-
Notifications
You must be signed in to change notification settings - Fork 4k
rabbit_access_control: Check configured auth backends are enabled at boot time #14359
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
f886f30
to
31b1637
Compare
While adding a testsuite, I discovered that the definition of what an "enabled plugin" is varies from function to function in
|
31b1637
to
b6bea2a
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Hi JSP! This is great 👍
... without having to pass a plugins path. [Why] It's painful to have to get the plugins path, then pass it to `list/1` every time. It's also more difficult to discover how to use `rabbit_plugins` to get that list of plugins.
… module [Why] This will be used in a later commit to find the auth backend plugin that provides a configured auth backend module. [How] We go through the list of available plugins, regardless if they are enabled or not, then look up the given module in the list of modules associated with each plugin's application.
…boot time [Why] If a user configures an auth backend module, but doesn't enabled the plugin that provides it, it will get a crash and a stacktrace when authentication is performed. The error is not helpful to understand what the problem is. [How] We add a boot step that go through the configured auth backends and query the core of RabbitMQ and the plugins. If an auth backend is provided by a plugin, the plugin must be enabled to consider the auth backend to be valid. In the end, at least one auth backend must be valid, otherwise the boot is aborted. If only some of the configured auth backends were filtered out, but there are still some valid auth backends, we store the filtered list in the application environment variable so that authentication/authorization doesn't try to use them later. We also report invalid auth backends in the logs: * Info message for a single invalid auth backend: [info] <0.213.0> The `rabbit_auth_backend_ldap` auth backend module is configured. However, the `rabbitmq_auth_backend_ldap` plugin must be enabled in order to use this auth backend. Until then it will be skipped during authentication/authorization * Warning message when some auth backends were filtered out: [warning] <0.213.0> Some configured backends were dropped because their corresponding plugins are disabled. Please look at the info messages above to learn which plugin(s) should be enabled. Here is the list of auth backends kept after filering: [warning] <0.213.0> [rabbit_auth_backend_internal] * Error message when no auth backends are valid: [error] <0.213.0> None of the configured auth backends are usable because their corresponding plugins were not enabled. Please look at the info messages above to learn which plugin(s) should be enabled. V2: In fact, `rabbit_plugins:is_enabled/1` indicates if a plugin is running, not if it is enabled... The new check runs as a boot step and thus is executed before plugins are started. Therefore we can't use this API. Instead, we use `rabbit_plugins:enabled_plugins/0' which lists explicitly enabled plugins. The drawback is that in the auth backend is enabled implicitly because it is a dependency of another explicitly enabled plugin, the check will still consider it is disabled and thus abort the boot. Fixes #13783.
b6bea2a
to
23588b6
Compare
Why
If a user configures an auth backend module, but doesn't enabled the plugin that provides it, it will get a crash and a stacktrace when authentication is performed. The error is not helpful to understand what the problem is.
How
We add a boot step that go through the configured auth backends and query the core of RabbitMQ and the plugins. If an auth backend is provided by a plugin, the plugin must be enabled to consider the auth backend to be valid.
In the end, at least one auth backend must be valid, otherwise the boot is aborted.
If only some of the configured auth backends were filtered out, but there are still some valid auth backends, we store the filtered list in the application environment variable so that authentication/authorization doesn't try to use them later.
We also report invalid auth backends in the logs:
Info message for a single invalid auth backend:
Warning message when some auth backends were filtered out:
Error message when no auth backends are valid:
Fixes #13783.