Commit Graph

465 Commits

Author SHA1 Message Date
Luke Bakken 7fe159edef
Yolo-replace format strings
Replaces `~s` and `~p` with their unicode-friendly counterparts.

```
git ls-files *.erl | xargs sed -i.ORIG -e s/~s>/~ts/g -e s/~p>/~tp/g
```
2022-10-10 10:32:03 +04:00
Michael Klishin a9b72877f5 Bump deps: michaelklishin/erlang-jose and Thoas 2022-08-29 15:28:37 +04:00
Michael Klishin b14eee13b5 OAuth 2: rename a function 2022-08-23 14:30:03 +04:00
Michael Klishin 21e98f8b13 OAuth 2: unit_SUITE naming and wording 2022-08-23 13:20:01 +04:00
Michael Klishin 877f03082a
OAuth 2: use a separate system suite group for RAR 2022-08-23 12:59:59 +04:00
Marcial Rosales d321a30198
README edits
Make it clear that the first sample location grants
access to any queue and/or exchange on the selected
vhost and cluster
2022-08-22 16:16:16 +04:00
Michael Klishin 5629a7ccbb
OAuth 2 README: add a missing link 2022-08-22 16:16:16 +04:00
Michael Klishin 4134bbacfc
OAuth 2: edits per discussion with @marcialrosales 2022-08-22 16:16:16 +04:00
Michael Klishin 3a09139635
OAuth 2: more RAR doc edits 2022-08-22 16:16:15 +04:00
Michael Klishin 207162d535
OAuth 2: one more RAR doc edit 2022-08-22 16:16:15 +04:00
Michael Klishin 083abe52b7
OAuth 2 Cuttlefish schema: cosmetics 2022-08-22 16:16:15 +04:00
Michael Klishin 382c7f092b
OAuth 2: README edits 2022-08-22 16:16:15 +04:00
Michael Klishin 32242a5c7a
OAuth 2: README edits 2022-08-22 16:16:15 +04:00
Michael Klishin efc2878bdb
README edits 2022-08-22 16:16:15 +04:00
Marcial Rosales 3112fa962e
Update documentation 2022-08-22 16:16:14 +04:00
Marcial Rosales be36f91fb0
Update docs 2022-08-22 16:16:14 +04:00
Marcial Rosales 39fbeea628
Use user-tags without prefix tag: as action name 2022-08-22 16:16:14 +04:00
Marcial Rosales 8ee81896cf
Add missing test cases 2022-08-22 16:16:14 +04:00
Marcial Rosales 29b97e085b
Test single value for locations and actions 2022-08-22 16:16:14 +04:00
Marcial Rosales 9562ea53bc
Correct mistake in the translation example 2022-08-22 16:16:14 +04:00
Marcial Rosales 3dbb438f5a
Improve readability 2022-08-22 16:16:14 +04:00
Marcial Rosales 38e83ac8d4
Explain how permissions are translated to scopes 2022-08-22 16:16:13 +04:00
Marcial Rosales fa77f93448
Explain how the permissions translate to scopes 2022-08-22 16:16:13 +04:00
Marcial Rosales eb3f894d25
Update docs 2022-08-22 16:16:13 +04:00
Marcial Rosales 4be9bdbc08
Use wildcard library rather than re
for cluster, vhost , queue , exchange,
and routing-key patterns
2022-08-22 16:16:13 +04:00
Marcial Rosales 7cea128a48
Allow regular expression in location's cluster field 2022-08-22 16:16:13 +04:00
Marcial Rosales 4505fbd1dd
Remove print statement 2022-08-22 16:16:13 +04:00
Marcial Rosales d83401aaf1
Fix issue where the cluster was wrongly matched
It looks like it was matching any cluster which started
with the value in resource_server_id rather than the
exact value
2022-08-22 16:16:13 +04:00
Marcial Rosales a9d069e762
Make aud field optional 2022-08-22 16:16:12 +04:00
Marcial Rosales d69781a7ef
Support rich authorization request spec 2022-08-22 16:16:11 +04:00
Rin Kuryloski 575c5f9975 Remove all of the .travis.yml files
since we no longer use them
2022-08-16 09:46:31 +02:00
Michael Klishin 8f779ce461
Avoid direct references to jsx
and remove an unused Honeycomb Common Test helper module
we ended up not using.

Discovered when spiking a JSON library switch to Thoas.

Pair: @pjk25
2022-07-25 19:34:51 +04:00
Philip Kuryloski a250a533a4 Remove elixir related -ignore_xref calls
As they are no longer necessary with xref2 and the erlang.mk updates
2022-06-09 23:18:40 +02:00
Philip Kuryloski 15a79466b1 Use the new xref2 macro from rules_erlang
That adopts the modern erlang.mk xref behaviour
2022-06-09 23:18:28 +02:00
Philip Kuryloski 327f075d57 Make rabbitmq-server work with rules_erlang 3
Also rework elixir dependency handling, so we no longer rely on mix to
fetch the rabbitmq_cli deps

Also:

- Specify ra version with a commit rather than a branch
- Fixup compilation options for erlang 23
- Add missing ra reference in MODULE.bazel
- Add missing flag in oci.yaml
- Reduce bazel rbe jobs to try to save memory
- Use bazel built erlang for erlang git master tests
- Use the same cache for all the workflows but windows
- Avoid using `mix local.hex --force` in elixir rules
  - Fetching seems blocked in CI, and this should reduce hex api usage in
    all builds, which is always nice
- Remove xref and dialyze tags since rules_erlang 3 includes them in
  the defaults
2022-06-08 14:04:53 +02:00
Loïc Hoguin dc70cbf281
Update Erlang.mk and switch to new xref code 2022-05-31 13:51:12 +02:00
Péter Gömöri 52cb5796a3 Remove leftover compiler option for get_stacktrace 2022-05-03 18:40:49 +02:00
Michael Klishin c6de0fd155
Remove a stray ct:pal/2 call in production code
References #4588, #4666
2022-04-29 16:01:00 +04:00
Michael Klishin 38c5683377
OAuth 2: more tests in follow-up to #4588 2022-04-27 21:51:16 +04:00
Michael Klishin ca290f1116
OAuth 2: expand all scope aliases provided
Per discussion with @MarcialRosales.

In follow-up to #4588.
2022-04-27 21:21:40 +04:00
Michael Klishin 2dccccfdb4
Merge pull request #4604 from rabbitmq/rabbitmq-server-4588
OAuth 2: support for scope aliases
2022-04-23 08:33:07 +04:00
Michael Klishin 4bd782986d
OAuth 2: test tag extraction with scope aliases 2022-04-22 12:39:29 +04:00
Michael Klishin e3aade2a93
OAuth 2: one more test case 2022-04-22 12:09:50 +04:00
Michael Klishin 85c8c3e10f
OAuth 2: integration tests for missing/incorrect scope aliases 2022-04-22 11:45:20 +04:00
Michael Klishin ba3d2a4b11
OAuth 2: one more integration test for scope aliases 2022-04-22 11:26:47 +04:00
Michael Klishin 54710ed3d0
OAuth 2: system suite refactoring 2022-04-22 11:01:44 +04:00
Michael Klishin 878b1e0bad
OAuth 2: extract token refresh tests into a separate group 2022-04-22 10:39:57 +04:00
Michael Klishin 0a5f103bc5
OAuth 2: integration suite cosmetics 2022-04-22 10:17:33 +04:00
Michael Klishin ebbba4c992
OAuth 2: extract complex claim integration tests in a separate group 2022-04-22 09:50:14 +04:00
Péter Gömöri ead29ffa12
Add note on token expiration and refresh 2022-04-21 23:40:56 +02:00
Michael Klishin efe78133c9
OAuth 2: add an integration test for scope aliases 2022-04-22 01:31:22 +04:00
Michael Klishin 9d72a4a804
OAuth 2: more scope aliasing tests 2022-04-22 00:38:26 +04:00
Michael Klishin a242fb9f3d
OAuth 2: refactor unit_SUITE 2022-04-21 16:28:44 +04:00
Michael Klishin 0862199b9e
OAuth 2: initial scope aliasing test 2022-04-21 14:16:46 +04:00
Michael Klishin a2a54686e7
OAuth 2: initial work on scope aliases
Per discussion with @MarcialRosales, we try to fetch
aliases from two sources, based on feedback from two different
users who seemingly rely on the same family of identity
provider products:

 * Use the JWT scope field value first
 * Use extra_scopes_source app env setting second

Just like with the existing extra scopes/complex claim
support originally contributed for Keycloak/identityProvider,
we merge all these scopes obtained from "alternative sources"
with the value of the JWT scopes field. This implicitly
assumes that the result makes sense semantically and
there will not be conflicting scopes. That's on the user to
make sure of.

References #4588
2022-04-20 14:29:31 +04:00
Luke Bakken dba25f6462
Replace files with symlinks
This prevents duplicated and out-of-date instructions.
2022-04-15 06:04:29 -07:00
Michael Klishin c38a3d697d
Bump (c) year 2022-03-21 01:21:56 +04:00
Arnaud Cogoluègnes 4a2f61a49a
Fix usage of add_uaa_key command
Switch is --pem-file, not --pem_file.
2022-03-09 16:24:05 +01:00
Arnaud Cogoluègnes 8443305e49
Remove Travis CI badge in OAuth 2 plugin 2022-03-02 08:57:40 +01:00
Philip Kuryloski dabf053cf8 Additional dialyzer warning fixes
Currently loading of the rabbitmq_cli defined behaviors compiled with
Elixir does not work, so we ignore the callback definitions contained therein
2022-02-25 18:14:35 +01:00
Philip Kuryloski 226e00fcd2 Tighten up dialyzer usage
now that rules_erlang no longer cascades up dialyzer warnings from deps
2022-02-24 11:18:41 +01:00
Philip Kuryloski d8201726ae Ignore dialyzer warnings for most apps 2022-02-21 09:19:56 +01:00
Lajos Gerecs 608d11a3f8 convert additional_scopes_param to the correct equivalent 2022-02-03 18:13:08 +01:00
Philip Kuryloski efcd881658 Use rules_erlang v2
bazel-erlang has been renamed rules_erlang. v2 is a substantial
refactor that brings Windows support. While this alone isn't enough to
run all rabbitmq-server suites on windows, one can at least now start
the broker (bazel run broker) and run the tests that do not start a
background broker process
2022-01-18 13:43:46 +01:00
Anh Thi Lan Nguyen 575b6a1188 Increase token expiration time 2021-12-14 17:18:09 +07:00
Anh Thi Lan Nguyen 8aeca45a17 Start SSL app for testing server 2021-12-14 16:47:20 +07:00
Anh Thi Lan Nguyen 0bc7c98bda Standardise README.md 2021-12-14 12:22:55 +07:00
Anh Thi Lan Nguyen 868443deb0 Correct configuration example in README.md 2021-12-14 11:28:33 +07:00
Anh Thi Lan Nguyen ea8ad0e3e3 Add timeout for httpc request 2021-12-14 11:28:33 +07:00
Anh Thi Lan Nguyen 093a04323b Add configurable crl_check and fail_if_no_peer_cert
- Add configuration: crl_check, fail_if_no_peer_cert
- Correct configuration: hostname_verification
2021-12-14 11:28:33 +07:00
Anh Thi Lan Nguyen 118e44c10e Add wildcard configuration
A "wildcard" configuration is added to enable key server verification with wildcard certificate
2021-12-14 11:28:33 +07:00
Anh Thi Lan Nguyen a9bc1c0ce9 Update README.md
- Update new configuration document
- Add configurable "depth" for key server verification
2021-12-14 11:28:33 +07:00
Anh Thi Lan Nguyen 8c541fb047 Set peer_verification default as verify_none 2021-12-14 11:28:33 +07:00
Anh Thi Lan Nguyen 1615cbfb8b Update better configuration names
- "strict" changes to "https.peer_verification"
- "cacertfile" changes to "https.cacertfile"
2021-12-14 11:28:33 +07:00
Anh Thi Lan Nguyen dd685f1179 Oauth2 plugin improvements
- Validate JWKS server when getting keys
- Restrict usable algorithms
2021-12-14 11:28:33 +07:00
Michal Kuratczyk acf474e056 Fix cuttlefish config for oauth2
The structure of the signing_keys map should be `<<"id">> => {pem, <<"key">>}`.
Previously it was mapped directly as `<<"id">> => <<"key">>`.
2021-11-18 12:58:57 +01:00
Philip Kuryloski b8cabfe3dd bump test timeouts 2021-07-28 08:37:40 +02:00
Philip Kuryloski 2a6a9c786b Bazel test timeouts 2021-07-27 10:57:50 +02:00
Philip Kuryloski abc8703fd8 Bump test timeouts in bazel 2021-07-26 11:09:09 +02:00
Philip Kuryloski 8f9de08de7 Also assert no missing suites for all other deps 2021-07-12 18:05:55 +02:00
Philip Kuryloski 8c7e7e0656 Revert "Default all `rabbitmq_integration_suite` to flaky in bazel"
This reverts commit 70cb8147b2.
2021-06-23 20:53:14 +02:00
Philip Kuryloski 70cb8147b2 Default all `rabbitmq_integration_suite` to flaky in bazel
Most tests that can start rabbitmq nodes have some chance of
flaking. Rather than chase individual flakes for now, this commit
changes the default (though it can still be overriden, as is the case
for config_scheme_SUITE in many places, since I have yet to see that
particular suite flake).
2021-06-21 16:10:38 +02:00
Michael Klishin 604fbfac3a
Depend on erlang-jose ref with fix for potatosalad/erlang-jose#113 2021-06-10 15:49:39 +03:00
Michael Klishin ab795c1232
OAuth 2 system_SUITE: squash some erlc warnings 2021-06-10 15:48:33 +03:00
Philip Kuryloski 37f5744833 Add rabbitmq_auth_backend_oauth2 system_SUITE to bazel 2021-06-09 17:43:20 +02:00
Philip Kuryloski 30f9a95b9f Add dialyze for remaning tier-1 plugins 2021-06-01 10:19:10 +02:00
Philip Kuryloski 98e71c45d8 Perform xref checks on many tier-1 plugins 2021-05-21 12:03:22 +02:00
Philip Kuryloski c13c2af614 Bazel file refactoring 2021-05-11 12:03:27 +02:00
Philip Kuryloski ec5954fe9c Refactor rabbitmq_auth_backend_oauth2 bazel 2021-05-11 10:52:28 +02:00
SkapiN 05cb5f8fa6
Set correct field for extra scope and improve doc
- Replace  additional_rabbitmq_scopes in doc for the correct extra_scopes_source value
- Add samples
- More details for audiance checkup on token
2021-04-16 15:27:58 +02:00
Philip Kuryloski 072a1c0462 Refactor and dedupe .bazel file content 2021-04-16 10:22:44 +02:00
Philip Kuryloski 78bb20f0aa Adopt change of suite_name -> name in ct_suite from @bazel-erlang 2021-04-08 14:25:06 +02:00
Philip Kuryloski 2f17113154 Add deps/rabbitmq_auth_mechanism_ssl to bazel build 2021-04-06 14:30:14 +02:00
Philip Kuryloski 64f6c18cb8 Add the rabbitmq_auth_backend_oauth2 suite
requires recent @bazel-erlang updates
2021-03-31 19:11:32 +02:00
Philip Kuryloski a63f169fcb Remove duplicate rabbitmq-components.mk and erlang.mk files
Also adjust the references in rabbitmq-components.mk to account for
post monorepo locations
2021-03-22 15:40:19 +01:00
kjnilsson 52f745dcde Update rabbitmq-components.mk
use v1.x branch of ra
2021-03-18 15:14:40 +00:00
Loïc Hoguin d5e3bdd623
Add ADDITIONAL_PLUGINS variable
This allows including additional applications or third party
plugins when creating a release, running the broker locally,
or just building from the top-level Makefile.

To include Looking Glass in a release, for example:

$ make package-generic-unix ADDITIONAL_PLUGINS="looking_glass"

A Docker image can then be built using this release and will
contain Looking Glass:

$ make docker-image

Beware macOS users! Applications such as Looking Glass include
NIFs. NIFs must be compiled in the right environment. If you
are building a Docker image then make sure to build the NIF
on Linux! In the two steps above, this corresponds to Step 1.

To run the broker with Looking Glass available:

$ make run-broker ADDITIONAL_PLUGINS="looking_glass"

This commit also moves Looking Glass dependency information
into rabbitmq-components.mk so it is available at all times.
2021-03-12 12:29:28 +01:00
Michael Klishin 97ff62d3b2
Drop trailing newlines from logged messages where possible
Lager strips trailing newline characters but OTP logger with the default
formatter adds a newline at the end. To avoid unintentional multi-line log
messages we have to revisit most messages logged.

Some log entries are intentionally multiline, others
are printed to stdout directly: newlines are required there
for sensible formatting.
2021-03-11 15:17:37 +01:00
Jean-Sébastien Pédron cdcf602749
Switch from Lager to the new Erlang Logger API for logging
The configuration remains the same for the end-user. The only exception
is the log root directory: it is now set through the `log_root`
application env. variable in `rabbit`. People using the Cuttlefish-based
configuration file are not affected by this exception.

The main change is how the logging facility is configured. It now
happens in `rabbit_prelaunch_logging`. The `rabbit_lager` module is
removed.

The supported outputs remain the same: the console, text files, the
`amq.rabbitmq.log` exchange and syslog.

The message text format slightly changed: the timestamp is more precise
(now to the microsecond) and the level can be abbreviated to always be
4-character long to align all messages and improve readability. Here is
an example:

    2021-03-03 10:22:30.377392+01:00 [dbug] <0.229.0> == Prelaunch DONE ==
    2021-03-03 10:22:30.377860+01:00 [info] <0.229.0>
    2021-03-03 10:22:30.377860+01:00 [info] <0.229.0>  Starting RabbitMQ 3.8.10+115.g071f3fb on Erlang 23.2.5
    2021-03-03 10:22:30.377860+01:00 [info] <0.229.0>  Licensed under the MPL 2.0. Website: https://rabbitmq.com

The example above also shows that multiline messages are supported and
each line is prepended with the same prefix (the timestamp, the level
and the Erlang process PID).

JSON is also supported as a message format and now for any outputs.
Indeed, it is possible to use it with e.g. syslog or the exchange. Here
is an example of a JSON-formatted message sent to syslog:

    Mar  3 11:23:06 localhost rabbitmq-server[27908] <0.229.0> - {"time":"2021-03-03T11:23:06.998466+01:00","level":"notice","msg":"Logging: configured log handlers are now ACTIVE","meta":{"domain":"rabbitmq.prelaunch","file":"src/rabbit_prelaunch_logging.erl","gl":"<0.228.0>","line":311,"mfa":["rabbit_prelaunch_logging","configure_logger",1],"pid":"<0.229.0>"}}

For quick testing, the values accepted by the `$RABBITMQ_LOGS`
environment variables were extended:
  * `-` still means stdout
  * `-stderr` means stderr
  * `syslog:` means syslog on localhost
  * `exchange:` means logging to `amq.rabbitmq.log`

`$RABBITMQ_LOG` was also extended. It now accepts a `+json` modifier (in
addition to the existing `+color` one). With that modifier, messages are
formatted as JSON intead of plain text.

The `rabbitmqctl rotate_logs` command is deprecated. The reason is
Logger does not expose a function to force log rotation. However, it
will detect when a file was rotated by an external tool.

From a developer point of view, the old `rabbit_log*` API remains
supported, though it is now deprecated. It is implemented as regular
modules: there is no `parse_transform` involved anymore.

In the code, it is recommended to use the new Logger macros. For
instance, `?LOG_INFO(Format, Args)`. If possible, messages should be
augmented with some metadata. For instance (note the map after the
message):

    ?LOG_NOTICE("Logging: switching to configured handler(s); following "
                "messages may not be visible in this log output",
                #{domain => ?RMQLOG_DOMAIN_PRELAUNCH}),

Domains in Erlang Logger parlance are the way to categorize messages.
Some predefined domains, matching previous categories, are currently
defined in `rabbit_common/include/logging.hrl` or headers in the
relevant plugins for plugin-specific categories.

At this point, very few messages have been converted from the old
`rabbit_log*` API to the new macros. It can be done gradually when
working on a particular module or logging.

The Erlang builtin console/file handler, `logger_std_h`, has been forked
because it lacks date-based file rotation. The configuration of
date-based rotation is identical to Lager. Once the dust has settled for
this feature, the goal is to submit it upstream for inclusion in Erlang.
The forked module is calld `rabbit_logger_std_h` and is based
`logger_std_h` in Erlang 23.0.
2021-03-11 15:17:36 +01:00
dcorbacho 61f7b2a723 Update to ranch 2.0 2021-03-08 23:11:05 +01:00
Michael Klishin b6c4831e75
Bump Lager to 3.9.1 2021-03-04 04:36:39 +03:00
Loïc Hoguin 66ac1bf5e9
Bump observer_cli to 1.6.1
More responsive when the system is overloaded with file calls.
2021-03-01 21:55:27 +03:00
Michael Klishin 8fe3df9343
Upgrade Lager to 3.9.0 for OTP 24 compatibility
`lager_util:expand_path/1` use changes are
due to erlang-lager/lager#540
2021-02-26 00:52:15 +03:00
Michael Klishin f73e851f9c
Bump observer_cli to 1.6.0 2021-02-24 12:53:55 +03:00
Michael Klishin a5098b28a7
Bump Lager to 3.8.2 for OTP 24 compatibility 2021-02-24 12:53:30 +03:00
Michael Klishin b2b37f5626
Merge pull request #2791 from Appva/feature/jwks
Support fetching JWT signing keys from JWKS endpoint
2021-02-23 09:48:25 +03:00
Michael Klishin 2a5ee5b407
Destructure in the function head 2021-02-22 17:14:04 +03:00
Michael Klishin 0d615080f2
Remove a clause that would never match 2021-02-22 17:12:44 +03:00
Michael Klishin 2273797d36
Bindings in Erlang use CamelCase 2021-02-22 17:07:47 +03:00
Michael Klishin 7a4b0783c8
cuttlefish:unvalid/1 expects a string 2021-02-22 17:01:43 +03:00
Michal Kuratczyk 53fc8ebbe0 Make the tests green
Fix the snippet and make it more through.
2021-02-22 13:35:30 +01:00
Michal Kuratczyk c729e15112 WIP: cuttlefish support for oauth2 plugin
No support for symmetric key key options as this would make the
implementation much more complex and shouldn't really be used anyway.

WIP becasue while the code seems to work but tests fail.
2021-02-22 10:33:35 +01:00
Teo Klestrup Röijezon 543e8aa3a3 Enable jwks_http to run embedded without requiring a separate OTP application 2021-02-18 17:41:54 +01:00
Teo Klestrup Röijezon 68dd52e577 Move jwks_http modules into the test folder 2021-02-18 17:11:21 +01:00
Gabriele Santomaggio 742295583e fix old link 2021-02-15 16:20:21 +01:00
Teo Klestrup Röijezon 91add59b9a Document JWKS support 2021-02-05 12:01:38 +01:00
Teo Klestrup Röijezon 1a3d68be37 JWKS tests 2021-02-05 11:23:10 +01:00
Teo Klestrup Röijezon 480f7eaadf Support fetching JWT signing keys from JWKS endpoint 2021-02-03 17:09:54 +01:00
Michael Klishin 4aa149b1b2
Bump JOSE dependency to 1.11 2021-02-01 21:30:51 +03:00
Arnaud Cogoluègnes b921ac11a8
Merge pull request #2712 from rabbitmq/rabbitmq-stream-prometheus
Add stream prometheus plugin
2021-01-27 16:46:37 +01:00
Michael Klishin 52479099ec
Bump (c) year 2021-01-22 09:00:14 +03:00
Arnaud Cogoluègnes bf72683eb2
Add stream prometheus plugin 2021-01-11 16:49:56 +01:00
Arnaud Cogoluègnes 23d7e8114c
Introduce stream management plugin 2020-11-19 14:48:25 +01:00
Jean-Sébastien Pédron 47686ee1f0
Remove unused .github directories
They were valid until the switch to the "monorepository" when everything
was merged into a single Git repository.
2020-11-17 13:33:16 +01:00
Arnaud Cogoluègnes fb8e2be7df Update rabbitmq-components.mk 2020-11-03 14:27:35 +01:00
Michael Klishin 9fca2b5db6 Update rabbitmq-components.mk 2020-10-21 12:55:31 +03:00
Michael Klishin 6993eb3cac Merge pull request #51 from morsok/patch-1
[DOC] Add info about additional_rabbitmq_scopes
2020-10-08 15:17:37 +03:00
Simon fdacaf9b92 Fix md linking error 2020-10-08 09:32:44 +02:00
Robert Gustafsson 57716223e0 Add support for using extra scopes standalone
This commit makes it possible to use additional sources of scopes in a token
standalone, without the need of combining them with existing ones.
2020-09-16 16:30:24 +02:00
Simon Alling 9b0e853799 Simplify post_process_payload_keycloak 2020-09-01 17:17:15 +02:00
Alexandre amiche d966a66856 [DOC] Add info about additional_rabbitmq_scopes 2020-08-24 11:32:40 +02:00
Luke Bakken d398ef9a12 Update rabbitmq-components.mk 2020-08-04 08:41:46 -07:00
Jean-Sébastien Pédron 7aabc7d397 Update rabbitmq-components.mk 2020-07-30 12:06:51 +02:00
Luke Bakken ca5a1a5cf0 Update rabbitmq-components.mk 2020-07-29 10:02:02 -07:00
dcorbacho 9ffd10aa30 Update erlang.mk 2020-07-21 14:31:52 +01:00
Jean-Sébastien Pédron 97f6a61434 Update rabbitmq-components.mk 2020-07-21 12:07:56 +02:00
Michael Klishin 391115a570 Update rabbitmq-components.mk 2020-07-21 03:42:44 +03:00
dcorbacho b471122e9b Revert drop of Exhibit B on MPL 2.0 2020-07-20 16:57:22 +01:00
dcorbacho 2bf9d30638 Update LICENSE 2020-07-20 10:41:31 +01:00
Michael Klishin 3c8c33c438 Update MPL2 license file, drop Exhibit B
and add a VMware copyright notice.

We did not mean to make this code Incompatible with Secondary Licenses
as defined in [1].

1. https://www.mozilla.org/en-US/MPL/2.0/FAQ/
2020-07-17 14:53:04 +03:00
dcorbacho f0d39cb4e2 Switch to Mozilla Public License 2.0 (MPL 2.0) 2020-07-10 20:27:35 +01:00
Jean-Sébastien Pédron bf17f5de89 Update erlang.mk 2020-06-23 17:13:24 +02:00
Michael Klishin 474c0fc1b6 Bump Recon to 2.5.1
for Erlang 23 compatibility of 'rabbitmq-diagnostics observer'

References zhongwencool/observer_cli#68.
2020-06-09 08:22:12 +03:00
Michael Klishin 6ebf80174d Update README.md 2020-05-19 21:08:43 +03:00
Michael Klishin 9776180291 Reword a confusing sentence 2020-05-19 21:03:54 +03:00
Michael Klishin ab8df7c70c Update README.md 2020-04-29 18:19:16 +03:00
Michael Klishin a366fc49ec Update README.md 2020-04-29 18:18:30 +03:00
Jean-Sébastien Pédron 7dcc11cdfd Update copyright (year 2020) 2020-03-10 16:05:48 +01:00
Michael Klishin d8b77afceb Merge pull request #45 from rabbitmq/rsa_keys
Improve error messages for verification failures with RSA keys
2020-03-10 00:23:33 +03:00
Philip Kuryloski 28080e1e2c Log authentication rejection messages
Normally when auth fails, we simply log that it failed for a given
username. Since the username is ignored with the auth mechanism,
this does not provide sufficient context for debugging config
errors.
2020-03-09 12:49:48 +01:00
Philip Kuryloski 37d9a2bf77 Add a docker based example of rsa_keys
Add a simpler way of demonstrating asymmetric keys, where only
docker is required.
2020-03-09 12:49:48 +01:00
Michael Klishin 2b2a7471f5 Bump jose to 1.10.1
Primarily to reduce confusion about its licensing.
jose has been MIT-licensed since Dec 2018.
2020-03-09 11:04:25 +03:00
Gerhard Lazu 197e077078 Update rabbitmq-components.mk 2020-03-06 09:19:13 +00:00
Gerhard Lazu 4f32940765 Update erlang.mk 2020-03-06 09:17:19 +00:00
Jean-Sébastien Pédron 65238638fc Travis CI: Update config from rabbitmq-common 2020-03-04 14:24:27 +01:00
Jean-Sébastien Pédron 4cb2d24b0c Travis CI: Update config from rabbitmq-common 2020-03-04 11:17:13 +01:00
Jean-Sébastien Pédron 4eb61c19f0 Travis CI: Update config from rabbitmq-common 2020-03-03 14:53:37 +01:00
Michael Klishin 8d4b3439f9 Avoid using erlang:get_stacktrace/0 for improved OTP 23/24 compat 2020-02-27 22:22:32 +03:00
Gerhard Lazu 0acac56586 Update rabbitmq-components.mk 2020-02-11 15:31:41 +00:00
Arnaud Cogoluègnes 80dfdc64df Use {pem, <<PEM>>} style configuration for asymmetric keys sample
This avoids having to mention fields like "n" (modulus) and "e"
(exponent) which are difficult to extract from the public key and then
encode.
2020-01-15 15:35:04 +01:00
Michael Klishin e4870b9c70 (c) bump 2019-12-29 05:50:24 +03:00
Jean-Sébastien Pédron a58c3f5f48 Git: Ignore copied CLI 2019-12-12 13:24:26 +01:00
Jean-Sébastien Pédron aef9207977 Update rabbitmq-components.mk 2019-12-12 13:14:52 +01:00
Anton Dalgren c4789ac25a Added missing comma in configuration example 2019-12-09 11:51:12 +01:00
Arnaud Cogoluègnes e936e82292 Move up aud/scope binary to array conversion
This way scope is always an array which makes it easier for downstream
processing.

References #41
2019-12-05 14:26:17 +01:00
Arnaud Cogoluègnes cb3fe65a07 Polish extra scopes source tests
Set up environment in init/end test functions, change some scopes in
test to make assertion more obvious.

References #41
2019-12-05 14:10:21 +01:00
Michael Klishin d9073fba8d Make this code less unorthodox, take 2
Also improves naming a bit.
2019-12-05 10:28:37 +03:00
Michael Klishin 7d2b069cbd Make this code less unorthodox, take 1 2019-12-05 10:12:51 +03:00
Michal Papuga 9a230b0aeb Resolve PR comments - rename variables. 2019-12-05 05:29:12 +01:00
Michal Papuga 3a04670a45 Implement support for gathering scopes from predefined JWT section and combine them with existing ones in post_process_payload () method. Create unit_SUITE and system_SUITE test cases. 2019-12-04 19:14:08 +01:00
Michael Klishin 1e0cb18279 Revert "Update rabbitmq-components.mk"
This reverts commit 157e9ce515.

We want to continue using Ra master on RabbitMQ master branches.
2019-10-30 12:03:53 +03:00
Michael Klishin 157e9ce515 Update rabbitmq-components.mk 2019-10-30 12:03:07 +03:00
kjnilsson 764725fe71 Update rabbitmq-components.mk 2019-09-13 10:24:14 +01:00
kjnilsson 60430d7a59 Update rabbitmq-components.mk 2019-09-04 10:30:52 +01:00
Michael Klishin 6c513b4a4e Merge pull request #38 from rabbitmq/rabbitmq-auth-backend-oauth2-37-keycloak-support
Support Keycloak token format in post-processing
2019-08-22 08:20:49 +07:00
Michael Klishin d4e3706937 Add management config settings to the symmetric key demo 2019-08-22 04:03:04 +03:00
Arnaud Cogoluègnes f3405e46fa Support Keycloak token format in post-processing
Scopes from the "authorization" field are extracted and replace the
value of the "scope" key in the parsed and processed token.

Fixes #37
2019-08-21 10:34:20 +02:00
Michael Klishin 9ea2c69588 Update rabbitmq-components.mk 2019-08-11 01:47:48 +10:00
Jean-Sébastien Pédron 420e482687 Update erlang.mk 2019-08-02 09:53:31 +02:00
Michael Klishin 838618de0c Update rabbitmq-components.mk 2019-08-01 17:13:09 +03:00
Arnaud Cogoluègnes 16968e8c66 Remove unnecessary console output 2019-07-24 09:04:58 +02:00
Luke Bakken f01f0fe023 Add GitHub templates
And LICENSE file.

Fixes #33
2019-07-18 14:28:41 -07:00
Michael Klishin 01e05dbb77 Add Code of Conduct and Contributing files
Standard for tier 1 RabbitMQ plugins.

References #33.
2019-07-18 17:05:42 +03:00
Arnaud Cogoluègnes 49f1b6b043 Support simple strings in aud and scope fields
Simple strings are supported, strings with spaces are split into arrays.
The strings are split upfront, the Erlang representation of the token
does not change, to avoid impacts in the code downstream.

Fixes #24
2019-07-12 09:45:02 +02:00
Michael Klishin 5f44635d05 uaa_jwt:get_jwk/1: return an error if there are no configured signing keys
Closes #30.
2019-07-10 18:52:59 +03:00
Arnaud Cogoluègnes 833bb4cec9 Deal with unused parameter 2019-07-10 15:47:57 +02:00
Arnaud Cogoluègnes 29b9b9152c Add early plugin dependency to compile command
Otherwise make xref fails.
2019-07-10 15:42:03 +02:00
Arnaud Cogoluègnes cb81b0748f Remove extra parameters from output call 2019-07-10 15:12:48 +02:00
Arnaud Cogoluègnes de859d0e72 Document tag support
For management plugin access. Add a tag to the super user in the demo.
2019-07-09 17:44:27 +02:00
Arnaud Cogoluègnes c83efe4db5 Update rabbitmq-components.mk 2019-07-09 16:05:50 +02:00
Arnaud Cogoluègnes ae8b61a8aa Check token expiration on authentication 2019-07-02 15:27:13 +02:00
Michael Klishin fdb4693083 Integration suite: don't attempt to close channels on a closing connection 2019-07-02 13:20:36 +02:00
Michael Klishin 16f7328986 Integration suite: correctly compute expiration
it should be in seconds.
2019-07-02 12:15:17 +02:00
Michael Klishin d44e4bce59 Integration tests for JWT token/secret updates; improved error reporting 2019-07-01 21:20:57 +02:00
Michael Klishin 8a8bda0369 More OAuth 2 token refresh tests (WIP) 2019-07-01 16:48:53 +02:00
Arnaud Cogoluègnes 961b8d0c55 Merge branch 'master' into oauth2-credential-expiration-support 2019-07-01 11:43:38 +02:00
Arnaud Cogoluègnes 907624372d Update rabbitmq-components.mk 2019-07-01 11:36:34 +02:00
Arnaud Cogoluègnes d9a0ddd6bd Update erlang.mk 2019-07-01 11:36:17 +02:00
Michael Klishin 369e4158c1 Assert on operations on both new and existing channels
Per suggestion from @acogoluegnes.
2019-06-29 00:28:05 +02:00
Michael Klishin 4a4f81c374 Token refresh integration tests
Depend on recent updates in the Erlang client.
2019-06-28 18:44:33 +02:00