Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 187b771

Browse files
MarcialRosalesMarcialRosales
committed
Add use case for oauth2-proxy
1 parent ef7ab49 commit 187b771

File tree

17 files changed

+482
-49
lines changed

17 files changed

+482
-49
lines changed

‎Makefile‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,12 @@ stop-uaa: ## Stop uaa
3030
stop-keycloak: ## Stop keycloak
3131
@docker kill keycloak
3232

33+
start-oauth2-proxy: ## Start oauth2-proxy
34+
@bin/oauth2-proxy/deploy
35+
36+
stop-oauth2-proxy: ## Stop oauth2-proxy
37+
@docker-compose -f conf/oauth2-proxy/compose.yml down
38+
3339
start-rabbitmq: ## Run RabbitMQ Server
3440
@./bin/deploy-rabbit
3541

‎README.md‎

Lines changed: 22 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@ If you want to understand the details of how to configure RabbitMQ with Oauth2 g
2424
- [JMS protocol](#jms-protocol)
2525
- [MQTT protocol](#mqtt-protocol)
2626
- [AMQP 1.0 protocol](#amqp-10-protocol)
27+
- [Messaging on Topic Exchanges](#messaging-on-topic-exchanges)
2728
- Use advanced OAuth 2.0 configuration
2829
- [Use custom scope field](#use-custom-scope-field)
2930
- [Use multiple asymmetrical signing keys](#use-multiple-asymmetrical-signing-keys)
@@ -34,7 +35,7 @@ If you want to understand the details of how to configure RabbitMQ with Oauth2 g
3435
- [KeyCloak](use-cases/keycloak.md)
3536
- [https://auth0.com/](use-cases/auth0.md)
3637
- [Azure Active Directory](use-cases/azure.md)
37-
38+
- [Oauth2 proxy](use-cases/oauth2-proxy.md)
3839
- [Understand the environment](#understand-the-environment)
3940
- [RabbitMQ server](#rabbitmq-server)
4041
- [UAA server](#uaa-server)
@@ -337,6 +338,26 @@ And send a message. It uses the *client_id* `jms_producer`, declared in UAA, to
337338
make start-amqp1_0-publisher
338339
```
339340

341+
## Messaging on Topic Exchanges
342+
343+
This section has been dedicated exclusively to explain what scopes you need in order to operate on **Topic Exchanges**.
344+
345+
**NOTE**: None of the users and/or clients declared in any of Authorization servers provided by this tutorial have the
346+
appropriate scopes to operate on **Topic Exchanges**. In the [MQTT Protocol](#mqtt-protocol) section, the application
347+
used a hand-crafted token with the scopes to operate on **Topic Exchanges**.
348+
349+
To bind and/or unbind a queue to/from a **Topic Exchange**, you need to have the following scopes:
350+
351+
- **write** permission on the queue and routing key -> `rabbitmq.write:<vhost>/<queue>/<routingkey>`
352+
> e.g. `rabbitmq.write:*/*/*`
353+
354+
- **read** permission on the exchange and routing key -> `rabbitmq.write:<vhost>/<exchange>/<routingkey>`
355+
> e.g. `rabbitmq.read:*/*/*`
356+
357+
To publish to a **Topic Exchange**, you need to have the following scope:
358+
359+
- **write** permission on the exchange and routing key -> `rabbitmq.write:<vhost>/<exchange>/<routingkey>`
360+
> e.g. `rabbitmq.write:*/*/*`
340361
341362

342363
## Use advanced OAuth 2.0 configuration

‎bin/deploy-rabbit‎

Lines changed: 16 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,10 @@
11
#!/usr/bin/env bash
22

3-
43
SCRIPT="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
54

65
MODE=${MODE:-uaa}
7-
CONFIG=${CONFIG:-rabbitmq.config}
8-
IMAGE_TAG=${IMAGE_TAG:-3.11.9-management}
6+
CONFIG=${CONFIG:-rabbitmq.conf}
7+
IMAGE_TAG=${IMAGE_TAG:-3.11-management}
98
IMAGE=${IMAGE:-rabbitmq}
109

1110
function generate-ca-server-client-kpi {
@@ -42,12 +41,24 @@ function deploy {
4241
-v $SCRIPT/../conf/${MODE}/certs/basic/server_localhost/cert.pem:/etc/rabbitmq/rabbitmq.crt"
4342
fi
4443

44+
SIGNING_KEY_FILE=$SCRIPT/../conf/${MODE}/signing-key/signing-key.pem
45+
if [ -f "$SIGNING_KEY_FILE" ]; then
46+
EXTRA_MOUNTS="${EXTRA_MOUNTS} -v ${SIGNING_KEY_FILE}:/etc/rabbitmq/signing-key.pem"
47+
fi
48+
49+
MOUNT_RABBITMQ_CONFIG="/etc/rabbitmq/rabbitmq.config"
50+
51+
if [[ "$CONFIG" == *.conf ]]
52+
then
53+
MOUNT_RABBITMQ_CONFIG="/etc/rabbitmq/rabbitmq.conf"
54+
fi
55+
4556
docker network inspect rabbitmq_net >/dev/null 2>&1 || docker network create rabbitmq_net
4657
docker rm -f rabbitmq 2>/dev/null || echo "rabbitmq was not running"
47-
echo "running RabbitMQ with Idp $MODE and configuration file conf/$MODE/$CONFIG"
58+
echo "running RabbitMQ ($IMAGE:$IMAGE_TAG) with Idp $MODE and configuration file conf/$MODE/$CONFIG"
4859
docker run -d --name rabbitmq --net rabbitmq_net \
4960
-p 15672:15672 -p 5672:5672 ${EXTRA_PORTS}\
50-
-v ${SCRIPT}/../conf/${MODE}/${CONFIG}:/etc/rabbitmq/rabbitmq.config:ro \
61+
-v ${SCRIPT}/../conf/${MODE}/${CONFIG}:${MOUNT_RABBITMQ_CONFIG}:ro \
5162
-v ${SCRIPT}/../conf/enabled_plugins:/etc/rabbitmq/enabled_plugins \
5263
-v ${SCRIPT}/../conf:/conf ${EXTRA_MOUNTS} ${IMAGE}:${IMAGE_TAG}
5364
}

‎bin/keycloak/deploy‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,11 +9,17 @@ docker rm -f keycloak 2>/dev/null || echo "keycloak was not running"
99

1010
echo "Running keycloack docker image ..."
1111

12+
SIGNING_KEY_FILE=$SCRIPT/../conf/${MODE}/signing-key/signing-key.pem
13+
if [ -f "$SIGNING_KEY_FILE" ]; then
14+
EXTRA_MOUNTS="${EXTRA_MOUNTS} -v ${SIGNING_KEY_FILE}:/etc/rabbitmq/signing-key.pem"
15+
fi
16+
1217
docker run \
1318
--detach \
1419
--name keycloak --net rabbitmq_net \
1520
--publish 8080:8080 \
1621
--env KEYCLOAK_ADMIN=admin \
1722
--env KEYCLOAK_ADMIN_PASSWORD=admin \
1823
--mount type=bind,source=${ROOT}/conf/keycloak/import/,target=/opt/keycloak/data/import/ \
24+
${EXTRA_MOUNTS} \
1925
quay.io/keycloak/keycloak:20.0 start-dev --import-realm

‎bin/oauth2-proxy/deploy‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
#!/usr/bin/env bash
2+
3+
SCRIPT="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
4+
5+
ROOT=$SCRIPT/../..
6+
7+
docker network inspect rabbitmq_net >/dev/null 2>&1 || docker network create rabbitmq_net
8+
docker-compose -f $ROOT/conf/oauth2-proxy/compose.yml down 2>/dev/null || echo "oauth2-proxy was not running"
9+
10+
echo "Running oauth2-proxy docker image ..."
11+
12+
export OAUTH2_PROXY_COOKIE_SECRET=`python -c 'import os,base64; print(base64.b64encode(os.urandom(16)).decode("ascii"))'`
13+
docker-compose -f $ROOT/conf/oauth2-proxy/compose.yml up

‎conf/auth0/rabbitmq.conf‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
auth_backends.1 = rabbit_auth_backend_oauth2
2+
3+
management.oauth_enabled = true
4+
management.oauth_client_id = REPLACD
5+
management.oauth_scopes = openid profile rabbitmq.tag:administrator
6+
management.oauth_provider_url = https://dev-prbc0gw4.us.auth0.com
7+
8+
auth_oauth2.resource_server_id = rabbitmq
9+
auth_oauth2.preferred_username_claims.1 = user_name
10+
auth_oauth2.additional_scopes_key = permissions
11+
auth_oauth2.jwks_url = https://dev-prbc0gw4.us.auth0.com/.well-known/jwks.json

0 commit comments

Comments
 (0)