Adding OAuth with Entra to RabbitMQ not working

[ddrachau]

Currently I am installing a Bitnami Helmchart to rollout a simple plain RabbitMQ:

CHART NAME: rabbitmq
CHART VERSION: 16.0.9
APP VERSION: 4.1.1

extraEnvVars:
  - name: MODE
    value: entra

extraPlugins:
  - rabbitmq_auth_backend_oauth2

extraConfiguration: |-
  auth_backends.1 = rabbit_auth_backend_oauth2
  auth_backends.2 = internal

  management.oauth_enabled = true
  management.oauth_client_id = 5XXXXXXX
  management.oauth_scopes = openid profile api://5XXXXXXX/management-ui

  auth_oauth2.resource_server_id = api://5XXXXXXX
  auth_oauth2.issuer = https://login.microsoftonline.com/3YYYY/v2.0
  auth_oauth2.additional_scopes_key = roles

Once I open the https RabbitMQ Page, I can click a button 'Click here to login' and I am redirect to MS Entra. After signing in, I am rerouted to RabbitMQ which complaints:

rabbitmq 2025-07-04 09:39:38.771114+00:00 [debug] <0.1233.0> User 'x@y' authenticated successfully by backend rabbit_auth_backend_oauth2 rabbitmq 2025-07-04 09:39:38.771170+00:00 [warning] <0.1233.0> HTTP access denied: user 'x@y' - Not management user

For me it looks like RabbitMQ is not looking in the token field roles or ignores all the roles and combinations which are in there.

Has anybody a working OAuth Login with Entra?

[MirahImage]

There is an MS Entra specific guide, which is necessary to use, as Entra does not conform to the OAuth2 specification.

[ddrachau]

I explicitly followed this guide and also the troubleshooting guide, but the described setup is not working

[ddrachau]

The MS Entra specific guide does cover most of the needed configuration, but it states:

auth_oauth2.resource_server_id = {Application(client) ID}

it must be

auth_oauth2.resource_server_id = api://{Application(client) ID}

in order to validate the token successfully.

Once the token was verified, the roles did not get recognized. The documentation stated, that the use of auth_oauth2.scope_prefix is optional with a default value of 'rabbitmq.'.

This is not the case, or it is buggy. You have to explicitly set the auth_oauth2.scope_prefix variable to whatever prefix you are. using:

so auth_oauth2.scope_prefix = rabbitmq. for role values like rabbitmq.tag:administrator