Commit Graph

475 Commits

Author SHA1 Message Date
Marcial Rosales c73fdf79ff Remove log statement 2025-05-29 09:02:29 +02:00
Marcial Rosales 1d942027a9 Add system test for variable expansion 2025-05-29 09:02:29 +02:00
Marcial Rosales 0023ba2a01 Add var expansion to vhost and resource access 2025-05-29 09:02:29 +02:00
Michal Kuratczyk 9fefcc4827
Remove rabbitmq_mqtt from DEPS (it's a TEST_DEP) 2025-05-19 09:40:05 +02:00
Michal Kuratczyk 637a2bc8cc
OTP28: re:split change; street-address macro
https://github.com/erlang/otp/issues/9739

In OTP28+, splitting an empty string returns an empty list, not an empty
string (the input).

Additionally `street-address` macro was removed in OTP28 - replace with
the value it used to be.

Lastly, rabbitmq_auth_backend_oauth2 has an MQTT test, so add
rabbitmq_mqtt to TEST_DEPS
2025-05-19 08:59:50 +02:00
Loïc Hoguin c5d150a7ef
Use Erlang.mk's native Elixir support for CLI
This avoids using Mix while compiling which simplifies
a number of things and let us do further build improvements
later on.

Elixir is only enabled from within rabbitmq_cli currently.

Eunit is disabled since there are only Elixir tests.

Dialyzer will force-enable Elixir in order to process
Elixir-compiled beam files.

This commit also includes a few changes that are
related:

 * The Erlang distribution will now be started for parallel-ct

 * Many unnecessary PROJECT_MOD lines have been removed

 * `eunit_formatters` has been removed, it provides little value

 * The new `maybe_flock` Erlang.mk function is used where possible

 * Build test deps when testing rabbitmq_cli (Mix won't do it anymore)

 * rabbitmq_ct_helpers now use the early plugins to have Dialyzer
   properly set up
2025-03-18 10:02:49 +01:00
Aitor Perez 07adc3e571
Remove Bazel files 2025-03-13 13:42:34 +00:00
Marcial Rosales ecacf0f19c Clean up 2025-02-11 16:12:15 +01:00
Marcial Rosales 3041d6c253 Support in code the old keycloak format
That was not keycloak format it was an
extension to the oauth spec introuduced
a few years ago. To get a token from
keycloak using this format, a.k.a.
requesting party token, one has to specify
a different claim type called
urn:ietf:params:oauth:grant-type:uma-ticket
2025-02-11 16:12:15 +01:00
Marcial Rosales 1179d3a3ec Support keycloak custom format via configuration 2025-02-11 16:12:15 +01:00
Michael Klishin 968eefa1bb
Bump (c) line year
There are no functional changes to this massive diff.
2025-01-01 17:54:10 -05:00
Diana Parra Corbacho bdaa31e7ea Tests: catch exception on connection closed
The tests force closing the connection with an error
2024-12-16 11:58:05 +01:00
Michael Klishin 719b5564c9
Cosmetics 2024-11-28 15:55:13 -05:00
Michael Klishin 301b79c470
Type spec improvements in rabbit_auth_backend_oauth2 2024-11-28 15:51:47 -05:00
Marcial Rosales 3718fe3289 Prevent change of username on token refresh 2024-11-27 10:41:28 +01:00
Hathoute c44c5150f2
Fix failing test
(cherry picked from commit 6459111f86)
2024-11-18 14:44:56 -05:00
Hathoute Hamza f1ee5b551a
Update rabbit_oauth2_schema.erl
(cherry picked from commit ed5f29cec8)
2024-11-18 12:46:46 -05:00
Hathoute 0d51ee9ec0
rabbitmq-auth-backend-oauth2: correctly map additional_scopes_key
(cherry picked from commit 0d799a50eb)
2024-11-18 12:46:40 -05:00
GitHub fa0067c22d bazel run gazelle 2024-11-01 04:02:26 +00:00
David Ansari 1778bc22aa Support AMQP 1.0 token renewal
Closes #9259.

 ## What?
Allow an AMQP 1.0 client to renew an OAuth 2.0 token before it expires.

 ## Why?
This allows clients to keep the AMQP connection open instead of having
to create a new connection whenever the token expires.

 ## How?
As explained in https://github.com/rabbitmq/rabbitmq-server/issues/9259#issuecomment-2437602040
the client can `PUT` a new token on HTTP API v2 path `/auth/tokens`.
RabbitMQ will then:
1. Store the new token on the given connection.
2. Recheck access to the connection's vhost.
3. Clear all permission caches in the AMQP sessions.
4. Recheck write permissions to exchanges for links publishing to
   RabbitMQ, and recheck read permissions from queues for links
   consuming from RabbitMQ. The latter complies with the user
   expectation in #11364.
2024-10-30 10:42:40 +01:00
Michael Klishin 9893a2bd48
Merge pull request #12399 from rabbitmq/deprecate-oauth2-settings
Deprecate two OAuth2 settings: auth_oauth2.jwks_url and management.metadata_url
2024-10-09 11:46:58 -04:00
Marcial Rosales 0f1b8760a4 Fix issue 2024-10-09 11:01:09 -04:00
Marcial Rosales 0835c7ecf4 Resolve merge conflicts 2024-10-09 11:01:09 -04:00
Marcial Rosales ee8d5f7fb0 Deprecate jwks_url but it is still supported
jwks_uri takes precedence when both are set
2024-10-09 11:01:09 -04:00
Marcial Rosales b21a222abd Remove management.oauth_metadata_url 2024-10-09 11:01:09 -04:00
Marcial Rosales 423b591310 Fix failing test cases 2024-10-09 10:57:38 -04:00
Marcial Rosales ebc3dea971 Minor formatting improvement 2024-10-09 10:57:38 -04:00
Marcial Rosales b966ab7b72 Configure scope_aliases also per resource_server 2024-10-09 10:57:38 -04:00
Marcial Rosales 3e81cfa89d Handle wrong scope_aliases configuration 2024-10-09 10:57:38 -04:00
Marcial Rosales 48670a0ecf Support two modes of configuring
scope_aliases using cuttlefish
2024-10-09 10:57:38 -04:00
Marcial Rosales a30c829ec5 Test translation function of scope_aliases 2024-10-09 10:57:38 -04:00
Marcial Rosales dcb52638ab Minor refactoring 2024-10-09 10:57:38 -04:00
Marcial Rosales 5841e37804 Fix schema translation for
scope_aliases
2024-10-09 10:57:38 -04:00
Marcial Rosales cd46b406df Modify schema to include scope_aliases
WIP Add translation function
2024-10-09 10:57:38 -04:00
GitHub 5ae16631e9 bazel run gazelle 2024-10-09 04:02:38 +00:00
Michael Klishin c15f19fe83 OAuth 2: CLI is a build time dependency, not a runtime one 2024-10-08 07:11:43 -04:00
Michael Klishin e7f82a53ba OAuth 2: add a missing dependency on rabbitmq_cli 2024-10-08 07:09:08 -04:00
Marcial Rosales 743f663520 Fix bazel configuration 2024-10-08 08:17:48 +02:00
Marcial Rosales 0ec415a419 Fix bazel misconfiguration 2024-10-08 08:17:48 +02:00
Marcial Rosales d25e0f8e88 Refactoring
- Use rabbit_oauth2 prefix for modules which do not have it
- Ensure most lines stick to 80 column
2024-10-08 08:17:48 +02:00
Marcial Rosales f56324e72c Remove wrong file 2024-10-08 08:17:48 +02:00
Marcial Rosales 966d5d49b1 Fix fucntion signature 2024-10-08 08:17:48 +02:00
Marcial Rosales 6e74d8b60e Always use list() type for urls 2024-10-08 08:17:48 +02:00
Marcial Rosales 6d0e195957 Fix schema issues
And fix selenium script to run
rabbitrmq locally
2024-10-08 08:17:48 +02:00
Marcial Rosales b2532e0c1d Modify management schema
to be able to set extra parameters
for authorize and token endpoints
2024-10-08 08:17:48 +02:00
Marcial Rosales eb2fbc6d9b Improve format 2024-10-08 08:17:48 +02:00
Marcial Rosales 9f11f25b9d Fix test 2024-10-08 08:17:48 +02:00
Marcial Rosales b339714bf8 Test invalid token parameter config 2024-10-08 08:17:48 +02:00
Marcial Rosales 0d4fb55cda Remove unnecessary statement 2024-10-08 08:17:48 +02:00
Marcial Rosales 5044e297d4 Add token endpoint params to schema 2024-10-08 08:17:48 +02:00