Use Keycloak as OAuth 2.0 server
This guide explains how to set up OAuth 2.0 for RabbitMQ and Keycloak as Authorization Server using the following flows:
- Access management UI via a browser
- Access management HTTP API
- Application authentication and authorization
Prerequisites to follow this guide
- Docker
- make
- A local clone of a GitHub repository that contains all the configuration files and scripts used on this example
- Add the following entry to
/etc/hosts
:
- Add the following entry to
localhost keycloak rabbitmq
Deploy Keycloak
-
First, deploy Keycloak. It comes preconfigured with all the required scopes, users and clients.
-
Run the following command to start Keycloak server:
make start-keycloak
There is a dedicated Keycloak realm called Test
configured as follows:
- A rsa signing key
- A rsa provider
- Three clients:
rabbitmq-client-code
for the rabbitmq management UI,mgt_api_client
to access via the management api andproducer
to access via AMQP protocol.
Start RabbitMQ
Run the command below to start RabbitMQ configured with the Keycloak server we started in the previous section: This is the rabbitmq.conf used for Keycloak.
export MODE=keycloak
make start-rabbitmq
Access Management api
To access the management api run the following command. It uses the client mgt_api_client which has the scope rabbitmq.tag:administrator.
make curl-keycloak url=http://localhost:15672/api/overview client_id=mgt_api_client secret=LWOuYqJ8gjKg3D2U8CJZDuID3KiRZVDa
Application authentication and authorization with PerfTest
To test OAuth 2.0 authentication with AMQP protocol you are going to use RabbitMQ PerfTest tool which uses RabbitMQ Java Client.
First you obtain the token and pass it as a parameter to the make target start-perftest-producer-with-token
.
make start-perftest-producer-with-token PRODUCER=producer TOKEN=$(bin/keycloak/token producer kbOFBXI9tANgKUq8vXHLhT6YhbivgXxn test)
NOTE: Initializing an application with a token has one drawback: the application cannot use the connection beyond the lifespan of the token. See the next section where you demonstrate how to refresh the token.
Application authentication and authorization with Pika
In the following information, OAuth 2.0 authentication is tested with the AMQP protocol and the Pika library. These tests specifically demonstrate how to refresh a token on a live AMQP connection.
The sample Python application can be found on GitHub.
To run this sample code proceed as follows:
python3 --version
pip install pika
pip install requests
python3 pika-client/producer.py producer kbOFBXI9tANgKUq8vXHLhT6YhbivgXxn
If pip
is not available try instead the following two commands to installing it:
python3 -m venv venv
source venv/bin/activate
Note: Ensure you install pika 1.3
Access management UI
- Go to http://localhost:15672.
- Click on the single button on the page which redirects to Keycloak to authenticate.
- Enter
rabbit_admin
andrabbit_admin
and you should be redirected back to RabbitMQ Management fully logged in.
Stop keycloak
make stop-keycloak
Notes about setting up Keycloak
Configure Client
For backend applications which uses Client Credentials flow, you can create a Client with:
- Access Type :
public
- Turn off
Standard Flow
,Implicit Flow
, andDirect Access Grants
- With Service Accounts Enabled on. If it is not enabled you do not have the tab
Credentials
- In the
Credentials
tab, you have theclient id
Configure Client scopes
Default Client Scope are scopes automatically granted to every token. Whereas Optional Client Scope are scopes which are only granted if they are explicitly requested during the authorization/token request flow.
Include appropriate aud claim
You must configure a Token Mapper of type Hardcoded claim with the value of rabbitmq's resource_server_id*. You can configure Token Mapper either to a Client scope or to a Client.