RabbitMQ

 How to access Rabbitmq management UI with Apache basic auth SSO

Vignesh Narasimhulu's profile image
Vignesh Narasimhulu posted Mar 30, 2020 04:31 PM

I'm trying to use apache as reverse proxy for rabbitmq management UI with authentication handled in apache.

 

The apache authentication and redirection to rabbitmq node works fine. However, once apache authenticates the page, it takes me to rabbitmq login page. I want rabbitmq to honor the authentication that was handled by apache i.e. something like auth-proxy.

 

As a workaround, I have setup same user/password in apache & rabbitmq and I login twice. I would like to know how to enable SSO using apache basic-auth for rabbitmq management UI. Thanks.

 

RabbitMQ version: 3.7.17

Apache: 2.4.29

OS: Ubuntu 18

 

Thanks in advance.

Luke Bakken's profile image
Luke Bakken posted Mar 30, 2020 05:30 PM

Apache must be configured to send the same Basic Auth header with every request to RabbitMQ.

 

Thanks -

Luke

Vignesh Narasimhulu's profile image
Vignesh Narasimhulu posted Mar 31, 2020 04:40 AM

Hi Luke, thanks for your reply. Apache passes the basicauth to rabbitmq and I validated the same via Chrome debug and I can see that authorization is passed with basic auth. However, it does not allow until I login via the rabbitmq UI too with the same credentials. Am I missing some additional headers or parameters to be passed from apache to rabbitmq management UI?

 

Thanks.

Luke Bakken's profile image
Luke Bakken posted Mar 31, 2020 05:36 AM

Hello,

 

When you log in, a cookie is set. Unless this cookie is passed back to the user's browse, and then used, a double-sign on is necessary.

 

Here is the code:

 

https://github.com/rabbitmq/rabbitmq-management/blob/master/priv/www/js/main.js#L56-L81

 

Thanks,

Luke

Vignesh Narasimhulu's profile image
Vignesh Narasimhulu posted Mar 31, 2020 09:31 AM

Thanks again, Luke. Let me check that.

Vignesh Narasimhulu's profile image
Vignesh Narasimhulu posted Apr 14, 2020 02:57 AM

I managed to get it working using the below apache config. However, it works only if username and password is simple. If password is complex, the passthrough feature does not work and I have to re-login in RMQ management UI too. So I'm checking how to overcome that - any help is appreciated, thanks:

 

#get authorization, format it and assign it to cookie in rmq-ui compatible format RewriteCond %{HTTP:Authorization} "^Basic (.*)$" RewriteRule .* - [E=authcheck:%1,NS] Header set Set-Cookie "m=2258:%{authcheck}e"   AllowEncodedSlashes On <Location /rabbitmq> ProxyPass http://RMQNODE:15672 nocanon ProxyPassReverse http://RMQNODE:15672 ProxyPassReverseCookiePath / /rabbitmq/ </Location>