RabbitMQ

 Hi, I need encrypt the ldap bind user password in rabbitmq.conf file but after set it the bind to ldap fails due to ldap_bind_error. The details of the configurations are following. Would appreciate if someone could help. Thanks.

LUCIANO LIMONI's profile image
LUCIANO LIMONI posted Mar 19, 2020 08:52 PM

rabbitmq.conf file

 

 auth_ldap.dn_lookup_bind.user_dn = uid=klhrabmq,ou=sistemas,ou=people,o=portoseguro,c=BR

 auth_ldap.dn_lookup_bind.password = {encrypted,HviVJ2KgI1uvw8jLtTpo1OwXqq6T9CgNud9EnxySDKEFDgHYsff6xVqlNbS6x+Nt}

 auth_ldap.dn_lookup_attribute = uid

 auth_ldap.dn_lookup_base = ou=people,o=portoseguro,c=BR

 

advanced.config file

 

[

 

{rabbitmq_auth_backend_ldap,[

   {vhost_access_query, {constant, true}},

 

   {resource_access_query, {constant, true}},

   {topic_access_query, {constant, true}},

   {tag_queries,      [{administrator, {constant, false}},

               {management,  {constant, true}}]}

]},

 

{rabbit, [{config_entry_decoder,[{passphrase, portoseguro}]}]}

 

].

 

Error Message:

 

2020-03-19 14:35:33.828 [info] <0.870.0> LDAP CHECK: login for slhvarei

2020-03-19 14:35:33.828 [info] <0.870.0>   LDAP connecting to servers: ["ldap-homol.portoseguro.brasil"]

2020-03-19 14:35:33.831 [info] <0.871.0>   LDAP network traffic: bind request = {'BindRequest',3,"uid=klhrabmq,ou=sistemas,ou=people,o=portoseguro,c=BR",{simple,"{encrypted,HviVJ2KgI1uvw8jLtTpo1OwXqq6T9CgNud9EnxySDKEFDgHYsff6xVqlNbS6x+Nt}"}}

2020-03-19 14:35:33.834 [info] <0.871.0>   LDAP network traffic: bind reply = {ok,{'LDAPMessage',1,{bindResponse,{'BindResponse',invalidCredentials,[],[],asn1_NOVALUE,asn1_NOVALUE}},asn1_NOVALUE}}

2020-03-19 14:35:33.834 [info] <0.454.0>   LDAP bind returned "invalid credentials": uid=klhrabmq,ou=sistemas,ou=people,o=portoseguro,c=BR

2020-03-19 14:35:33.834 [info] <0.870.0>   LDAP connecting to servers: ["ldap-homol.portoseguro.brasil"]

2020-03-19 14:35:33.834 [info] <0.871.0>   LDAP network traffic: bind request = {'BindRequest',3,{refused,"uid=klhrabmq,ou=sistemas,ou=people,o=portoseguro,c=BR",[]},{simple,<<"llllou55">>}}

2020-03-19 14:35:33.835 [info] <0.454.0>   LDAP bind error: {refused,"uid=klhrabmq,ou=sistemas,ou=people,o=portoseguro,c=BR",[]} {'EXIT',{{badmatch,{error,{asn1,{function_clause,[{'ELDAPv3',encode_restricted_string,[{refused,"uid=klhrabmq,ou=sistemas,ou=people,o=portoseguro,c=BR",[]},[<<4>>]],[{file,"/tmp/build/8979955e/erlang-rpm-src/BUILD/otp-OTP-22.2.7/lib/eldap/src/../ebin/ELDAPv3.erl"},{line,3438}]},{'ELDAPv3',enc_BindRequest,2,[{file,"/tmp/build/8979955e/erlang-rpm-src/BUILD/otp-OTP-22.2.7/lib/eldap/src/../ebin/ELDAPv3.erl"},{line,1250}]},{'ELDAPv3',enc_LDAPMessage_protocolOp,2,[{file,"/tmp/build/8979955e/erlang-rpm-src/BUILD/otp-OTP-22.2.7/lib/eldap/src/../ebin/ELDAPv3.erl"},{line,328}]},{'ELDAPv3',enc_LDAPMessage,2,[{file,"/tmp/build/8979955e/erlang-rpm-src/BUILD/otp-OTP-22.2.7/lib/eldap/src/../ebin/ELDAPv3.erl"},{line,305}]},{'ELDAPv3',encode,2,[{file,"/tmp/build/8979955e/erlang-rpm-src/BUILD/otp-OTP-22.2.7/lib/eldap/src/../ebin/ELDAPv3.erl"},{line,145}]},{eldap,send_the_LDAPMessage,3,[{file,"eldap.erl"},{line,1003}]},{eldap,request,4,[{file,"eldap.erl"},{line,985}]},{eldap,exec_simple_bind,2,[{file,"eldap.erl"},{line,695}]}]}}}},[{eldap,send_the_LDAPMessage,3,[{file,"eldap.erl"},{line,1003}]},{eldap,request,4,[{file,"eldap.erl"},{line,985}]},{eldap,exec_simple_bind,2,[{file,"eldap.erl"},{line,695}]},{eldap,do_the_simple_bind,4,[{file,"eldap.erl"},{line,680}]},{eldap,loop,2,[{file,"eldap.erl"},{line,546}]}]}}

2020-03-19 14:35:33.835 [info] <0.870.0> LDAP DECISION: login for slhvarei: {error,ldap_bind_error}

2020-03-19 14:35:33.835 [warning] <0.870.0> HTTP access denied: rabbit_auth_backend_cache failed authenticating slhvarei: ldap_bind_error

Luke Bakken's profile image
Luke Bakken

Hello,

 

You will have to put all of your settings into the rabbitmq_auth_backend_ldap section of the configuration file. Since you won't have any settings left in rabbitmq.conf, the file should be called /etc/rabbitmq/rabbitmq.config

 

Please see this mailing list discussion for how to solve your problem:

 

https://groups.google.com/d/topic/rabbitmq-users/-29AXD51qoM/discussion

 

Especially the solution here:

 

https://groups.google.com/d/msg/rabbitmq-users/-29AXD51qoM/CVErMxBMEgAJ

 

Thanks,

Luke