RabbitMQ authentication without password

Question

Because I don't need to consider security issues in my application, I want to connect to RabbitMQ using the Java client without a password.

In the management UI, I set the users password to "no password". Then I tried it this way:

ConnectionFactory factory = new ConnectionFactory();
factory.setHost("localhost");
factory.setUsername("myuser");
connection = factory.newConnection();

Alternatively, I tried to assemble the URI by hand:

factory.setUri("amqp://myuser@localhost:5672");

...but in both cases the authentication fails with this exception:

Exception in thread "main" com.rabbitmq.client.AuthenticationFailureException: ACCESS_REFUSED - Login was refused using authentication mechanism PLAIN. For details see the broker logfile.
    at com.rabbitmq.client.impl.AMQConnection.start(AMQConnection.java:339)
    at com.rabbitmq.client.ConnectionFactory.newConnection(ConnectionFactory.java:716)
    at com.rabbitmq.client.ConnectionFactory.newConnection(ConnectionFactory.java:760)
    at de.bmw.rabbitmq.workerqueue.Producer2.main(Producer2.java:51)

Is it even possible to get a connection without a password?

score 3 · Answer 1 · answered Apr 19 '16 at 13:53

3

Because I don't need to consider security issues in my application

I would heavily question this assumption. In fact, I would go so far as to say this is never correct.

That being said:

just use a simple password that anyone can know. It's going to be easier to do that, than to try and make RMQ work without a password.

answered Apr 19 '16 at 13:53

Derick Bailey

72,004
22
206
219

2

I was expecting a reply like this ;) But really, in this case it is an isolated test-net and we want to avoid any hassle in set up and maintenance. – andi0815 Apr 19 '16 at 14:07
Agree with the security concern, but RabbitMQ Management Plugin API Documentation states that `Setting [password] to "" will ensure the user cannot use a password to log in`, so when you need a user to obtain a connection, but not login to management API you need to use passwordless authentication. – Dinei Dec 23 '16 at 13:21

Andy · Answer 2 · 2017-10-09T18:58:38.390

Passwordless authentication can be achieved by using the rabbitmq-auth-mechanism-ssl as documented here: https://github.com/rabbitmq/rabbitmq-auth-mechanism-ssl. This requires that SSL/TLS support is set up and working. If this option is chosen, a trusted root certificate is used for authentication, and any username/password is ignored altogether.

I'm currently investigating whether passwordless authentication is possible in conjunction with LDAP, but I haven't had any luck getting this to work.

Edit: In my environment, Windows services are authenticating using certificate-based auth, and the RabbitMQ cluster admins can authenticate to the management web UI using LDAP. In case you're interested in LDAP auth, here's another post about it.

score 0 · Answer 3 · answered Jun 13 '16 at 13:05

0

To finalize this issue. As suggested by Derick Bailey: I helped myself by introducing (default) credentials for the different clients.

answered Jun 13 '16 at 13:05

andi0815

129
1
6

RabbitMQ authentication without password

3 Answers3