-plugin-is-enabled branch from 31b1637 to b6bea2a Compare August 12, 2025 10:54
@mergify mergify bot added the make label Aug 12, 2025
Copy link
Collaborator

@lukebakken lukebakken left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi JSP! This is great 👍

... without having to pass a plugins path.

[Why]
It's painful to have to get the plugins path, then pass it to `list/1`
every time. It's also more difficult to discover how to use
`rabbit_plugins` to get that list of plugins.
… module

[Why]
This will be used in a later commit to find the auth backend plugin that
provides a configured auth backend module.

[How]
We go through the list of available plugins, regardless if they are
enabled or not, then look up the given module in the list of modules
associated with each plugin's application.
…boot time

[Why]
If a user configures an auth backend module, but doesn't enabled the
plugin that provides it, it will get a crash and a stacktrace when
authentication is performed. The error is not helpful to understand what
the problem is.

[How]
We add a boot step that go through the configured auth backends and
query the core of RabbitMQ and the plugins. If an auth backend is
provided by a plugin, the plugin must be enabled to consider the auth
backend to be valid.

In the end, at least one auth backend must be valid, otherwise the boot
is aborted.

If only some of the configured auth backends were filtered out, but
there are still some valid auth backends, we store the filtered list in
the application environment variable so that
authentication/authorization doesn't try to use them later.

We also report invalid auth backends in the logs:

* Info message for a single invalid auth backend:

    [info] <0.213.0> The `rabbit_auth_backend_ldap` auth backend module is configured. However, the `rabbitmq_auth_backend_ldap` plugin must be enabled in order to use this auth backend. Until then it will be skipped during authentication/authorization

* Warning message when some auth backends were filtered out:

    [warning] <0.213.0> Some configured backends were dropped because their corresponding plugins are disabled. Please look at the info messages above to learn which plugin(s) should be enabled. Here is the list of auth backends kept after filering:
    [warning] <0.213.0> [rabbit_auth_backend_internal]

* Error message when no auth backends are valid:

    [error] <0.213.0> None of the configured auth backends are usable because their corresponding plugins were not enabled. Please look at the info messages above to learn which plugin(s) should be enabled.

V2: In fact, `rabbit_plugins:is_enabled/1` indicates if a plugin is
    running, not if it is enabled... The new check runs as a boot step
    and thus is executed before plugins are started. Therefore we can't
    use this API. Instead, we use `rabbit_plugins:enabled_plugins/0'
    which lists explicitly enabled plugins. The drawback is that in the
    auth backend is enabled implicitly because it is a dependency of
    another explicitly enabled plugin, the check will still consider it
    is disabled and thus abort the boot.

Fixes #13783.
@dumbbell dumbbell force-pushed the verify-auth-plugin-is-enabled branch from b6bea2a to 23588b6 Compare August 12, 2025 16:38
@dumbbell dumbbell marked this pull request as ready for review August 12, 2025 17:33
@michaelklishin michaelklishin added this to the 4.2.0 milestone Aug 12, 2025
@michaelklishin michaelklishin merged commit cf3fd1e into main Aug 12, 2025
560 of 561 checks passed
@michaelklishin michaelklishin deleted the verify-auth-plugin-is-enabled branch August 12, 2025 18:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants