What resource does ${name} refer to in topic_access_query?

[Magnus Bäck]

With LDAP authorization, topic_access_query supports a number of ${var} substitutions. In that context, what does ${name} mean? The documentation says "the name of the resource", but which resource? The exchange?

(The background is that I want to restrict which routing keys people can use when publishing to the amq.default exchange. The names of our queues are prefixed with the username, so I'd like to check if the routing key begins with the username iff the exchange name is amq.default to enforce that people can only publish directly to their own queues.)

Thanks,

Magnus

[Luke Bakken]

Hi Magnus,

"name" refers to the name of the topic exchange -

https://github.com/rabbitmq/rabbitmq-server/blob/main/deps/rabbitmq_auth_backend_ldap/src/rabbit_auth_backend_ldap.erl#L152-L172

If you increase logging verbosity you should see log messages that show which topic exchange is being checked:

?L("CHECK: ~ts for ~ts", [log_resource(Args), log_user(User)]),