Skip to main content
Version: 4.0

Use Keycloak as OAuth 2.0 server

This guide explains how to set up OAuth 2.0 for RabbitMQ and Keycloak as Authorization Server using the following flows:

  • Access management UI via a browser
  • Access management HTTP API
  • Application authentication and authorization

Prerequisites to follow this guide

  • Docker
  • make
  • A local clone of a GitHub repository that contains all the configuration files and scripts used on this example
    • Add the following entry to /etc/hosts:
localhost keycloak rabbitmq

Deploy Keycloak

  1. First, deploy Keycloak. It comes preconfigured with all the required scopes, users and clients.

  2. Run the following command to start Keycloak server:

    make start-keycloak

There is a dedicated Keycloak realm called Test configured as follows:

  • A rsa signing key
  • A rsa provider
  • Three clients: rabbitmq-client-code for the rabbitmq management UI, mgt_api_client to access via the management api and producer to access via AMQP protocol.

Start RabbitMQ

Run the command below to start RabbitMQ configured with the Keycloak server we started in the previous section: This is the rabbitmq.conf used for Keycloak.

export MODE=keycloak
make start-rabbitmq

Access Management api

To access the management api run the following command. It uses the client mgt_api_client which has the scope rabbitmq.tag:administrator.

make curl-keycloak url=http://localhost:15672/api/overview client_id=mgt_api_client secret=LWOuYqJ8gjKg3D2U8CJZDuID3KiRZVDa

Application authentication and authorization with PerfTest

To test OAuth 2.0 authentication with AMQP protocol you are going to use RabbitMQ PerfTest tool which uses RabbitMQ Java Client.

First you obtain the token and pass it as a parameter to the make target start-perftest-producer-with-token.

make start-perftest-producer-with-token PRODUCER=producer TOKEN=$(bin/keycloak/token producer kbOFBXI9tANgKUq8vXHLhT6YhbivgXxn test)

NOTE: Initializing an application with a token has one drawback: the application cannot use the connection beyond the lifespan of the token. See the next section where you demonstrate how to refresh the token.

Application authentication and authorization with Pika

In the following information, OAuth 2.0 authentication is tested with the AMQP protocol and the Pika library. These tests specifically demonstrate how to refresh a token on a live AMQP connection.

The sample Python application can be found on GitHub.

To run this sample code proceed as follows:

python3 --version
pip install pika
pip install requests
python3 pika-client/producer.py producer kbOFBXI9tANgKUq8vXHLhT6YhbivgXxn
tip

If pip is not available try instead the following two commands to installing it:

python3 -m venv venv
source venv/bin/activate

Note: Ensure you install pika 1.3

Access management UI

  1. Go to http://localhost:15672.
  2. Click on the single button on the page which redirects to Keycloak to authenticate.
  3. Enter rabbit_admin and rabbit_admin and you should be redirected back to RabbitMQ Management fully logged in.

Stop keycloak

make stop-keycloak

Notes about setting up Keycloak

Configure Client

For backend applications which uses Client Credentials flow, you can create a Client with:

  • Access Type : public
  • Turn off Standard Flow, Implicit Flow, and Direct Access Grants
  • With Service Accounts Enabled on. If it is not enabled you do not have the tab Credentials
  • In the Credentials tab, you have the client id

Configure Client scopes

Default Client Scope are scopes automatically granted to every token. Whereas Optional Client Scope are scopes which are only granted if they are explicitly requested during the authorization/token request flow.

Include appropriate aud claim

You must configure a Token Mapper of type Hardcoded claim with the value of rabbitmq's resource_server_id*. You can configure Token Mapper either to a Client scope or to a Client.