Support http forward proxy in OAuth 2.0 authentication backend plugin

[MarcialRosales]

Is your feature request related to a problem? Please describe.

When there is a forward proxy in between the Idp and RabbitMQ, RabbitMQ has to use the proxy protocol to contact the idp via the proxy.

Describe the solution you'd like

Allow users to configure Oauth2.0 authentication plugin with the proxy settings to use when connecting to the Idp, either to download signing keys or to download the openid configuration.

Describe alternatives you've considered

No response

Additional context

No response

[dawidbugaj]

Hi @MarcialRosales - do you have some information when the new version of RabbitMQ (with this feature) will be available (in this year or next?),

Thank you :)

[MarcialRosales]

Hi @dawidbugaj , it will be next year.

[dawidbugaj]

@MarcialRosales - cool, thank you for your reply and confirmation :)

[michaelklishin]

@dawidbugaj it will likely ship in Tanzu RabbitMQ, that is, the commercial edition. It is not a core OAuth 2 feature, it is not a part of any OAuth 2/OpenID protocol spec.

Our team has invested a ton of time into OAuth 2 support and we think that supporting OpenID Connect, 5 different IDPs (identity providers) and even two IDPs at the same time (a very rare feature in OSS data services), plus the documentation and examples alone count for a decent OSS feature. We find this more than enough for the open source edition.

Just setting up some expectations, that's all.

[dawidbugaj]

HI @michaelklishin , I'm using Entra ID ( Azure ) as an IDP for authentication to RabbitMQ ( version 4, open source ). The main problem is, that rabbitmq is behind corporate proxy and it seems it can't get validation token, for example:

2024-10-29 14:28:13.500798+01:00 [error] <0.6465.0> OAuth 2 JWT: failed to download keys: {error, 2024-10-29 14:28:13.500798+01:00 [error] <0.6465.0> {failed_connect, 2024-10-29 14:28:13.500798+01:00 [error] <0.6465.0> [{to_address, 2024-10-29 14:28:13.500798+01:00 [error] <0.6465.0> {"[login.microsoftonline.com](http://login.microsoftonline.com/)",443}}, 2024-10-29 14:28:13.500798+01:00 [error] <0.6465.0> {inet,[inet],econnrefused}]}} 2024-10-29 14:28:13.501133+01:00 [warning] <0.6465.0> HTTP access denied: user 'entra id' - invalid credentials

(where entra_id is entra id of application in Azure)

but I can reach login.microsoft.com:

`* Connected to <our_proxy> port (#0)

• allocate connect buffer!
• Establish HTTP proxy tunnel to login.microsoftonline.com:443

CONNECT login.microsoftonline.com:443 HTTP/1.1
Host: login.microsoftonline.com:443
User-Agent: curl/7.61.1
Proxy-Connection: Keep-Alive

< HTTP/1.1 200 Connection established`

It seems, that feature might be helping,

Thanks :)

[michaelklishin]

@dawidbugaj indeed it will. And it will ship in the commercial edition only.

[MarcialRosales]

Delivered in Tanzu RabbitMQ 4.1