Skip to content

Commit af4b486

Browse files
Update scope aliases example
1 parent fd151ed commit af4b486

File tree

2 files changed

+9
-9
lines changed

2 files changed

+9
-9
lines changed

docs/oauth2-examples/index.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -531,6 +531,7 @@ make curl-with-token URL=http://localhost:15672/api/overview TOKEN=$(bin/jwt_tok
531531
### Using Scope Aliases {#using-scope-aliases}
532532

533533
This example demonstrates how to use custom scopes with RabbitMQ.
534+
534535
**UAA** identity provider has been configured with two clients (`producer_with_roles`
535536
and `consumer_with_roles`) with the following custom scopes:
536537
`producer_with_roles` with

docs/oauth2.md

Lines changed: 8 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -139,7 +139,7 @@ In chronological order, here is the sequence of events that occur when a client
139139
| `auth_oauth2.resource_server_type` | The Resource Server Type required when using [Rich Authorization Request](#rich-authorization-request) token format
140140
| `auth_oauth2.additional_scopes_key` | Configure the plugin to look for scopes in other fields (maps to `additional_rabbitmq_scopes` in the old format). |
141141
| `auth_oauth2.scope_prefix` | [Configure the prefix for all scopes](#scope-prefix). The default value is `auth_oauth2.resource_server_id` followed by the dot `.` character.
142-
| `auth_oauth2.scope_aliases` | [Configure scope aliases](#scope-aliases).
142+
| `auth_oauth2.scope_aliases` | [Configure scope aliases](#scope-aliases). See this [example](oauth2-examples#using-scope-aliases).
143143
| `auth_oauth2.preferred_username_claims` | [List of the JWT claims](#preferred-username-claims) to look for the username associated with the token.
144144
| `auth_oauth2.default_key` | ID of the default signing key.
145145
| `auth_oauth2.signing_keys` | Paths to the [signing key files](#signing-key-files).
@@ -194,34 +194,33 @@ auth_oauth2.scope_prefix = ''
194194
An scope alias is a mapping between a custom scope and a RabbitMQ's scope. A custom
195195
scope is any scope which is not recogonized by RabbitMQ.
196196

197-
Scope aliases are necessary when you can create RabbitMQ scopes in your
198-
identity provider. Instead you have to name scopes following a format which is not
197+
Scope aliases are necessary when you cannot create RabbitMQ scopes in your
198+
identity provider. Instead you have to name them following a format which is not
199199
recognizable by RabbitMQ.
200200

201201
For instance, say you have these two roles in your identity provider:
202202
- `admin`.
203203
- `developer`.
204-
An OAuth token may carry those roles in the claim `scope` or in the claim `roles`.
205-
Either way you want to map those roles to the following RabbitMQ scopes:
204+
205+
Also say that you want to map those roles to the following RabbitMQ scopes:
206206
- `admin` to `rabbitmq.tag:administrator rabbitmq.read:*/`
207207
- `developer` to `rabbitmq.tag:management rabbitmq.read:*/* rabbitmq.write:*/* rabbitmq.configure:*/*`
208208

209209
You configure the scope aliases as follows. The mapping can be 1:1 or 1:many:
210210
```ìni
211211
# ...
212-
auth_oauth2.scope_prefix = rabbitmq.
213212
auth_oauth2.scope_aliases.admin = rabbitmq.tag:administrator rabbitmq.read:*/
214213
auth_oauth2.scope_aliases.developer = rabbitmq.tag:management rabbitmq.read:*/* rabbitmq.write:*/* rabbitmq.configure:*/*
215214
# ...
216215
```
217216

218217
Sometimes, the alias is not made of a single word but instead it uses special characters
219-
and symbols such as `api://admin` or `api://developer`. In those cases, you can configure the scope aliases as follows:
218+
and symbols including the separator character `.`. In those cases, you can configure the scope aliases as follows:
219+
```ìni
220220
# ...
221-
auth_oauth2.scope_prefix = rabbitmq.
222221
auth_oauth2.scope_aliases.1.alias = api://admin
223222
auth_oauth2.scope_aliases.1.scope = rabbitmq.tag:administrator rabbitmq.read:*/
224-
auth_oauth2.scope_aliases.2.alias = api://developer
223+
auth_oauth2.scope_aliases.2.alias = api://developer.All
225224
auth_oauth2.scope_aliases.2.scope = rabbitmq.tag:management rabbitmq.read:*/* rabbitmq.write:*/* rabbitmq.configure:*/*
226225
# ...
227226
```

0 commit comments

Comments
 (0)