Authentication backends (LDAP, OAuth) in RabbitMQ - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding LDAP Authentication in RabbitMQ

Which statement correctly describes how RabbitMQ uses LDAP for authentication?

A RabbitMQ stores LDAP user passwords locally and compares them during login.

B RabbitMQ directly queries the LDAP server to verify user credentials during login.

C RabbitMQ uses LDAP only for authorization, not authentication.

D RabbitMQ requires users to authenticate via OAuth before LDAP is checked.

💡 Hint

Think about how LDAP servers are typically used for user verification.

RabbitMQ uses LDAP to authenticate users by querying the LDAP server to check credentials at login time.

💻 Command Output

intermediate

RabbitMQ OAuth Authentication Plugin Output

What is the expected output when enabling the OAuth2 authentication plugin in RabbitMQ and restarting the server?

RabbitMQ

rabbitmq-plugins enable rabbitmq_auth_backend_oauth2
sudo systemctl restart rabbitmq-server
sudo rabbitmqctl status | grep oauth2

A {rabbit,auth_backend_oauth2} is enabled and running

B Error: plugin rabbitmq_auth_backend_oauth2 not found

C OAuth2 plugin enabled but server failed to start

D No output related to oauth2 found

💡 Hint

Check if the plugin is listed as enabled after restart.

Enabling the OAuth2 plugin and restarting RabbitMQ should show the plugin as enabled and running in the status output.

❓ Configuration

advanced

Configuring LDAP Authentication Backend in RabbitMQ

Which configuration snippet correctly sets up RabbitMQ to authenticate users against an LDAP server at ldap.example.com on port 389?

A

auth_backends = rabbit_auth_backend_ldap
ldap.servers = ldap.example.com
ldap.port = 389
ldap.user_dn_pattern = uid=${username},ou=users,dc=example,dc=com

B

auth_backends = [rabbit_auth_backend_ldap]
ldap.server = ldap.example.com
ldap.port = 636
ldap.user_dn_pattern = uid=${username},ou=users,dc=example,dc=com

C

auth_backends.1 = rabbit_auth_backend_ldap
ldap.servers.1 = ldap.example.com
ldap.port = 636
ldap.user_dn_pattern = cn=${username},ou=users,dc=example,dc=com

D

auth_backends.1 = rabbit_auth_backend_ldap
ldap.servers.1 = ldap.example.com
ldap.port = 389
ldap.user_dn_pattern = cn=${username},ou=users,dc=example,dc=com

💡 Hint

Check the correct keys for LDAP server and port, and user DN pattern syntax.

Option D correctly uses the indexed auth_backends key, sets ldap.servers.1, port 389, and the user DN pattern with cn attribute.

❓ Troubleshoot

advanced

Troubleshooting OAuth2 Authentication Failure in RabbitMQ

After configuring OAuth2 authentication in RabbitMQ, users report login failures. Which of the following is the most likely cause?

A LDAP server is down, causing OAuth2 to fail.

B RabbitMQ does not support OAuth2 authentication.

C The OAuth2 token endpoint URL is incorrect or unreachable.

D RabbitMQ requires a local password file for OAuth2 to work.

💡 Hint

Consider what external service OAuth2 depends on.

OAuth2 authentication depends on contacting the token endpoint. If the URL is wrong or unreachable, authentication fails.

✅ Best Practice

expert

Best Practice for Securing RabbitMQ with LDAP and OAuth

Which approach best secures RabbitMQ authentication when using both LDAP and OAuth backends?

A Configure RabbitMQ to use OAuth as primary backend and LDAP as fallback, enabling TLS for both connections.

B Use LDAP only and disable OAuth to reduce complexity.

C Allow anonymous access and rely on network firewall for security.

D Store all user passwords in RabbitMQ and disable external backends.

💡 Hint

Think about layered security and encrypted connections.

Using OAuth as primary and LDAP as fallback with TLS encryption ensures secure, flexible authentication.

Practice

1. What is the main purpose of using LDAP or OAuth as authentication backends in RabbitMQ?

easy

A. To allow RabbitMQ to verify users using external systems

B. To speed up message delivery between queues

C. To store messages persistently on disk

D. To enable RabbitMQ clustering automatically

Solution

1. Step 1: Understand authentication backends

   Authentication backends like LDAP or OAuth let RabbitMQ check user credentials against external systems.

2. Step 2: Identify the main purpose

   This helps centralize user management and improve security by not storing passwords locally.

3. Final Answer:

   To allow RabbitMQ to verify users using external systems -> Option A

4. Quick Check:

   Authentication backend purpose = Verify users externally [OK]

Hint: Authentication backends check users outside RabbitMQ [OK]

Common Mistakes:

• Confusing authentication with message delivery
• Thinking backends store messages
• Assuming backends manage clustering

2. Which of the following is the correct way to enable LDAP authentication backend in rabbitmq.conf?

easy

A. auth_backends.1 = ldap

B. auth_backends = [ldap]

C. auth_backends = ldap

D. auth_backends = {ldap}

Solution

1. Step 1: Recall RabbitMQ config syntax for backends

   RabbitMQ uses dotted notation for lists in auth_backends, such as auth_backends.1 = ldap.

2. Step 2: Identify correct syntax

   auth_backends.1 = ldap is the correct format.

3. Final Answer:

   auth_backends.1 = ldap -> Option A

4. Quick Check:

   Dotted notation auth_backends.N [OK]

Hint: Use dotted notation auth_backends.1 = ldap [OK]

Common Mistakes:

• Using square brackets [] like auth_backends = [ldap]
• Assigning string without numbering
• Using curly braces {}

3. Given this rabbitmq.conf snippet:

auth_backends.1 = ldap
ldap.servers.1 = ldap.example.com
ldap.user_dn_pattern = cn=${username},ou=users,dc=example,dc=com

What happens when a user tries to log in with username alice?

medium

A. RabbitMQ denies login because user_dn_pattern is missing

B. RabbitMQ uses local user database ignoring LDAP

C. RabbitMQ checks LDAP server at ldap.example.com using DN 'cn=alice,ou=users,dc=example,dc=com'

D. RabbitMQ tries OAuth authentication instead

Solution

1. Step 1: Analyze LDAP config parameters

   The config sets LDAP as backend and defines server and user DN pattern with ${username} placeholder.

2. Step 2: Substitute username in DN pattern

   For username 'alice', DN becomes 'cn=alice,ou=users,dc=example,dc=com'. RabbitMQ uses this to query LDAP server.

3. Final Answer:

   RabbitMQ checks LDAP server at ldap.example.com using DN 'cn=alice,ou=users,dc=example,dc=com' -> Option C

4. Quick Check:

   Username substitution in DN pattern = LDAP query [OK]

Hint: User DN pattern uses ${username} to query LDAP [OK]

Common Mistakes:

• Assuming local database is used
• Thinking user_dn_pattern is optional
• Confusing OAuth with LDAP backend

4. You configured OAuth as an authentication backend but RabbitMQ always rejects valid tokens. Which config mistake could cause this?

medium

A. Missing auth_backends.1 = oauth line

B. Incorrect OAuth server URL in config

C. Setting auth_backends.1 = ldap instead of OAuth

D. Using auth_backends = oauth without numbering

Solution

1. Step 1: Check OAuth backend config requirements

   OAuth backend needs correct server URL to validate tokens properly.

2. Step 2: Identify cause of token rejection

   If the OAuth server URL is wrong, RabbitMQ cannot validate tokens, causing rejections.

3. Final Answer:

   Incorrect OAuth server URL in config -> Option B

4. Quick Check:

   OAuth token validation needs correct server URL [OK]

Hint: Verify OAuth server URL to fix token validation [OK]

Common Mistakes:

• Forgetting to enable OAuth backend
• Using LDAP backend config for OAuth
• Ignoring numbering in list syntax

5. You want RabbitMQ to authenticate users first with LDAP, then fallback to OAuth if LDAP fails. How should you configure auth_backends in rabbitmq.conf?

hard

A. auth_backends = {ldap, oauth}

B. auth_backends.1 = oauth
auth_backends.2 = ldap

C. auth_backends = ldap
auth_backends = oauth

D. auth_backends.1 = ldap
auth_backends.2 = oauth

Solution

1. Step 1: Understand auth_backends order

   RabbitMQ tries backends in the order listed in auth_backends.

2. Step 2: Set LDAP first, OAuth second

   To try LDAP first, then OAuth, configure auth_backends.1 = ldap
auth_backends.2 = oauth.

3. Final Answer:

   auth_backends.1 = ldap auth_backends.2 = oauth -> Option D

4. Quick Check:

   Backend order controls fallback sequence [OK]

Hint: List backends in order of priority with auth_backends.1, .2 [OK]

Common Mistakes:

• Reversing backend order
• Using multiple auth_backends lines
• Using curly braces instead of brackets