Authorization only via JWT (without UAA server)

[h0jeZvgoxFepBQ2C]

Hi,

I just wanted to ask if there is a possibility to to authenticate clients with JWTs, but without a seperate UAA server?
(or I miss something and my question doesnt make any sense)?

F.e. I would like to set up a cert on the rabbitmq server where I can sign JWTs which clients can use then to connect via WebStomp - but only to the channels / actions which are included in the signed JWTs?

For me it's not really clear to me on how to do this with the current documentation, because it always refers to UAA servers?

Thank you!

[michaelklishin]

As of 3.11 there is support for OIDC and more identity providers. "Self-signed JWTs" are not really a scenario we try to cover.

You can use x.509 certificate-based authentication for clients with some protocols..

[michaelklishin]

We don't see enough demand for this case in the community, in particular amongst the largest users.

[h0jeZvgoxFepBQ2C]

I see, sad. So there is no easy way to do this as it seems :(

[h0jeZvgoxFepBQ2C]

Using x509 certificates is quite cumbersome, since I would have to generate each time new certificates for each user, I guess? Looks much easier with JTWs?

[michaelklishin]

If you ask me, using x.509 certificates is easier than setting up all the infrastructure for JWTs.

[michaelklishin]

@h0jeZvgoxFepBQ2C we don't have plans to support "self signed JWTs" at this time. RabbitMQ is open source software, you can contribute support for something like that if you really need this.