Authentication backends (LDAP, OAuth) in RabbitMQ - Mini Project: Build & Apply

Configure RabbitMQ Authentication Backends with LDAP and OAuth

📖 Scenario: You are setting up RabbitMQ on a company server. The company wants to secure access by using two authentication methods: LDAP for employees and OAuth for external apps.This project will guide you step-by-step to configure RabbitMQ to use LDAP and OAuth authentication backends.

🎯 Goal: By the end, you will have a RabbitMQ configuration file that enables LDAP and OAuth authentication backends with the correct settings.

📋 What You'll Learn

Create a RabbitMQ configuration file with LDAP backend settings

Add OAuth backend configuration to the same file

Use correct syntax for RabbitMQ config in Erlang terms format

Print the final configuration content

💡 Why This Matters

🌍 Real World

Companies often use RabbitMQ for messaging and want to secure it by integrating with existing user directories (LDAP) and modern identity providers (OAuth).

💼 Career

Knowing how to configure RabbitMQ authentication backends is important for DevOps engineers managing secure messaging infrastructure.

1

Create the initial RabbitMQ configuration with LDAP backend

Create a variable called rabbitmq_config as a string containing the RabbitMQ configuration. Include the auth_backends list with rabbit_auth_backend_ldap as the only backend. Also add the ldap settings with servers set to ["ldap.company.com"] and user_dn_pattern set to "uid=${username},ou=users,dc=company,dc=com".

RabbitMQ

# Create the rabbitmq_config string with LDAP backend and settings
# Your code here

Hint

Remember to use triple quotes for multi-line string and Erlang terms syntax for RabbitMQ config.

2

Add OAuth backend to the authentication backends list

Add rabbit_auth_backend_oauth2 to the auth_backends list in the rabbitmq_config string, so it contains both rabbit_auth_backend_ldap and rabbit_auth_backend_oauth2.

RabbitMQ

rabbitmq_config = """
[{rabbit, [
  {auth_backends, [rabbit_auth_backend_ldap, rabbit_auth_backend_oauth2]},
  {ldap, [
    {servers, ["ldap.company.com"]},
    {user_dn_pattern, "uid=${username},ou=users,dc=company,dc=com"}
  ]}
]}].
"""
# Your code here

Hint

Make sure both backends are inside the auth_backends list separated by a comma.

3

Add OAuth2 backend configuration settings

Add an auth_oauth2 section inside the rabbit config in rabbitmq_config. Set issuer to "https://auth.company.com", client_id to "rabbitmq-client", and client_secret to "supersecret".

RabbitMQ

rabbitmq_config = """
[{rabbit, [
  {auth_backends, [rabbit_auth_backend_ldap, rabbit_auth_backend_oauth2]},
  {ldap, [
    {servers, ["ldap.company.com"]},
    {user_dn_pattern, "uid=${username},ou=users,dc=company,dc=com"}
  ]},
  {auth_oauth2, [
    {issuer, "https://auth.company.com"},
    {client_id, "rabbitmq-client"},
    {client_secret, "supersecret"}
  ]}
]}].
"""
# Your code here

Hint

Follow the Erlang config format carefully. The auth_oauth2 section is a list of key-value tuples inside the rabbit config.

4

Print the final RabbitMQ configuration

Write a print statement to display the content of the rabbitmq_config variable.

RabbitMQ

rabbitmq_config = """
[{rabbit, [
  {auth_backends, [rabbit_auth_backend_ldap, rabbit_auth_backend_oauth2]},
  {ldap, [
    {servers, ["ldap.company.com"]},
    {user_dn_pattern, "uid=${username},ou=users,dc=company,dc=com"}
  ]},
  {auth_oauth2, [
    {issuer, "https://auth.company.com"},
    {client_id, "rabbitmq-client"},
    {client_secret, "supersecret"}
  ]}
]}].
"""

# Print the configuration
# Your code here

Hint

Use print(rabbitmq_config) to show the full configuration string.

Practice

1. What is the main purpose of using LDAP or OAuth as authentication backends in RabbitMQ?

easy

A. To allow RabbitMQ to verify users using external systems

B. To speed up message delivery between queues

C. To store messages persistently on disk

D. To enable RabbitMQ clustering automatically

Solution

1. Step 1: Understand authentication backends

   Authentication backends like LDAP or OAuth let RabbitMQ check user credentials against external systems.

2. Step 2: Identify the main purpose

   This helps centralize user management and improve security by not storing passwords locally.

3. Final Answer:

   To allow RabbitMQ to verify users using external systems -> Option A

4. Quick Check:

   Authentication backend purpose = Verify users externally [OK]

Hint: Authentication backends check users outside RabbitMQ [OK]

Common Mistakes:

• Confusing authentication with message delivery
• Thinking backends store messages
• Assuming backends manage clustering

2. Which of the following is the correct way to enable LDAP authentication backend in rabbitmq.conf?

easy

A. auth_backends.1 = ldap

B. auth_backends = [ldap]

C. auth_backends = ldap

D. auth_backends = {ldap}

Solution

1. Step 1: Recall RabbitMQ config syntax for backends

   RabbitMQ uses dotted notation for lists in auth_backends, such as auth_backends.1 = ldap.

2. Step 2: Identify correct syntax

   auth_backends.1 = ldap is the correct format.

3. Final Answer:

   auth_backends.1 = ldap -> Option A

4. Quick Check:

   Dotted notation auth_backends.N [OK]

Hint: Use dotted notation auth_backends.1 = ldap [OK]

Common Mistakes:

• Using square brackets [] like auth_backends = [ldap]
• Assigning string without numbering
• Using curly braces {}

3. Given this rabbitmq.conf snippet:

auth_backends.1 = ldap
ldap.servers.1 = ldap.example.com
ldap.user_dn_pattern = cn=${username},ou=users,dc=example,dc=com

What happens when a user tries to log in with username alice?

medium

A. RabbitMQ denies login because user_dn_pattern is missing

B. RabbitMQ uses local user database ignoring LDAP

C. RabbitMQ checks LDAP server at ldap.example.com using DN 'cn=alice,ou=users,dc=example,dc=com'

D. RabbitMQ tries OAuth authentication instead

Solution

1. Step 1: Analyze LDAP config parameters

   The config sets LDAP as backend and defines server and user DN pattern with ${username} placeholder.

2. Step 2: Substitute username in DN pattern

   For username 'alice', DN becomes 'cn=alice,ou=users,dc=example,dc=com'. RabbitMQ uses this to query LDAP server.

3. Final Answer:

   RabbitMQ checks LDAP server at ldap.example.com using DN 'cn=alice,ou=users,dc=example,dc=com' -> Option C

4. Quick Check:

   Username substitution in DN pattern = LDAP query [OK]

Hint: User DN pattern uses ${username} to query LDAP [OK]

Common Mistakes:

• Assuming local database is used
• Thinking user_dn_pattern is optional
• Confusing OAuth with LDAP backend

4. You configured OAuth as an authentication backend but RabbitMQ always rejects valid tokens. Which config mistake could cause this?

medium

A. Missing auth_backends.1 = oauth line

B. Incorrect OAuth server URL in config

C. Setting auth_backends.1 = ldap instead of OAuth

D. Using auth_backends = oauth without numbering

Solution

1. Step 1: Check OAuth backend config requirements

   OAuth backend needs correct server URL to validate tokens properly.

2. Step 2: Identify cause of token rejection

   If the OAuth server URL is wrong, RabbitMQ cannot validate tokens, causing rejections.

3. Final Answer:

   Incorrect OAuth server URL in config -> Option B

4. Quick Check:

   OAuth token validation needs correct server URL [OK]

Hint: Verify OAuth server URL to fix token validation [OK]

Common Mistakes:

• Forgetting to enable OAuth backend
• Using LDAP backend config for OAuth
• Ignoring numbering in list syntax

5. You want RabbitMQ to authenticate users first with LDAP, then fallback to OAuth if LDAP fails. How should you configure auth_backends in rabbitmq.conf?

hard

A. auth_backends = {ldap, oauth}

B. auth_backends.1 = oauth
auth_backends.2 = ldap

C. auth_backends = ldap
auth_backends = oauth

D. auth_backends.1 = ldap
auth_backends.2 = oauth

Solution

1. Step 1: Understand auth_backends order

   RabbitMQ tries backends in the order listed in auth_backends.

2. Step 2: Set LDAP first, OAuth second

   To try LDAP first, then OAuth, configure auth_backends.1 = ldap
auth_backends.2 = oauth.

3. Final Answer:

   auth_backends.1 = ldap auth_backends.2 = oauth -> Option D

4. Quick Check:

   Backend order controls fallback sequence [OK]

Hint: List backends in order of priority with auth_backends.1, .2 [OK]

Common Mistakes:

• Reversing backend order
• Using multiple auth_backends lines
• Using curly braces instead of brackets