jwt - RabbitMQ + OAuth => 用户的 MQTT 登录失败

Question

我在配置RabbitMQ以使用JWT进行客户端访问时遇到问题（例如使用 Paho 访问 MQTT）

我已经使用了这个推荐的插件rabbitmq_auth_backend_oauth2

我正在使用Keycloak生成我的 JWT access_token

样本 ：

{
    "exp": 1617886910,
    "iat": 1617872510,
    "jti": "e720xxxxxxad0",
    "iss": "https://xxxxxxxxxxx",
    "aud": [
        "kanban",
        "rabbitmq",
        "account"
    ],
    "sub": "ec27xxxxxxx92fc",
    "typ": "Bearer",
    "azp": "kanban",
    "session_state": "1bcxxxxxxx5e",
    "acr": "1",
    "allowed-origins": [
        ""
    ],
    "realm_access": {
        "roles": [
            "offline_access",
            "uma_authorization"
        ]
    },
    "scope": "email kanban.read:*/* kanban.write:*/* profile kanban.configure:*/*",
    "email_verified": false,
    "plant": "*",
    "name": "xxx xx",
    "preferred_username": "xxxx",
    "given_name": "xxxxx",
    "rabbitmq": ["kanban.read:*/*", "kanban.write:*/*"],
    "family_name": "xx",
    "email": "xxxxxxxxx"
}

对于 rabbitmq 配置： Dockefile

RUN rabbitmq-plugins enable rabbitmq_mqtt
RUN rabbitmq-plugins enable rabbitmq_web_mqtt
RUN rabbitmq-plugins enable rabbitmq_management
RUN rabbitmq-plugins enable rabbitmq_auth_backend_oauth2
COPY ./rabbitmq/advanced.config /etc/rabbitmq/advanced.config
COPY ./rabbitmq/rabbitmq.conf /etc/rabbitmq/rabbitmq.conf
EXPOSE 1883

高级配置

[
  {rabbit, [
    {auth_backends, [rabbit_auth_backend_oauth2, rabbit_auth_backend_internal]},
    {auth_mechanisms, ['PLAIN','AMQPPLAIN','EXTERNAL']}
  ]},
  {rabbitmq_auth_backend_oauth2, [
    {resource_server_id, <<"kanban">>},
    {key_config, [
      {default_key, <<"YoC-uSkB0wTmh39078PuzmobULDLk-1aQqDZWV4fgYc">>},
      {additional_rabbitmq_scopes, <<"rabbitmq">>}, 
      {jwks_url, <<"https://XXXXX/auth/realms/XXXXX/protocol/openid-connect/certs">>},
      {signing_key, 
          #{<<"YoC-uSkB0wTmh39078PuzmobULDLk-1aQqDZWV4fgYc">> => {pem, <<"-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArXL0WnwckscW5XeCofcG65Fhdy/FJhvvuQkFOUu2erzPfI1Tq35yijikcAG4Qp+nnpUaKXw6juWXdRwebAEuX6ZsCZ5T75dJlXErov3jqOb47U5V0g2B2nNWOzeNGLsPDBOVw3e1iG6zIZtVUlJBM7hkAQuKj6w9R4mu5JEisGCw3onjrF97/E1oOvTw3v+tDYxwWqyLpFi5crjam3lzx4VxN8zwLCx1Q3x2a3jeMLlt0iL9F/+axrHZg45CrMq0MOsWJ3vJQh7WfKjW6hFlyDE4y/nxHds+v/nmzJC5ahEAFHixq7+0VhL0K+tSDmQjxG8gBfyaPsQsPCLC4Zzv/wIDAQAB
-----END PUBLIC KEY-----">>}
         }
     }]
    }
  ]}
].

当我使用 Paho 进行测试时，在 PASSWORD 字段（以及用户为空或其他任何内容）上提供我的 JWT，我遇到了错误。

我尝试过的：

• 通过提供愚蠢的密钥检查是否加载了advanced.config => 生成解析错误
• 检查 authbackend 是否已加载 => 启动时显示在日志中
• 检查不同的用户名或在我的 paho 脚本中为空
• 检查 advanced.config 中是否有签名密钥字段
• 检查 JKWS 周围是否有 << >> => 没有发生任何事情

什么可能导致错误或我的配置文件中的配置错误？

标签： jwtrabbitmqkeycloak