Skip to content

4.1: Add a proxy configuration setting for OAuth 2 #2143

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 3 commits into from
Closed

4.1: Add a proxy configuration setting for OAuth 2 #2143

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
e98bb10
Add proxy variable
MarcialRosales Dec 16, 2024
5f936c8
Declare proxy configurable variable
MarcialRosales Dec 17, 2024
3bd333f
Add link to forward proxy section
MarcialRosales Dec 17, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
41 changes: 39 additions & 2 deletions docs/oauth2.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -159,6 +159,11 @@ In chronological order, here is the sequence of events that occur when a client
| `auth_oauth2.https.fail_if_no_peer_cert` | Used together with `auth_oauth2.https.peer_verification = verify_peer`. When set to `true`, TLS connection will be rejected if the client fails to provide a certificate. The default value is `false`.
| `auth_oauth2.https.hostname_verification` | Enable wildcard-aware hostname verification for key server. Available values: `wildcard`, `none`. The default value is `none`.
| `auth_oauth2.https.crl_check` | [Perform CRL verification](https://www.erlang.org/doc/man/ssl#type-crl_check) (Certificate Revocation List) verification. Default value is false.
| `auth_oauth2.proxy` | Configures explicit [forward proxy](#forward-proxy) server used to connect to the issuer.
| `auth_oauth2.proxy.host` | Proxy's hostname
| `auth_oauth2.proxy.port` | Proxy's port (HTTP)
| `auth_oauth2.proxy.username` | Username if required to authenticate with proxy server.
| `auth_oauth2.proxy.password` | Password if required to authenticate with proxy server.
| `auth_oauth2.algorithms` | Restrict [the usable algorithms](https://github.com/potatosalad/erlang-jose#algorithm-support).
| `auth_oauth2.verify_aud` | Whether to verify the [token's `aud`](#token-validation) field or not. The default value is `true`.
| `auth_oauth2.resource_servers` | [Multiple OAuth 2.0 resources configuration](#multiple-resource-servers-configuration).
Expand Down Expand Up @@ -277,6 +282,33 @@ auth_oauth2.algorithms.1 = HS256
auth_oauth2.algorithms.2 = RS256
```

## Forward Proxy {#forward-proxy}

This configuration is required when RabbitMQ has to go via an explicit forward proxy
in order to connect to the Authorization Server's endpoints. RabbitMQ uses the [HTTP Connect](https://en.wikipedia.org/wiki/HTTP_tunnel#HTTP_CONNECT_method) method to establish a
HTTP Tunnel with the forward proxy.

This table below summarizes the variables that configures the forward proxy.

| Key | Documentation
|--------------------------------------------|-----------
| `auth_oauth2.proxy.host` | Proxy's hostname
| `auth_oauth2.proxy.port` | Proxy's port (HTTP)
| `auth_oauth2.proxy.username` | Username if required to authenticate with proxy server.
| `auth_oauth2.proxy.password` | Password if required to authenticate with proxy server.


This table below summarizes the variables that configures the forward proxy for
an OAuth provider declared under `auth_oauth2.oauth_providers` like `auth_oauth2.oauth_providers.{id/index}`.

| Key | Documentation
|--------------------------------|-----------
| `proxy.host` | Proxy's hostname
| `proxy.port` | Proxy's port (HTTP)
| `proxy.username` | Username if required to authenticate with proxy server.
| `proxy.password` | Password if required to authenticate with proxy server.



## Multiple Resource Servers Сonfiguration {#multiple-resource-servers-configuration}

Expand Down Expand Up @@ -322,8 +354,13 @@ Each `auth_oauth2.oauth_providers.{id/index}` entry has the following sub-keys.
| `https.depth` | The maximum number of non-self-issued intermediate certificates that may follow the peer certificate in a valid [certification path](ssl#peer-verification-depth). The default value is 10.
| `https.verify` | Configures [peer verification](ssl#peer-verification). Available values: `verify_none`, `verify_peer`. The default value is `verify_peer` if there are trusted CA installed in the OS or `auth_oauth2.https.cacertfile` is set.
| `https.fail_if_no_peer_cert` | Used together with `auth_oauth2.https.peer_verification = verify_peer`. When set to `true`, TLS connection will be rejected if the client fails to provide a certificate. The default value is `false`.
| `https.hostname_verification` | Enable wildcard-aware hostname verification for key server. Available values: `wildcard`, `none`. The default value is `none`.
| `https.crl_check` | [Perform CRL verification](https://www.erlang.org/doc/man/ssl#type-crl_check) (Certificate Revocation List) verification. Default value is false.
| `https.hostname_verification`| Enable wildcard-aware hostname verification for key server. Available values: `wildcard`, `none`. The default value is `none`.
| `https.crl_check` | [Perform CRL verification](https://www.erlang.org/doc/man/ssl#type-crl_check) (Certificate Revocation List) verification. Default value is false.
| `proxy` | Configures the explicit [forward proxy ](#forward-proxy) server used to connect to the issuer.
| `proxy.host` | Proxy's Hostname
| `proxy.port` | Proxy's Port (HTTP)
| `proxy.username` | Username if required to authenticate with proxy server.
| `proxy_password` | Password if required to authenticate with proxy server.
| `signing_keys` | Local filesystem paths to the [signing key files](#signing-key-files). The files must exist and be readable.
| `default_key` | ID of the default signing key.
| `algorithms` | Used to restrict [the list of enabled algorithms](https://github.com/potatosalad/erlang-jose#algorithm-support).
Expand Down