OAuth 2: Variable expansion, topic permissions vs resource permissions

[inseroaj]

Community Support Policy

• I have read RabbitMQ's Community Support Policy

RabbitMQ version used

4.0.3

How is RabbitMQ deployed?

Community Docker image

Steps to reproduce the behavior in question

@MarcialRosales Upon upgrading from RabbitMQ 4.1.0 to 4.1.1, the issue in #13894 was resolved, however I'm still a bit confused why it did not work before.

From what I understand, the change in 4.1.1 was only about supporting resource permissions in addition to topic permissions. Such that the pattern */queueprefix.{sub}.* should work in addition to */queueprefix.{name}.*/*. But as mentioned in this comment, even using the longer pattern */queueprefix.{name}.*/* for the rabbitmq.read permission, I still got the error read access to queue 'queueprefix.MYUSER.somequeue' in vhost '/' refused for user 'MYUSER' (using RabbitMQ 4.1.0).

For the test, I only tried reading from the queue using the Get Message(s) feature for a queue in the RabbitMQ Management UI. Is the reason simply the way the management UI reads from the queue - that it must be a resource based permission rather than topic permissions?

To clarify: There is no issue, just trying to understand the relationship between these permission types.

[MarcialRosales]

Hi @inseroaj , thanks for insisting on getting a clarification about the root cause. You were right, there was one more issue in 4.1.0 which it was also addressed in 4.1.1. The management ui, first of all, checks that the user has access to the vhost in addition to read access on the queue. However, the oauth2 backend did not support variable expansion when checking vhost access, only when checking against topic permissions.

[inseroaj]

Thanks for the clarification.
Although, the vhost part of the pattern */queueprefix.{sub}.* is the first *. No variable expansion involved there - it's in the queue name part. But are you just saying that it wasn't able to resolve the permission in a vhost context, if it involves a variable expansion at all?