OAuth2 Backend: How to get access for adding a binding to a Topic Exchange

[OLibutzki]

Hello everyone,

I would like to a a binding from a queue to a topic exchange for a certain routing key using the Management UI.

My user is authenticated with the OAuth2 Backend and has the following client scopes:

• openid
• profile
• rabbitmq.*
• rabitmag.tag.administrator

The resource server id is set to rabbitmq:
auth_oauth2.resource_server_id = rabbitmq

With these permissions I am able to create queue, exchanges, vhosts,...
Unfortunately I cannot bind a queue to a topic exchange. The RabbitMQ server logs stats:
[warning] <0.1018.0> Binding error: access to topic 'T' in exchange 'X' in vhost '/' refused for user 'U'

After reading the docs carefully I understand that it seems to be an issue with Topic authorization, but I don't have a clue how to authorize the user. Any suggestions?

Thanks a lot.

--- EDIT ---
In the MQTT section of the rabbitmq-oauth2-tutorial I found this chapter:

IMPORTANT: If you try to access the management ui and authenticate with UAA using rabbit_admin you
wont be able to do bind a queue with routing_key test to the amq.topic exchange because that user
in UAA does not have the required permissions. In our handcrafted token, you have granted ourselves the right permissions/scopes.

Sounds like the problem I have, but I have no idea how to solve this. I do not know what the handcrafted token is and who it grants the required permissions.

[michaelklishin]

Support for Auth 2 in AMQP 1.0 has just recently landed, MQTT is likely to be investigated next.

@MarcialRosales FYI.

[OLibutzki]

Is it worth opening an issue or is it intended not to be supported?

[ansd]

I don't see a reason why variable expansion in topic permission patterns should only be supported by rabbit_auth_backend_internal. It makes sense to me to support it also for other auth backends. Feel free to open an issue and to submit a PR.

[OLibutzki]

Ok, I created an issue: #7178.

[brunomedeirosdedalus]

Did you try adding the permission <resource_id>.configure:*/*/*, <resource_id>.read:*/*/* and <resource_id>.write:*/*/* for instance?

[OLibutzki]

Yes, it works using this. My fault was that I just granted <resource_id>.configure:*/*, <resource_id>.read:*/* and <resource_id>.write:*/* . I have been missing the last asterisk for the topic auth part.