Continous question based on https://github.com/rabbitmq/rabbitmq-auth-backend-oauth2/issues/35

[meiting wang]

Hi,

I noticed one of comments in issue#35 of rabbitmq-auth-backend-oauth2.

Our team does not use GitHub issues for questions and discussions.

RabbitMQ 3.8 will be released in the next few months. We are fairly confident that the beta versions are quite stable and early adopters should not run into any major issues. If you really need one of the new features in 3.8, I'd consider starting with beta releases.

This plugin depends on internal authn and authz changes in RabbitMQ server. They were necessary so that authorization operations have access to the password (in 3.7 they don't, as other backends do not need it). This in turn lets you specify the token in the password field. Early versions of this plugin used the username for that but that value is logged in many cases, and since tokens are sensitive values, this was only acceptable for a prototype.
Modifying the plugin will not make it 3.7 compatible. You have to modify RabbitMQ itself.

I'd recommend either not using the plugin or adopting a 3.8 beta. A first 3.8 RC is expected next month.

I have not really tried but a concern is if WEB STOMP plugin can cowork with rabbitmq-auth-backend-oauth2 plugin?

WEB STOMP client connects to RabbitMQ with user and password (access token retreived from auth server), is it possible that RabbitMQ use the specified auth backend to do user authentication and when WEB STOMP client SUBSCRIBE to a destination in RabbitMQ, RabbitMQ can do user authorization based on the translated permission from the access token?

Best Wishes

[Arnaud Cogoluègnes]

The OAuth plugin will be used for any protocol, including STOMP over
web sockets, so a valid token used for a Web STOMP connection should
work accordingly.

> --
> You received this message because you are subscribed to the Google Groups "rabbitmq-users" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to rabbitmq-user...@googlegroups.com.
> To view this discussion on the web, visit https://groups.google.com/d/msgid/rabbitmq-users/6eb6858a-15de-4d6c-af69-6ea91ef02eb5%40googlegroups.com.

[meiting wang]

Thanks for your reply.

在 2019年7月31日星期三 UTC+8下午8:11:37，Arnaud Cogoluègnes写道：

> To unsubscribe from this group and stop receiving emails from it, send an email to rabbitm...@googlegroups.com.