RabbitMQ + Windows + LDAP without sending password

Question

I'm trying to get LDAP authentication/authorization working with RabbitMQ 3.6.2 on Windows 7. I've gotten basic authentication working where the application sends a username/password, but the password is in the code which I need to figure out how to avoid. Has anyone achieved success in configuring RabbitMQ to authenticate via LDAP without supplying a password? I've been referring to the LDAP plugin docs, but to no avail.

My rabbitmq.config file is set up thusly:

[
    {rabbit, 
        {auth_backends, [{rabbit_auth_backend_ldap, rabbit_auth_backend_internal},
                                                     rabbit_auth_backend_internal]}
    },
    {rabbitmq_auth_backend_ldap,
        [{servers, ["theserver.thedomain.com"]},
        %% this works, but a password is still required
        {user_dn_pattern, "CN=${username},OU=theADgroup,OU=anothergroup,DC=thedomain,DC=dom"},
        %% looks like this is required
        {other_bind, anon},
        {use_ssl, false},
        {port, 389},
        {log, true}
    ]}
].

Thanks,

Andy

Answer 1

Here's what I ended up with in case it helps anyone. I had to add 3 parameters to the config:

• dn_lookup_attribute set to "userPrincipalName"
• dn_lookup_base set to "DC=Name1,DC=Name2" (change this to fit your AD setup)
• user_dn_pattern set to "${username}@thedomain.com" (this was done for convenience - without this, users had to log in with their full email address, but with it, they only have to use their username)

You likely won't need all the settings in the config below, but this is my config nonetheless including authenticating over SSL and granting certain specific AD groups "Administrator" access to RabbitMQ Management UI. I added lots of comments to hopefully aid in figuring it out.

[
    {rabbit, 
        {auth_backends, [{rabbit_auth_backend_ldap, rabbit_auth_backend_internal}]}
    },
    %% LDAP Authentication.  See https://www.rabbitmq.com/ldap.html
    {rabbitmq_auth_backend_ldap,
        [{servers, ["theserver.thedomain.com"]},
        {dn_lookup_attribute, "userPrincipalName"},
        {dn_lookup_base, "DC=Name1,DC=Name2"},
        %% this makes it so that login usernames are just <username> instead of <username>@thedomain.com
        {user_dn_pattern, "${username}@thedomain.com"},
        %% Authenticate over SSL
        {use_ssl, true},
        {port, 636},
        %% Change this to true to troubleshoot LDAP failures (see file rabbit@<machinename>.log and scroll to bottom for the most recent activity)
        {log, false},

        %% ------------------------------------------------------------------------------------
        %% LDAP-based authorization for employee logins to the management UI.
        %% The following settings maps the permissions that LDAP-authenticated users will have.
        %% For more info, see: https://www.rabbitmq.com/access-control.html
        %% ------------------------------------------------------------------------------------

        %% Grant access to all virtual hosts (this is the default, but is present here for the sake of transparency)
        {vhost_access_query, {constant, true}},

        %% Grant access to "resources" (exchanges, queues, bindings, etc.) (this is the default)
        {resource_access_query, {constant, true}},

        %% Grant RabbitMQ administrator access based on LDAP group membership.
        {tag_queries, [{administrator, {'or',
            [{in_group, "CN=Group 1 Name,OU=Group 1 OU,OU=Groups,DC=thecompany,DC=com"},
            {in_group, "CN=Group 2 Name,OU=Group 2 OU,OU=Groups,DC=thecompany,DC=com"},
            {in_group_nested, "CN=Group 3 Name,OU=Group 3 OU,OU=Groups,DC=thecompany,DC=com"}]}
        }]}
    ]}
].

Edit: Here's a snippet from a program that shows RabbitMQ ConnectionFactory connecting without using username/password since it relies on certificate-based authentication. You only need the path to the SSL certificate (generated for free using OpenSSL) along with the certificate passphrase.

using LipsumGenerator.Message;
using Messaging.Work;
using RabbitMQ.Client;
using System;
using System.Configuration;
using System.Security.Authentication;

namespace Publisher
{
    class Program
    {
        static void Main(string[] args)
        {
            var factory = new ConnectionFactory();
            factory.HostName = ConfigurationManager.AppSettings["rabbitmqHostName"];

            factory.AuthMechanisms = new AuthMechanismFactory[] { new ExternalMechanismFactory() };
            factory.Ssl.ServerName = ConfigurationManager.AppSettings["rabbitmqServerName"];
            factory.Ssl.CertPath = ConfigurationManager.AppSettings["certificateFilePath"];
            factory.Ssl.CertPassphrase = ConfigurationManager.AppSettings["certificatePassphrase"];
            factory.Ssl.Enabled = true;
            factory.Ssl.Version = SslProtocols.Tls12;
            factory.Port = AmqpTcpEndpoint.DefaultAmqpSslPort;
            factory.VirtualHost = "/";

            using (var connection = factory.CreateConnection())
            {
                using (var channel = connection.CreateModel())
                {
                    Console.WriteLine(" [*] Publishing messages. To exit press CTRL+C");

                    int count = 0;
                    var rand = new Random();

                    while (true)
                    {
                        count++;
                        WorkProcessor.EnqueueMessage(channel, "Lipsum", new LipsumGeneratorMessage(rand.Next(5)));
                        Console.WriteLine("Sent message Lipsum " + count);
                        System.Threading.Thread.Sleep(rand.Next(2000));
                    }
                }
            }
        }
    }
}