Config for passing credential from ws to http_auth

[wiryonolau]

Hi, I'm confuse since there is two configuration in rabbitmq

I need to pass credential from js to rabbitmq and rabbitmq to http auth backend
Currently it can connect but the credential I receive in http auth always guest guest

I'm running using docker rabbitmq:11-alpine

rabbitmq.conf

loopback_users = none
loopback_users.guest = false
listeners.tcp.default = 5672
log.file.level = debug
web_stomp.tcp.port = 12345
web_stomp.use_http_auth = true

auth_backends.1 = http
auth_http.http_method   = post
auth_http.user_path     = http://***/account/auth/user

enabled_plugins

[
    rabbitmq_web_stomp
].

Stompjs connection
using https://github.com/stomp-js/stompjs
here I'm sending user as login and password as passcode

const client = new StompJs.Client({
    brokerURL: 'ws://rabbitmq:12345/ws',
    connectHeaders: {
        "login": 'user',
        "passcode": 'password',
    },
    debug: function(str) {
        console.log(str);
    },
    reconnectDelay: 5000,
    heartbeatIncoming: 4000,
    heartbeatOutgoing: 4000,
});

client.onConnect = function(frame) {
    // Do something, all subscribes must be done is this callback
    // This is needed because this will be executed after a (re)connect
};

client.onStompError = function(frame) {
    // Will be invoked in case of error encountered at Broker
    // Bad login/passcode typically will cause an error
    // Complaint brokers will set `message` header with a brief message. Body may contain details.
    // Compliant brokers will terminate the connection after any error
    console.log('Broker reported error: ' + frame.headers['message']);
    console.log('Additional details: ' + frame.body);
};

client.activate();

Js log

Opening Web Socket... login:24:25
Web Socket Opened... login:24:25
>>> CONNECT
login:user
passcode:password
accept-version:1.0,1.1,1.2
heart-beat:4000,4000

login:24:25
Received data login:24:25
<<< CONNECTED
version:1.2
heart-beat:4000,4000
session:session-8NAVIcyLoXE--QdV7eLm-Q
server:RabbitMQ/3.11.4
content-length:0

login:24:25
connected to server RabbitMQ/3.11.4 login:24:25

Backend auth receive guest guest instead of user password

2022-12-11T00:41:57+00:00 DEBUG (7): array (
   'username' => 'guest',
   'password' => 'guest',
   'vhost' => '/',
)

auth is working ok from rabbitmq to http_auth backend

rabbitmqctl authenticate_user "user" "password"
Authenticating user "user" ...
Success

# App backend log
2022-12-11T02:48:59+00:00 DEBUG (7): array (
  'username' => 'user',
  'password' => 'password',
)

Is there any config I haven't set ?

[michaelklishin]

Enable debug logging, IIRC nodes log what various backends return at debug level.

[wiryonolau]

log.file.level = debug only show this

rmq  | 2022-12-17 01:18:13.695823+00:00 [info] <0.559.0> accepting STOMP connection <0.559.0> (172.21.0.3:39610 -> 172.21.0.3:61613)
rmq  | 2022-12-17 01:18:13.696450+00:00 [info] <0.559.0> closing STOMP connection <0.559.0> (172.21.0.3:39610 -> 172.21.0.3:61613)

app  | 172.21.0.7 -  17/Dec/2022:01:18:14 +0000 "GET /index.php" 200
app  | 172.21.0.7 -  17/Dec/2022:01:18:15 +0000 "GET /index.php" 200
app  | 172.21.0.7 -  17/Dec/2022:01:18:15 +0000 "GET /index.php" 200
app  | 2022-12-17T01:18:15+00:00 DEBUG (7): array (
app  |   0 => 
app  |   array (
app  |     'Connection' => 
app  |     array (
app  |       0 => 'keep-alive',
app  |     ),
app  |     'Host' => 
app  |     array (
app  |       0 => 'nginx',
app  |     ),
app  |     'Te' => 
app  |     array (
app  |       0 => '',
app  |     ),
app  |     'Content-Length' => 
app  |     array (
app  |       0 => '45',
app  |     ),
app  |     'Content-Type' => 
app  |     array (
app  |       0 => 'application/x-www-form-urlencoded',
app  |     ),
app  |   ),
app  |   1 => 
app  |   array (
app  |     'type' => 'user',
app  |   ),
app  |   2 => 
app  |   array (
app  |     'username' => 'usertest',
app  |     'password' => 'passtest',
app  |     'vhost' => '/',
app  |   ),
app  | )
app  | 172.21.0.7 -  17/Dec/2022:01:18:15 +0000 "POST /index.php" 200
app  | 2022-12-17T01:18:15+00:00 DEBUG (7): array (
app  |   0 => 
app  |   array (
app  |     'Connection' => 
app  |     array (
app  |       0 => 'keep-alive',
app  |     ),
app  |     'Host' => 
app  |     array (
app  |       0 => 'nginx',
app  |     ),
app  |     'Te' => 
app  |     array (
app  |       0 => '',
app  |     ),
app  |     'Content-Length' => 
app  |     array (
app  |       0 => '47',
app  |     ),
app  |     'Content-Type' => 
app  |     array (
app  |       0 => 'application/x-www-form-urlencoded',
app  |     ),
app  |   ),
app  |   1 => 
app  |   array (
app  |     'type' => 'vhost',
app  |   ),
app  |   2 => 
app  |   array (
app  |     'username' => 'usertest',
app  |     'vhost' => '/',
app  |     'ip' => '172.21.0.1',
app  |     'tags' => '',
app  |   ),
app  | )
app  | 172.21.0.7 -  17/Dec/2022:01:18:15 +0000 "POST /index.php" 200

Is there a key or config to pass value from connect headers to http auth ?

[michaelklishin]

loopback_users = none
loopback_users.guest = false

Does not do what you think it does. It enables remote login for the default user which by default and in your case uses well known credentials. This is a really bad idea, even though you are supposedly disable the internal backend by not listing it.

[wiryonolau]

So I just need to remove this entry ?