Skip to content

Optionally allow separate configuration of auth_backends for all HTTP-based plugins (protocols, APIs) #13464

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed

Conversation

aaron-seo
Copy link
Contributor

@aaron-seo aaron-seo commented Mar 6, 2025

Proposed Changes

As discussed here #13205, and on community Slack, this PR allows a separate configuration of auth_backends for web_dispatch_access_control. This configuration is optional and designed to fallback to the regular auth_backends config, if not-configured.

Tested with the following configs (and retested with http_dispatch prefix)

Config 1 (empty):

# empty

Mgmt UI Auth with internal works, debug logs present for "fallback"

Config 2:

http_dispatch.auth_backends.1 = internal

Mgmt UI Auth with internal works, AMQP Auth with internal works, no debug logs for "fallback"

Config 3:

auth_backends.1 = ldap

Mgmt UI Auth with internal does not work, AMQP Auth with internal does not work, debug logs present for "fallback".

Config 4:

http_dispatch.auth_backends.1 = ldap

Mgmt UI Auth with internal does not work, AMQP Auth with internal works, no debug logs for "fallback"

Please describe the big picture of your changes here to communicate to the RabbitMQ team why we should accept this pull request.
If it fixes a bug or resolves a feature request, be sure to link to that issue.

A pull request that doesn't explain why the change was made has a much lower chance of being accepted.

Types of Changes

What types of changes does your code introduce to this project?
Put an x in the boxes that apply

  • Bug fix (non-breaking change which fixes issue #NNNN)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause an observable behavior change in existing systems)
  • Documentation improvements (corrections, new content, etc)
  • Cosmetic change (whitespace, formatting, etc)
  • Build system and/or CI

Checklist

Put an x in the boxes that apply.
You can also fill these out after creating the PR.
If you're unsure about any of them, don't hesitate to ask on the mailing list.
We're here to help!
This is simply a reminder of what we are going to look for before merging your code.

  • I have read the CONTRIBUTING.md document
  • I have signed the CA (see https://cla.pivotal.io/sign/rabbitmq)
  • I have added tests that prove my fix is effective or that my feature works
  • [] All tests pass locally with my changes (only ran web_dispatch suites, which passed)
  • If relevant, I have added necessary documentation to https://github.com/rabbitmq/rabbitmq-website
  • If relevant, I have added this change to the first version(s) in release-notes that I expect to introduce it

Further Comments

If this is a relatively large or complex change, kick off the discussion by explaining why you chose the solution
you did and what alternatives you considered, etc.

@aaron-seo aaron-seo closed this Mar 6, 2025
@aaron-seo aaron-seo reopened this Mar 6, 2025
@michaelklishin michaelklishin changed the title Optionally allow separate configuration of auth backends for web_dispatch Optionally allow separate configuration of auth_backends for all HTTP-based plugins (protocols, APIs) Mar 6, 2025
@michaelklishin
Copy link
Collaborator

@aaron-seo I'm afraid the fallback message is logged so often that it's beyond reasonable even at debug level. For example, starting a node with a management UI open and running two HTTP API client/tool test suites produces pages and pages of debug messages (one for every API request).

michaelklishin added a commit that referenced this pull request Mar 7, 2025
Doing so for every HTTP API request is excessive
even at debug level.
michaelklishin added a commit that referenced this pull request Mar 7, 2025
Doing so for every HTTP API request is excessive
even at debug level.

(cherry picked from commit 830374c)
@michaelklishin
Copy link
Collaborator

michaelklishin commented Mar 7, 2025

Accepted with a small logging-related change in #13465

mergify bot pushed a commit that referenced this pull request Mar 7, 2025
Doing so for every HTTP API request is excessive
even at debug level.

(cherry picked from commit 830374c)
(cherry picked from commit a8a8249)
mergify bot pushed a commit that referenced this pull request Mar 7, 2025
Doing so for every HTTP API request is excessive
even at debug level.

(cherry picked from commit 830374c)
(cherry picked from commit a8a8249)
(cherry picked from commit 888b57c)
michaelklishin added a commit that referenced this pull request Mar 12, 2025
Doing so for every HTTP API request is excessive
even at debug level.

(cherry picked from commit 830374c)
michaelklishin added a commit that referenced this pull request Mar 17, 2025
Doing so for every HTTP API request is excessive
even at debug level.

(cherry picked from commit 830374c)
ikavgo pushed a commit that referenced this pull request May 5, 2025
Doing so for every HTTP API request is excessive
even at debug level.

(cherry picked from commit 830374c)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants