User and permission management in RabbitMQ - Commands & Configuration

Introduction

Managing users and their permissions in RabbitMQ helps control who can access and perform actions on your message broker. This keeps your system safe and organized by giving only the right people the right access.

When you want to allow a new developer to send messages but not delete queues.

When you need to restrict access to certain parts of RabbitMQ for security reasons.

When you want to create a read-only user to monitor message queues.

When you want to remove access for a user who no longer needs it.

When you want to update permissions after changing your application's requirements.

Commands

This command creates a new user named 'alice' with the password 'strongpassword123'.

Terminal

rabbitmqctl add_user alice strongpassword123

Expected Output

Adding user "alice" ...

This command gives user 'alice' full permissions (configure, write, read) on the default virtual host '/'.

Terminal

rabbitmqctl set_permissions -p / alice ".*" ".*" ".*"

Expected Output

Setting permissions for user "alice" in vhost "/" ...

→

-p - Specifies the virtual host where permissions apply

This command lists all users currently configured in RabbitMQ.

Terminal

rabbitmqctl list_users

Expected Output

Listing users ...

alice	[administrator]

This command removes all permissions for user 'alice' on the default virtual host '/'.

Terminal

rabbitmqctl clear_permissions -p / alice

Expected Output

Clearing permissions for user "alice" in vhost "/" ...

→

-p - Specifies the virtual host where permissions are cleared

This command deletes the user 'alice' from RabbitMQ.

Terminal

rabbitmqctl delete_user alice

Expected Output

Deleting user "alice" ...

Key Concept

If you remember nothing else from this pattern, remember: users must be created first, then given specific permissions to control what they can do.

Common Mistakes

Trying to set permissions for a user before creating the user.

RabbitMQ will return an error because the user does not exist yet.

Always create the user first using 'rabbitmqctl add_user' before setting permissions.

Using incorrect virtual host names when setting permissions.

Permissions will not apply if the virtual host does not exist or is misspelled.

Verify the virtual host name with 'rabbitmqctl list_vhosts' and use the exact name.

Giving overly broad permissions like ".*" for all actions without need.

This can lead to security risks by allowing users to do more than necessary.

Grant only the minimum permissions needed for the user's role.

Summary

Create users with 'rabbitmqctl add_user' before assigning permissions.

Set user permissions per virtual host using 'rabbitmqctl set_permissions'.

List users with 'rabbitmqctl list_users' to verify user creation.

Clear permissions with 'rabbitmqctl clear_permissions' before deleting users.

Delete users with 'rabbitmqctl delete_user' when they no longer need access.