How to make rabbitmq docker support ldap login and tag privilege?

[raynent]

Hi ,
seems it doesn't load advance.config file when i start the docker container

version: '3'

services:
  rabbitmq:
    image: rabbitmq:3.12-management
    container_name: rabbitmq
#    environment:
#      - RABBITMQ_DEFAULT_USER=rabbitmq
#      - RABBITMQ_DEFAULT_PASS=rabbitmqworker123
#      - TZ=Asia/Shanghai
    ports:
      - "5672:5672"
      - "15672:15672"
    volumes:
      - ./data/etc/rabbitmq/:/etc/rabbitmq/


networks:
  default:
    driver: bridge

[root@dev rabbitmq]# cat data/etc/rabbitmq/enabled_plugins 
[rabbitmq_management,rabbitmq_prometheus,rabbitmq_auth_backend_ldap].
[root@dev rabbitmq]# cat  data/etc/rabbitmq/conf.d/10-defaults.conf 
## DEFAULT SETTINGS ARE NOT MEANT TO BE TAKEN STRAIGHT INTO PRODUCTION
## see https://www.rabbitmq.com/configure.html for further information
## on configuring RabbitMQ

## allow access to the guest user from anywhere on the network
## https://www.rabbitmq.com/access-control.html#loopback-users
## https://www.rabbitmq.com/production-checklist.html#users
loopback_users.guest = true

## Send all logs to stdout/TTY. Necessary to see logs when running via
## a container
log.console = true

# use LDAP exclusively for authentication and authorisation
auth_backends.1 = ldap
auth_ldap.servers.1  = 192.168.80.245
auth_ldap.user_dn_pattern = cn=${username},cn=ops,ou=nt,dc=ntlocal,dc=com
auth_ldap.use_ssl    = false
auth_ldap.port       = 389
auth_ldap.log        = network
auth_ldap.timeout   = 2000
[root@dev rabbitmq]# cat data/etc/rabbitmq/conf.d/advanced.config
[{rabbitmq_auth_backend_ldap,[

    {vhost_access_query,    {in_group, "cn=ops,ou=nt,dc=ntlocal,dc=com"}},

     {tag_queries,           [{administrator, {in_group, "cn=ops,ou=nt,dc=ntlocal,dc=com"}},

                              {management,    {in_group, "cn=ops,ou=nt,dc=ntlocal,dc=com"}}]}

]}].

rabbitmq  |   ##  ##      RabbitMQ 3.12.4
rabbitmq  |   ##  ##
rabbitmq  |   ##########  Copyright (c) 2007-2023 VMware, Inc. or its affiliates.
rabbitmq  |   ######  ##
rabbitmq  |   ##########  Licensed under the MPL 2.0. Website: https://rabbitmq.com
rabbitmq  | 
rabbitmq  | 
rabbitmq  |   Erlang:      25.3.2.6 [jit]
rabbitmq  |   TLS Library: OpenSSL - OpenSSL 3.1.2 1 Aug 2023
rabbitmq  |   Release series support status: supported
rabbitmq  | 
rabbitmq  | 
rabbitmq  |   Doc guides:  https://rabbitmq.com/documentation.html
rabbitmq  |   Support:     https://rabbitmq.com/contact.html
rabbitmq  |   Tutorials:   https://rabbitmq.com/getstarted.html
rabbitmq  |   Monitoring:  https://rabbitmq.com/monitoring.html
rabbitmq  | 
rabbitmq  | 
rabbitmq  |   Logs: <stdout>
rabbitmq  | 
rabbitmq  | 
rabbitmq  |   Config file(s): /etc/rabbitmq/conf.d/10-defaults.conf
rabbitmq  | 
rabbitmq  | 
rabbitmq  |   Starting broker...2024-02-16 11:47:15.946358+00:00 [info] <0.1682.0> 
rabbitmq  | 2024-02-16 11:47:15.946358+00:00 [info] <0.1682.0>  node           : rabbit@2c854b300d97
rabbitmq  | 2024-02-16 11:47:15.946358+00:00 [info] <0.1682.0>  home dir       : /var/lib/rabbitmq
rabbitmq  | 2024-02-16 11:47:15.946358+00:00 [info] <0.1682.0>  config file(s) : /etc/rabbitmq/conf.d/10-defaults.conf
rabbitmq  | 2024-02-16 11:47:15.946358+00:00 [info] <0.1682.0>  cookie hash    : 08r+4eFEAZR1eshy26i0mA==
rabbitmq  | 2024-02-16 11:47:15.946358+00:00 [info] <0.1682.0>  log(s)         : <stdout>
rabbitmq  | 2024-02-16 11:47:15.946358+00:00 [info] <0.1682.0>  data dir       : /var/lib/rabbitmq/mnesia/rabbit@2c854b300d97

rabbitmq  |  completed with 5 plugins.
rabbitmq  | 2024-02-16 11:47:16.024304+00:00 [info] <0.1991.0> Server startup complete; 5 plugins started.
rabbitmq  | 2024-02-16 11:47:16.024304+00:00 [info] <0.1991.0>  * rabbitmq_prometheus
rabbitmq  | 2024-02-16 11:47:16.024304+00:00 [info] <0.1991.0>  * rabbitmq_auth_backend_ldap
rabbitmq  | 2024-02-16 11:47:16.024304+00:00 [info] <0.1991.0>  * rabbitmq_management
rabbitmq  | 2024-02-16 11:47:16.024304+00:00 [info] <0.1991.0>  * rabbitmq_management_agent
rabbitmq  | 2024-02-16 11:47:16.024304+00:00 [info] <0.1991.0>  * rabbitmq_web_dispatch
rabbitmq  | 2024-02-16 11:51:59.456580+00:00 [info] <0.2157.0> LDAP CHECK: login for rayne
rabbitmq  | 2024-02-16 11:51:59.456648+00:00 [info] <0.2157.0>         LDAP filling template "cn=${username},cn=ops,ou=nt,dc=ntlocal,dc=com" with
rabbitmq  | 2024-02-16 11:51:59.456648+00:00 [info] <0.2157.0>             [{username,<<"rayne">>}]
rabbitmq  | 2024-02-16 11:51:59.456713+00:00 [info] <0.2157.0>         LDAP template result: "cn=rayne,cn=ops,ou=nt,dc=ntlocal,dc=com"
rabbitmq  | 2024-02-16 11:51:59.456730+00:00 [info] <0.2157.0>     LDAP connecting to servers: ["192.168.80.245"]
rabbitmq  | 2024-02-16 11:51:59.457925+00:00 [info] <0.2158.0>     LDAP network traffic: bind request = {'BindRequest',3,
rabbitmq  | 2024-02-16 11:51:59.457925+00:00 [info] <0.2158.0>                                           "cn=xxxx,cn=xxxx,ou=xxxx,dc=xxxx,dc=xxxx",
rabbitmq  | 2024-02-16 11:51:59.457925+00:00 [info] <0.2158.0>                                           {simple,"xxxx"}}
rabbitmq  | 2024-02-16 11:51:59.457925+00:00 [info] <0.2158.0> 
rabbitmq  | 2024-02-16 11:51:59.467016+00:00 [info] <0.2158.0>     LDAP network traffic: bind reply = {ok,
rabbitmq  | 2024-02-16 11:51:59.467016+00:00 [info] <0.2158.0>                                         {'LDAPMessage',1,
rabbitmq  | 2024-02-16 11:51:59.467016+00:00 [info] <0.2158.0>                                          {bindResponse,
rabbitmq  | 2024-02-16 11:51:59.467016+00:00 [info] <0.2158.0>                                           {'BindResponse',success,[],[],
rabbitmq  | 2024-02-16 11:51:59.467016+00:00 [info] <0.2158.0>                                            asn1_NOVALUE,asn1_NOVALUE}},
rabbitmq  | 2024-02-16 11:51:59.467016+00:00 [info] <0.2158.0>                                          asn1_NOVALUE}}
rabbitmq  | 2024-02-16 11:51:59.467016+00:00 [info] <0.2158.0> 
rabbitmq  | 2024-02-16 11:51:59.467083+00:00 [info] <0.1828.0>     LDAP bind succeeded: cn=xxxx,cn=xxxx,ou=xxxx,dc=xxxx,dc=xxxx
rabbitmq  | 2024-02-16 11:51:59.467130+00:00 [info] <0.1828.0>         LDAP filling template "cn=${username},cn=ops,ou=nt,dc=ntlocal,dc=com" with
rabbitmq  | 2024-02-16 11:51:59.467130+00:00 [info] <0.1828.0>             [{username,<<"rayne">>}]
rabbitmq  | 2024-02-16 11:51:59.467184+00:00 [info] <0.1828.0>         LDAP template result: "cn=rayne,cn=ops,ou=nt,dc=ntlocal,dc=com"
rabbitmq  | 2024-02-16 11:51:59.467197+00:00 [info] <0.1828.0>     LDAP CHECK: does rayne have tag administrator?
rabbitmq  | 2024-02-16 11:51:59.467224+00:00 [info] <0.1828.0>     LDAP evaluating query: {constant,false}
rabbitmq  | 2024-02-16 11:51:59.467236+00:00 [info] <0.1828.0>     LDAP evaluated constant: false
rabbitmq  | 2024-02-16 11:51:59.467257+00:00 [info] <0.1828.0>     LDAP DECISION: does rayne have tag administrator? false
rabbitmq  | 2024-02-16 11:51:59.467277+00:00 [info] <0.2157.0> LDAP DECISION: login for rayne: ok
rabbitmq  | 2024-02-16 11:51:59.467311+00:00 [warning] <0.2157.0> HTTP access denied: user 'rayne' - Not management user

As we seen , the ldap plugin has been started , and the ldap user can login , but the can't access coz no privilege

As we known the privilege tag can be setting in advance.config file in non-docker version

but how to make docker version works for it also ? （ tag_queries administrator ）

thanks

[raynent]

solved , the solution is put all files in /etc/rabbitmq path instead of default path /etc/rabbitmq/conf.d

rebuild container then everything works now

[michaelklishin]

advanced.config won't be loaded from a conf.d style directory, since you cannot have multiple files of this type.

New style configuration files can be loaded from such a directory because they can be combined trivially by appending a group of .conf files.

[raynent]

hmm yes ? but how to config such like

{tag_queries, [{administrator, {constant, true}},
 {management,    {constant, true}}]}

in new style configuration files ?

[michaelklishin]

hmm yes ? but how to config such like

{tag_queries, [{administrator, {constant, true}},

 {management,    {constant, true}}]}

in new style configuration files ?

Those can only be configured via the advanced config. That's not what my response was about, though. There is only one advanced config but you can add multiple regular configuration files to a directory because they are in a trivially mergeable format.