User and permission management in RabbitMQ - Commands & Configuration

Introduction

Managing users and their permissions in RabbitMQ helps control who can access and perform actions on your message broker. This keeps your system safe and organized by giving only the right people the right access.

When you want to allow a new developer to send messages but not delete queues.

When you need to restrict access to certain parts of RabbitMQ for security reasons.

When you want to create a read-only user to monitor message queues.

When you want to remove access for a user who no longer needs it.

When you want to update permissions after changing your application's requirements.

Commands

This command creates a new user named 'alice' with the password 'strongpassword123'.

Terminal

rabbitmqctl add_user alice strongpassword123

Expected Output

Adding user "alice" ...

This command gives user 'alice' full permissions (configure, write, read) on the default virtual host '/'.

Terminal

rabbitmqctl set_permissions -p / alice ".*" ".*" ".*"

Expected Output

Setting permissions for user "alice" in vhost "/" ...

→

-p - Specifies the virtual host where permissions apply

This command lists all users currently configured in RabbitMQ.

Terminal

rabbitmqctl list_users

Expected Output

Listing users ...

alice	[administrator]

This command removes all permissions for user 'alice' on the default virtual host '/'.

Terminal

rabbitmqctl clear_permissions -p / alice

Expected Output

Clearing permissions for user "alice" in vhost "/" ...

→

-p - Specifies the virtual host where permissions are cleared

This command deletes the user 'alice' from RabbitMQ.

Terminal

rabbitmqctl delete_user alice

Expected Output

Deleting user "alice" ...

Key Concept

If you remember nothing else from this pattern, remember: users must be created first, then given specific permissions to control what they can do.

Common Mistakes

Trying to set permissions for a user before creating the user.

RabbitMQ will return an error because the user does not exist yet.

Always create the user first using 'rabbitmqctl add_user' before setting permissions.

Using incorrect virtual host names when setting permissions.

Permissions will not apply if the virtual host does not exist or is misspelled.

Verify the virtual host name with 'rabbitmqctl list_vhosts' and use the exact name.

Giving overly broad permissions like ".*" for all actions without need.

This can lead to security risks by allowing users to do more than necessary.

Grant only the minimum permissions needed for the user's role.

Summary

Create users with 'rabbitmqctl add_user' before assigning permissions.

Set user permissions per virtual host using 'rabbitmqctl set_permissions'.

List users with 'rabbitmqctl list_users' to verify user creation.

Clear permissions with 'rabbitmqctl clear_permissions' before deleting users.

Delete users with 'rabbitmqctl delete_user' when they no longer need access.

Practice

1. What is the primary purpose of RabbitMQ user management?

easy

A. To monitor message queue performance

B. To configure network settings for RabbitMQ

C. To control who can access RabbitMQ and what they can do

D. To backup RabbitMQ data automatically

Solution

1. Step 1: Understand user management role

   User management in RabbitMQ controls access by defining users who can connect.

2. Step 2: Understand permission role

   Permissions define what actions users can perform on queues and exchanges.

3. Final Answer:

   To control who can access RabbitMQ and what they can do -> Option C

4. Quick Check:

   User management = Access control [OK]

Hint: User management = who can do what in RabbitMQ [OK]

Common Mistakes:

• Confusing user management with monitoring
• Thinking permissions configure network
• Assuming user management handles backups

2. Which command correctly adds a new user named alice with password secret123 in RabbitMQ?

easy

A. rabbitmqctl new_user alice secret123

B. rabbitmqctl add_user alice secret123

C. rabbitmqctl user_add alice secret123

D. rabbitmqctl create_user alice secret123

Solution

1. Step 1: Recall RabbitMQ user creation syntax

   The correct command to add a user is rabbitmqctl add_user username password.

2. Step 2: Match command with options

   Only rabbitmqctl add_user alice secret123 matches the correct syntax exactly.

3. Final Answer:

   rabbitmqctl add_user alice secret123 -> Option B

4. Quick Check:

   add_user command adds user [OK]

Hint: Use add_user to create users, not create_user [OK]

Common Mistakes:

• Using create_user instead of add_user
• Swapping username and password order
• Using commands that don't exist

3. What will be the output of the following command if user bob has permissions to configure and write to all queues but no read permission?

rabbitmqctl list_user_permissions bob

medium

A. Config: .* Write: .* Read: ""

B. Config: "" Write: "" Read: ""

C. Config: .* Write: .* Read: .*

D. Config: .* Write: "" Read: .*

Solution

1. Step 1: Understand permission patterns

   Permissions use regex patterns: .* means all, "" means none.

2. Step 2: Match permissions to output

   Bob has configure and write permissions to all queues, so those are .*. No read permission means empty string "".

3. Final Answer:

   Config: .* Write: .* Read: "" -> Option A

4. Quick Check:

   Permissions regex = C [OK]

Hint: Empty quotes mean no permission, .* means full permission [OK]

Common Mistakes:

• Assuming missing permission shows as .*
• Confusing read and write permissions
• Misreading empty string as no permission

4. You run rabbitmqctl set_permissions -p / myuser ".*" ".*" ".*" but get an error saying user myuser does not exist. What is the most likely fix?

medium

A. Restart RabbitMQ server before setting permissions

B. Change the virtual host name from / to default

C. Remove the -p option from the command

D. Create the user first using rabbitmqctl add_user myuser password

Solution

1. Step 1: Understand error cause

   Setting permissions requires the user to exist first; error means user missing.

2. Step 2: Fix by creating user

   Use rabbitmqctl add_user myuser password to create the user before setting permissions.

3. Final Answer:

   Create the user first using rabbitmqctl add_user myuser password -> Option D

4. Quick Check:

   User must exist before permissions [OK]

Hint: Add user before setting permissions [OK]

Common Mistakes:

• Trying to set permissions on non-existent user
• Changing virtual host unnecessarily
• Restarting server without fixing user

5. You want to create a user carol who can only read from queues in the virtual host vhost1. Which sequence of commands correctly achieves this?

hard

A. rabbitmqctl add_user carol pass123rabbitmqctl set_permissions -p vhost1 carol "" "" ".*"

B. rabbitmqctl add_user carol pass123rabbitmqctl set_permissions -p vhost1 carol ".*" ".*" ".*"

C. rabbitmqctl add_user carol pass123rabbitmqctl set_permissions -p vhost1 carol ".*" "" ""

D. rabbitmqctl add_user carol pass123rabbitmqctl set_permissions -p vhost1 carol "" ".*" ""

Solution

1. Step 1: Create user carol

   Use rabbitmqctl add_user carol pass123 to add the user.

2. Step 2: Set read-only permissions

   Set configure and write permissions to empty string "", and read permission to ".*" for all queues in vhost1.

3. Final Answer:

   rabbitmqctl add_user carol pass123
   rabbitmqctl set_permissions -p vhost1 carol "" "" ".*" -> Option A

4. Quick Check:

   Read-only = config "", write "", read ".*" [OK]

Hint: Set empty config/write, full read permission for read-only user [OK]

Common Mistakes:

• Giving full permissions instead of read-only
• Mixing up permission order (config, write, read)
• Forgetting to specify virtual host