I am new to RabbitMQ. I have it installed on Windows 10 Enterpise for development purposes. We have Active Directory running. Trying to set up LDAP for the management plugin, so that any user with the right password can login as administrator.
My latest config:
[
{
rabbit,
[
{
auth_backends, [
{rabbit_auth_backend_ldap, rabbit_auth_backend_internal},
rabbit_auth_backend_internal
]
}
]
},
{
rabbitmq_auth_backend_ldap,
[
{
servers, [
"WLNC0DS23N.na.mycompany.com","WBRD0DS21N.na.mycompany.com"
]
},
{
dn_lookup_attribute, "userPrincipalName"
},
{
dn_lookup_base, "DC=na,DC=mycompany,DC=com"
},
{
user_dn_pattern, "${username}@mycompany.com"
},
{
use_ssl, false
},
{
port, 389
},
{
log, true
},
{
vhost_access_query, {in_group_nested, "CN=NA_WHS,OU=GroupsAndContacts,OU=Exchange,DC=na,DC=mycompany,DC=com","member"}
},
{
resource_access_query, {in_group_nested, "CN=NA_WHS,OU=GroupsAndContacts,OU=Exchange,DC=na,DC=mycompany,DC=com","member"}
},
{
topic_access_query, {in_group_nested, "CN=NA_WHS,OU=GroupsAndContacts,OU=Exchange,DC=na,DC=mycompany,DC=com","member"}
},
{
tag_queries, [
{
administrator, {in_group_nested,"CN=NA_WHS,OU=GroupsAndContacts,OU=Exchange,DC=na,DC=mycompany,DC=com","member"}
}
]
}
]
}
].
Unfortunately, while LDAP seems to check me out ok, I am not able to login in and get this error in the log:
2019-05-28 16:04:14.662 [info] <0.678.0> LDAP CHECK: login for perryda
2019-05-28 16:04:14.663 [info] <0.678.0> LDAP filling template "${username}@mycompany.com" with
[{username,<<"perryda">>}]
2019-05-28 16:04:14.663 [info] <0.678.0> LDAP template result: "[email protected]"
2019-05-28 16:04:14.750 [info] <0.317.0> LDAP bind succeeded: xxxx
2019-05-28 16:04:14.750 [info] <0.317.0> LDAP filling template "${username}@mycompany.com" with
[{username,<<"perryda">>}]
2019-05-28 16:04:14.751 [info] <0.317.0> LDAP template result: "[email protected]"
2019-05-28 16:04:14.753 [info] <0.317.0> LDAP DN lookup: perryda -> CN=Perry\, David,OU=Users,OU=WLNC-Wilmington,OU=OC,OU=IT-SD,DC=na,DC=mycompany,DC=com
2019-05-28 16:04:14.753 [info] <0.317.0> LDAP CHECK: does perryda have tag administrator?
2019-05-28 16:04:14.753 [info] <0.317.0> LDAP evaluating query: {in_group_nested,"CN=NA_WHS,OU=GroupsAndContacts,OU=Exchange,DC=na,DC=mycompany,DC=com","member"}
2019-05-28 16:04:14.753 [info] <0.317.0> LDAP evaluating query: {in_group_nested,"CN=NA_WHS,OU=GroupsAndContacts,OU=Exchange,DC=na,DC=mycompany,DC=com","member",subtree}
2019-05-28 16:04:14.754 [info] <0.317.0> LDAP filling template "CN=NA_WHS,OU=GroupsAndContacts,OU=Exchange,DC=na,DC=mycompany,DC=com" with
[{username,<<"perryda">>},{user_dn,"CN=Perry\\, David,OU=Users,OU=WLNC-Wilmington,OU=OC,OU=IT-SD,DC=na,DC=mycompany,DC=com"}]
2019-05-28 16:04:14.754 [info] <0.317.0> LDAP template result: "CN=NA_WHS,OU=GroupsAndContacts,OU=Exchange,DC=na,DC=mycompany,DC=com"
2019-05-28 16:04:14.759 [info] <0.317.0> LDAP DECISION: does perryda have tag administrator? true
2019-05-28 16:04:14.759 [info] <0.678.0> LDAP DECISION: login for perryda: ok
2019-05-28 16:04:14.759 [warning] <0.678.0> HTTP access denied: user 'perryda' - invalid credentials
Does anyone have a clueon what the problem is, and how to fix?
This answer was posted by Daniil Fedotov in the RabbitMQ Google Group. It worked great!
Hi,
Your auth backend configuration line "{rabbit_auth_backend_ldap, rabbit_auth_backend_internal}," means that the LDAP backend is used only for authentication (checking that the user exists) but not authorization (checking that the user has access to resources), and internal backend is used for authorization. This means that you should have permissions and tags configured for the internal user. If you want authorization to happen via LDAP you should replace this tuple: "{rabbit_auth_backend_ldap, rabbit_auth_backend_internal}" with: "rabbit_auth_backend_ldap". Or create user permissions in the internal database, but I guess that's not what you're trying to achieve.