Azure+OAuth SSO for RabbitMQ

[ivan-piskunov-betpawa]

Hello!
I need help with implementing Single Sign-On (SSO) in RabbitMQ through Azure and OAuth. I followed this guide: https://www.rabbitmq.com/oauth2-examples-azure.html.

URL is HTTPS: https://rabbitmq-cluster.******.com/

My rabbitmq.config:

    [
      {rabbit, [
        {auth_backends, [rabbit_auth_backend_oauth2, rabbit_auth_backend_internal]}
      ]},
      {rabbitmq_management, [
        {oauth_enabled, true},
        {oauth_client_id, "b082c015-****-****-****-************"},
        {oauth_provider_url, "https://login.microsoftonline.com/36fb51f9-****-****-****-************"}
      ]},
      {rabbitmq_auth_backend_oauth2, [
        {resource_server_id, <<"b082c015-****-****-****-************">>},
        {extra_scopes_source, <<"roles">>},
        {key_config, [
          {jwks_url, <<"https://login.microsoftonline.com/36fb51f9-****-****-****-************/discovery/v2.0/keys">>}
        ]}
      ]}
    ].

In Azure, everything is set up according to the guide, but when I click the Click Here to log in button, it redirects me to enter my email/password/two-factor authentication, and it gives me a Not authorized error.

The logs are as follows:

2023-09-20 08:11:59.780510+00:00 [debug] <0.802.0> User 'b082c015-****-****-****-************' authentication failed with error:#{'__exception__' =>
2023-09-20 08:11:59.780510+00:00 [debug] <0.802.0>                                                                                    true,
2023-09-20 08:11:59.780510+00:00 [debug] <0.802.0>                                                                                '__struct__' =>
2023-09-20 08:11:59.780510+00:00 [debug] <0.802.0>                                                                                    'Elixir.Jason.DecodeError',
2023-09-20 08:11:59.780510+00:00 [debug] <0.802.0>                                                                                data =>
2023-09-20 08:11:59.780510+00:00 [debug] <0.802.0>                                                                                    <<>>,
2023-09-20 08:11:59.780510+00:00 [debug] <0.802.0>                                                                                position =>
2023-09-20 08:11:59.780510+00:00 [debug] <0.802.0>                                                                                    0,
2023-09-20 08:11:59.780510+00:00 [debug] <0.802.0>                                                                                token =>
2023-09-20 08:11:59.780510+00:00 [debug] <0.802.0>                                                                                    nil}:
2023-09-20 08:11:59.780510+00:00 [debug] <0.802.0> [{'Elixir.Jason','decode!',2,
2023-09-20 08:11:59.780510+00:00 [debug] <0.802.0>                  [{file,"lib/jason.ex"},
2023-09-20 08:11:59.780510+00:00 [debug] <0.802.0>                   {line,92},
2023-09-20 08:11:59.780510+00:00 [debug] <0.802.0>                   {error_info,#{module => 'Elixir.Exception'}}]},
2023-09-20 08:11:59.780510+00:00 [debug] <0.802.0>  {uaa_jwt,update_jwks_signing_keys,0,[{file,"uaa_jwt.erl"},{line,63}]},
2023-09-20 08:11:59.780510+00:00 [debug] <0.802.0>  {uaa_jwt,get_jwk,2,[{file,"uaa_jwt.erl"},{line,95}]},
2023-09-20 08:11:59.780510+00:00 [debug] <0.802.0>  {uaa_jwt,decode_and_verify,1,[{file,"uaa_jwt.erl"},{line,75}]},
2023-09-20 08:11:59.780510+00:00 [debug] <0.802.0>  {rabbit_auth_backend_oauth2,check_token,1,
2023-09-20 08:11:59.780510+00:00 [debug] <0.802.0>                              [{file,"rabbit_auth_backend_oauth2.erl"},
2023-09-20 08:11:59.780510+00:00 [debug] <0.802.0>                               {line,183}]},
2023-09-20 08:11:59.780510+00:00 [debug] <0.802.0>  {rabbit_auth_backend_oauth2,authenticate,2,
2023-09-20 08:11:59.780510+00:00 [debug] <0.802.0>                              [{file,"rabbit_auth_backend_oauth2.erl"},
2023-09-20 08:11:59.780510+00:00 [debug] <0.802.0>                               {line,128}]},
2023-09-20 08:11:59.780510+00:00 [debug] <0.802.0>  {rabbit_auth_backend_oauth2,user_login_authentication,2,
2023-09-20 08:11:59.780510+00:00 [debug] <0.802.0>                              [{file,"rabbit_auth_backend_oauth2.erl"},
2023-09-20 08:11:59.780510+00:00 [debug] <0.802.0>                               {line,66}]},
2023-09-20 08:11:59.780510+00:00 [debug] <0.802.0>  {rabbit_access_control,try_authenticate,3,
2023-09-20 08:11:59.780510+00:00 [debug] <0.802.0>                         [{file,"rabbit_access_control.erl"},{line,86}]}]
2023-09-20 08:11:59.780819+00:00 [warning] <0.802.0> HTTP access denied: User 'b082c015-****-****-****-************' authentication failed with internal error. Enable debug logs to see the real error.

In Azure Sign-in logs I see that Status: Success

Unfortunately, I've run out of ideas :(

[ivan-piskunov-betpawa]

Spent 2 days, created a ticket, only to later discover that what was missing is:
management.oauth_client_secret or:

...
      {rabbitmq_management, [
        {oauth_enabled, true},
        {oauth_client_id, "b082c015-****-****-****-************"},
        {oauth_provider_url, "https://login.microsoftonline.com/36fb51f9-****-****-****-************"},
        {oauth_client_secret, "<CLIENTID_SECRET"}
...

It would be helpful to mention this in the main guide, and not only here.

Question can be closed.