Add Azure AD use case #8

baptistedaroit · 2022-06-21T14:58:59Z

Hello!

As discussed in issue #2605, here is a pull request to add a tutorial about how to integrate with Azure AD.

This is for now only focusing on accessing the RabbitMQ Management UI.

Thanks.

michaelklishin · 2022-06-22T08:21:20Z

Thank you! It's a substantial amount of work. It will take some time to review as well :)

MarcialRosales · 2022-06-22T10:58:04Z

conf/azure/rabbitmq.config

+   {resource_server_id, <<"PUT YOUR AZURE AD APPLICATION ID">>},
+   {extra_scopes_source, <<"roles">>},
+   {key_config, [
+     {jwks_url, <<"PUT YOUR AZURE AD JWKS URI VALUE">>}


Umm. I think I should initialize jwks_url from the openconnect discovery endpoint unless the discover endpoint does not return a jwks_uri. I did not think about this one. Thank you !!!

MarcialRosales · 2022-06-22T11:04:52Z

use-cases/azure.md

+
+> :arrow_right: You will provide this file to RabbitMQ when you will start it (later in this tutorial)
+
+## Start RabbitMQ


Did you try the instructions on how to start RabbitMq explained here? in particular the very last step which suggest using an already built docker image. Did it work for you?

The plan is that once this oidc-integration branch merges into v.3.10.x branch we drop all the instructions referring to building RabbiMQ and instead we pull one of the existing docker images.

I didn't try before but I just did: it works perfectly so let me try to adjust the tutorial to use this method instead of building rabbitmq from scratch as I did.

MarcialRosales · 2022-06-22T11:09:59Z

use-cases/azure.md

+
+For the purpose of this tutorial, you can generate a self-signed certificate/key pair (answer the questions and enter the Common Name when prompted):
+```
+openssl req -newkey rsa:2048 -nodes -keyout KEY_FILENAME.key -x509 -days 365 -out CERT_FILENAME.crt


May I suggest that you create an azure folder under bin folder , similar to bin/keycloak or bin/uaa, called setup that generates this cert with the exact name you will use in the proxy.conf?

In the Makefile, there could be a target "setup-azure" which calls this script. Just a suggestion.

Sure. Let me try to implement it :)

MarcialRosales · 2022-06-22T11:13:10Z

use-cases/azure.md

+- Expose HTTPS port **443**
+
+```
+docker run -d -p 443:443 -v ./proxy.conf:/etc/nginx/conf.d/proxy.conf -v ./rabbit.crt:/etc/nginx/rabbit.crt -v ./rabbit.key:/etc/nginx/rabbit.key nginx:latest


To make it dead easy for community using this tutorial, I was thinking of providing scripts and invoke those scripts from a target in the Makefile.
For instance, what about a target in the Makefile called start-azure-proxy ? Up to you if you prefer to call directly docker from the Makefile target or move the docker statement to a separate script under bin/azure whichever way is easy. Sometimes i find it easier to do the latter.

MarcialRosales

Thank you so much for this thorough work !

I am glad to see that Azure does not impose its own scope's structure. I have seen that you have been able to define scopes compliant with RabbitMQ.

I would like to go through the tutorial and try it out but as far as i can see I am happy with the changes. I have left a few small comments.

baptistedaroit · 2022-06-24T15:42:19Z

@MarcialRosales

I have updated the initial proposition to be easier and compliant with a local implementation (ie using localhost):

I added a build-azure target in the Makefile that generates ssl files needed to implement https
I updated the bin/deploy-rabbit script to expose extra ports (here 15671 for https management ui) and mount required ssl files when MODE=azure

This should be quite simple now to follow this tutorial.

HTH.

MarcialRosales · 2022-06-28T07:55:01Z

Hi @baptistedaroit , it does help a lot. I am hoping to merge your PR after I use your guide today. Thanks !

MarcialRosales · 2022-06-28T13:47:22Z

bin/azure/deploy

+echo "--------------------------------"
+echo "Configure SSL cert/key ownership"
+echo "--------------------------------"
+chown 999:999 ${ROOT}/conf/azure/rabbitmq-ca.crt \


When I run it on my mac, these two lines failed. I skipped them and everything worked fine. @baptistedaroit Do we need them?

@MarcialRosales I think it depends on how docker is configured on the machine. In my case, I needed it because the key was mounted in the container with root as owner, with permissions 600 thus preventing rabbitmq to read it at startup.

MarcialRosales · 2022-06-28T13:49:17Z

conf/azure/rabbitmq.config

+     ]},
+     {oauth_enable, true},
+     {oauth_client_id, "PUT YOUR AZURE AD APPLICATION ID"},
+     {oauth_client_secret, "PUT YOUR AZURE AD APPLICATION SECRET"},


I made a mistake from the beginning even though in your instructions you cleared set, "take the value of the secret". And I wrongly took the secret id. Maybe, and given in the Azure user interface it is referred as "secret value", we can use "PUT YOUR AZURE AD APPLICATION SECRET VALUE"

ahah yep you are right, it can be confusing. Sorry about that one!

MarcialRosales · 2022-06-28T13:50:52Z

use-cases/azure.md

+
+## Verify RabbitMQ Management UI access
+
+Go to RabbitMQ Management UI `https://localhost:15671`. Depending on your browser, ignore the security warnings (raised by the fact that we are using a self-signed certificate) to proceed. 


very minor: I would not wrap the uri https://localhost:15671 in single quotes so that the reader can simply click and redirect to the management ui.

MarcialRosales · 2022-06-28T13:51:39Z

use-cases/azure.md

+```
+
+This generates the following files in `conf/azure`:
+- **rabbitmq-ca.**crt**: a custom certificate authority that is used to generate and sign a self signed certificate for RabbitMQ


i think you have an extra double * in front of crt.

MarcialRosales

EXCELLENT JOB ! I followed your guide without any problems. In fact, I did only one mistake which was taking the secret id rather than the secret value. But that was me playing bold.

THANK YOU VERY MUCH @baptistedaroit !

baptistedaroit · 2022-06-28T15:48:51Z

Thanks!

baptistedaroit mentioned this pull request Jun 21, 2022

Support for more general OAuth2 providers rabbitmq/rabbitmq-server#2605

Closed

MarcialRosales reviewed Jun 22, 2022

View reviewed changes

baptistedaroit force-pushed the oidc-integration-azure-use-case branch 3 times, most recently from 45950bb to 7fc1093 Compare June 24, 2022 15:30

Add Azure AD use case

58c7e31

baptistedaroit force-pushed the oidc-integration-azure-use-case branch from 7fc1093 to 58c7e31 Compare June 24, 2022 15:33

MarcialRosales self-requested a review June 28, 2022 13:45

MarcialRosales reviewed Jun 28, 2022

View reviewed changes

MarcialRosales approved these changes Jun 28, 2022

View reviewed changes

MarcialRosales merged commit 77d85d0 into rabbitmq:oidc-integration Jun 28, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add Azure AD use case #8

Add Azure AD use case #8

baptistedaroit commented Jun 21, 2022

michaelklishin commented Jun 22, 2022

MarcialRosales Jun 22, 2022

MarcialRosales Jun 22, 2022

baptistedaroit Jun 22, 2022

MarcialRosales Jun 22, 2022

baptistedaroit Jun 22, 2022

MarcialRosales Jun 22, 2022

MarcialRosales left a comment •

edited

Loading

baptistedaroit commented Jun 24, 2022

MarcialRosales commented Jun 28, 2022

MarcialRosales Jun 28, 2022

baptistedaroit Jun 28, 2022

MarcialRosales Jun 28, 2022

baptistedaroit Jun 28, 2022

MarcialRosales Jun 28, 2022

MarcialRosales Jun 28, 2022

MarcialRosales left a comment •

edited

Loading

baptistedaroit commented Jun 28, 2022


		> :arrow_right: You will provide this file to RabbitMQ when you will start it (later in this tutorial)

		## Start RabbitMQ


		## Verify RabbitMQ Management UI access

		Go to RabbitMQ Management UI `https://localhost:15671`. Depending on your browser, ignore the security warnings (raised by the fact that we are using a self-signed certificate) to proceed.

Add Azure AD use case #8

Add Azure AD use case #8

Conversation

baptistedaroit commented Jun 21, 2022

michaelklishin commented Jun 22, 2022

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

MarcialRosales left a comment • edited Loading

Choose a reason for hiding this comment

baptistedaroit commented Jun 24, 2022

MarcialRosales commented Jun 28, 2022

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

MarcialRosales left a comment • edited Loading

Choose a reason for hiding this comment

baptistedaroit commented Jun 28, 2022

MarcialRosales left a comment •

edited

Loading

MarcialRosales left a comment •

edited

Loading