MQTT connector begins to reject connections with the error message "Connection Refused: bad user name or password."

[stajkovicmilan]

Hello,

I'm encountering an issue with my MQTT connection on the RabbitMQ broker. Periodically, the MQTT connector begins to reject connections with the error message "Connection Refused: bad user name or password." However, restarting the broker service seems to temporarily resolve the issue.

My setup consists of three virtual machines, each running a RabbitMQ server under Docker(version: 3.11.16-management). These three machines act as nodes in a RabbitMQ cluster. I have the following plugins enabled:

• rabbitmq_auth_backend_http
• rabbitmq_management
• rabbitmq_management_agent
• rabbitmq_mqtt
• rabbitmq_shovel
• rabbitmq_shovel_management
• rabbitmq_top
• rabbitmq_web_mqtt
• rabbitmq_prometheus

Here's the configuration in my rabbitmq.conf:

loopback_users.guest = false
default_user = {{ rabbitmq_default_user }}
default_pass = {{ rabbitmq_default_pass }}
default_user_tags.administrator = true
default_user_tags.monitoring = true

auth_backends.1 = rabbit_auth_backend_internal
auth_backends.2 = http
auth_http.http_method = get
auth_http.user_path = {{ auth_service_url }}/auth/user
auth_http.vhost_path = {{ auth_service_url }}/auth/vhost
auth_http.resource_path = {{ auth_service_url }}/auth/resource
auth_http.topic_path = {{ auth_service_url }}/auth/topic

mqtt.allow_anonymous = false
mqtt.vhost = {{ rabbitmq_mqtt_vhost }}
mqtt.exchange = root

vm_memory_high_watermark.relative = 0.80
cluster_partition_handling = ignore

I would appreciate any insights or suggestions to address this issue.

[michaelklishin]

@stajkovicmilan we cannot suggest much without logs at debug level. We do not guess in this community.

You use two backends, one of which is a custom HTTP service. At debug level, you'd see what authentication decision each backend returns, and for the HTTP-based one, IIRC even what request(s) it tried to issue in the process.

The default internal database backend does not any kind of credential or account expiration that would be "reset" by a node restart.