Deprecate two OAuth2 settings: auth_oauth2.jwks_url and management.metadata_url #12399
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
MarcialRosales
changed the title
MarcialRosales
changed the base branch from
main
to
make-some-oauth2-settings-optional
MarcialRosales
changed the title
MarcialRosales
force-pushed
the
deprecate-oauth2-settings
branch
from
d70d6b2 to
2586207
Compare
This was referenced Oct 2, 2024
michaelklishin
changed the title
Collaborator
|
@MarcialRosales can you please resolve the conflicts? Thank you. |
MarcialRosales
force-pushed
the
deprecate-oauth2-settings
branch
from
5ab8dd0 to
7ea48d7
Compare
MarcialRosales
force-pushed
the
make-some-oauth2-settings-optional
branch
from
0ac9e5f to
d98eb17
Compare
MarcialRosales
force-pushed
the
deprecate-oauth2-settings
branch
from
7ea48d7 to
12134e3
Compare
Collaborator
|
@MarcialRosales the suite failures in CI seem very repeatable. |
MarcialRosales
force-pushed
the
deprecate-oauth2-settings
branch
from
7fb79ac to
987cee6
Compare
jwks_uri takes precedence when both are set
If oauth_metadata_url is configured, RabbitMQ uses it. Else it uses the discovery_endpoint url calculated from issuer and discovery_endpoint_path
michaelklishin
force-pushed
the
deprecate-oauth2-settings
branch
from
987cee6 to
0f1b876
Compare
Collaborator
|
The forced push was a rebase on top of |
michaelklishin
approved these changes
Oct 9, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Proposed Changes
Implements these 2 features which essentially deprecate two settings:
auth_oauth2.jwks_urland its corresponding erlang config entry #12239management.metadata_urland move it toauth_oauth2.discovery_endpoint_path#12237This PR adds two new settings while keeping the old ones until 4.2.x when they will be removed.
If the user configures the legacy
management.oauth_metadata_urlormanagement.oauth_resource_server.$name.oauth_metadata_urlvariables, RabbitMQ uses it. Else, the RabbitMQ uses the calculated discover endpoint url which usesissueranddiscovery_endpoint_pathanddiscovery_endpoint_params.RabbitMQ will use the legacy
auth_oauth2.jwks_urlvariable unlessauth_oauth2.jwks_uriis not set.If both are set, RabbitMQ favours the new setting,
auth_oauth2.jwks_uri.IMPORTANT NOTE: This PR depends on #12258. Once that PR is merged, this PR should be rebased and then merged.
This PR is accompanied by a docs PR rabbitmq/rabbitmq-website#2084.
Types of Changes
What types of changes does your code introduce to this project?
Put an
xin the boxes that applyRelease note
It should be mentioned in the release notes that
auth_oauth2.jwks_urlandmanagement.oauth_metadata_urlare deprecated and in 4.2.0 they will be removed.Any reference to
auth_oauth2.jwks_urlshould be renamed toauth_oauth2.jwks_uri.Any reference in the legacy schema to
rabbitmq_auth_backend_oauth2.key_config.jwks_urlshould be replaced byrabbitmq_auth_backend_oauth2.jwks_uri.Any reference to
management.oauth_metadata_urlshould be removed and instead configure theauth_oauth2.discovery_endpoint_pathaccordingly. There is a section in the docs that cover this in detail. Likewise withmanagement.oauth_resource_servers.$name.oauth_metadata_url.cc @pstack2021