OAuth2.0 - Provided Token is Invalid #5187
Replies: 5 comments 13 replies
-
|
Consider using Discussions for questions instead of filing issues. According to the exception, a public key entry cannot be decoded, perhaps it is not in the PEM format. We cannot suggest much with the amount of information provided. |
Beta Was this translation helpful? Give feedback.
-
|
Advanced Config if that helps. I am able to verify the signature on JWT.io with this public key. {rabbitmq_auth_backend_oauth2, [ |
Beta Was this translation helpful? Give feedback.
-
|
@michaelklishin Did you get chance to look at this further. Any further information if required I can share. |
Beta Was this translation helpful? Give feedback.
-
|
@gaurav-baid As @michaelklishin mentioned , the issue has to do with the public key of your signing key. There is something wrong with it and RabbitMQ fails to parse it. If you attach the whole configuration file and a sample token I can try it. Besides, you probably want to update the |
Beta Was this translation helpful? Give feedback.
-
|
@MarcialRosales @michaelklishin Thanks for the quick replies. |
Beta Was this translation helpful? Give feedback.
-
|
Hallo Team, I need some kind of help.. i would like use oauth2.0(Keycloak). so i used this git repo(https://github.com/rabbitmq/rabbitmq-oauth2-tutorial/blob/rich_auth_request/use-cases/keycloak.md) and installed the keycloak in my local. then i wrote rabbitmq.config and docker-compose.yml file like below docker-compose.yml version: '3' rabbitmq.config [ ]. enabled_plugins [rabbitmq_management,rabbitmq_auth_backend_oauth2,rabbitmq_mqtt]. Now the problem is when run the docker compose file. |
Beta Was this translation helpful? Give feedback.
-
|
Hi @215813 , I have just followed the instructions in the tutorial and I could access that management ui and I can see the SSO button.
One thing I have noticed in your docker compose is that you are binding If you do not get the button "click here to login", you should see a message warning that it is not possible to contact keycloak. |
Beta Was this translation helpful? Give feedback.
-
|
Hallo @MarcialRosales Thank you for kind response..I followed the steps given now.. i am not able to see "click here to login button. please find the screen shot and log file. 2022-10-06 08:40:00.628846+00:00 [notice] <0.44.0> Application syslog exited with reason: stopped ## RabbitMQ 3.11.0-rc.1########## Copyright (c) 2007-2022 VMware, Inc. or its affiliates. ########## Licensed under the MPL 2.0. Website: https://rabbitmq.com Erlang: 25.0.4 [jit] Doc guides: https://rabbitmq.com/documentation.html Logs: /var/log/rabbitmq/rabbit@3914d01d669b_upgrade.log Config file(s): /etc/rabbitmq/rabbitmq.config Starting broker...2022-10-06 08:40:00.984878+00:00 [info] <0.228.0>
i am referring this point in the tutoiral Access Management UI |
Beta Was this translation helpful? Give feedback.
-
|
Hi @215813 , There are a few odd things.
|
Beta Was this translation helpful? Give feedback.
-
|
Now i changed and wrote Docker file dockerfile: FROM rabbitmq:3.11-management-alpine COPY rabbitmq.config /etc/rabbitmq RUN ls /etc/rabbitmq rabbitmq.config [ running the docker file with the below commands: docker run --rm -it --hostname my-rabbit -p 5672:5672 -p 15672:15672 rabbitmq Even though i am not able to see sso login button |
Beta Was this translation helpful? Give feedback.
-
|
@MarcialRosales can you pls help me on this? i am not able to find the solution |
Beta Was this translation helpful? Give feedback.
-
|
hi @215813 , please try to use the configuration provided in the tutorial and once you get it working you can move on. |
Beta Was this translation helpful? Give feedback.
-
|
"Not management user" means the user record is not tagged with |
Beta Was this translation helpful? Give feedback.
-
|
Thank you so much .. it is working fine now.. |
Beta Was this translation helpful? Give feedback.
-
|
I am glad that it works @215813 . But I insist, the tutorial and all its configuration files and scripts are designed to work. Your user failed because, as you know, it did not have the appropriate scopes. |
Beta Was this translation helpful? Give feedback.
-
|
Hello @MarcialRosales I changed the configurations in rabbitmq to use jwks_url with Keycloak (oauth 2.0). Strange i am getting below error.
My configuration is like below advanced.config [ ]} rabbitmq.conf loopback_users.guest = false auth_oauth2.https.peer_verification = verify_peer ssl_options.fail_if_no_peer_cert = true log.console.level = debug Docker file COPY enabled_plugins /etc/rabbitmq RUN ls /etc/rabbitmq Kindly help me |
Beta Was this translation helpful? Give feedback.
-
|
Hi @215813 . I would like to suggest you to use the official RabbitMQ image rather than building a custom one. Here is an example https://github.com/rabbitmq/rabbitmq-oauth2-tutorial/blob/main/bin/deploy-rabbit#L21-L25. Back to your issue. Make sure keycloak is running in the address Make sure that RabbitMQ docker container can reach keycloak. |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
-
I am trying to implement OAuth 2.0 for RabbitMQ.
I am getting below error in the log.
2022-07-09 05:57:30.188 [error] <0.1668.0> closing AMQP connection <0.1668.0> (172.28.253.12:3269 -> 172.28.70.135:5671 - managmentservice):
{handshake_error,starting,0,{error,function_clause,'connection.start_ok',[{base64,mime_decode_binary,[<<>>,<<48,130,1,34,48,13,6,9,42,134,72,134,247,13,1,1,1,5,0,3,130,1,15,0,48,130,1,10,2,130,1,1,0,151,151,145,29,61,54,84,64,52,196,218,181,60,142,214,150,33,147,97,187,69,175,87,223,186,198,237,18,115,102,235,63,96,94,207,29,179,55,98,145,93,81,179,210,114,209,5,68,22,173,136,181,78,45,174,183,56,236,224,174,128,126,104,8,245,192,41,64,47,78,69,19,103,212,219,227,133,175,213,140,200,216,170,211,65,64,1,1,242,3,149,218,122,171,68,76,92,150,100,106,34,168,18,183,85,94,121,75,160,192,125,152,234,177,46,78,16,99,37,155,151,41,169,176,234,152,59,85,186,26,215,88,137,20,45,17,63,121,158,222,151,30,204,65,62,130,159,92,28,202,47,77,75,137,189,145,175,62,49,141,186,88,134,116,29,153,157,89,149,14,40,68,46,124,207,169,196,146,33,116,110,103,80,85,84,119,159,85,247,145,151,1,100,111,96,39,27,87,85,218,18,101,226,192,129,44,8,192,173,115,206,243,184,83,208,238,10,44,95,198,61,194,240,88,213,179,161,196,30,171,240,177,232,229,25,148,61,189,168,79,93,230,57,225,10,137,127,26,120,169,216,130,192,128,192>>,16,0,1],[{file,"base64.erl"},{line,232}]},{jose_public_key,pem_dec_entry,2,[{file,"src/jose_public_key.erl"},{line,358}]},{jose_public_key,pem_dec,2,[{file,"src/jose_public_key.erl"},{line,346}]},{jose_public_key,pem_decode,1,[{file,"src/jose_public_key.erl"},{line,164}]},{jose_jwk_pem,from_binary,1,[{file,"src/jwk/jose_jwk_pem.erl"},{line,27}]},{jose_jwk,from_pem,1,[{file,"src/jwk/jose_jwk.erl"},{line,449}]},{uaa_jwt_jwk,from_pem,1,[{file,"src/uaa_jwt_jwk.erl"},{line,37}]},{uaa_jwt,decode_and_verify,1,[{file,"src/uaa_jwt.erl"},{line,52}]}]}}
Looking at the Rabbit repository I am anticipating that it is failing at the time of token validation in the below method.
-spec decode_and_verify(binary()) -> {boolean(), map()} | {error, term()}.
decode_and_verify(Token) ->
case uaa_jwt_jwt:get_key_id(Token) of
{ok, KeyId} ->
case get_jwk(KeyId) of
{ok, JWK} ->
uaa_jwt_jwt:decode_and_verify(JWK, Token);
{error, _} = Err ->
Err
end;
{error, _} = Err ->
Err
end.
The KID was set in the Advanced Rabbit config file along with the public key
In .Net Code I am getting below error
The AMQP operation was interrupted: AMQP close-reason, initiated by Library, code=0, text='End of stream', classId=0, methodId=0, cause=System.IO.EndOfStreamException: Reached the end of the stream. Possible authentication failure.
at RabbitMQ.Client.Impl.InboundFrame.ReadFrom(Stream reader, Byte[] frameHeaderBuffer)
at RabbitMQ.Client.Framing.Impl.Connection.MainLoopIteration()
at RabbitMQ.Client.Framing.Impl.Connection.MainLoop()
Beta Was this translation helpful? Give feedback.
All reactions