rabbitmq-auth-backend-oauth2: correctly map additional_scopes_key

[Hathoute]

Proposed Changes

Fix #12750 by introducing a synonyms map that will map additional_scopes_key to extra_scopes_source, instead of replacing extra_scopes_source in the schema which will be a breaking change.

There's probably a better way to handle this, as this is my first time writing erlang code, let me know what you think.

Types of Changes

• Bug fix (non-breaking change which fixes issue 'additional_scopes_key' ignored when configuring multiple oauth2 resource servers #12750 )

Checklist

• I have read the CONTRIBUTING.md document
• I have signed the CA (see https://cla.pivotal.io/sign/rabbitmq)
• I have added tests that prove my fix is effective or that my feature works
• All tests pass locally with my changes (tested only rabbitmq-auth-backend-oauth2)

[michaelklishin]

#12752

[michaelklishin]

@Hathoute config_schema_SUITE in deps/rabbitmq_auth_backend_oauth fails:

config_schema_SUITE > run_snippets
    #1. {error,
         {{exception,
           {config_mismatch,
            {"multiple_resource_servers",
             "auth_oauth2.resource_server_id = new_resource_server_id\n        auth_oauth2.scope_prefix = new_resource_server_id.\n        auth_oauth2.resource_server_type = new_resource_server_type\n        auth_oauth2.additional_scopes_key = my_custom_scope_key\n        auth_oauth2.preferred_username_claims.1 = user_name\n        auth_oauth2.preferred_username_claims.2 = username\n        auth_oauth2.preferred_username_claims.3 = email\n        auth_oauth2.verify_aud = true\n        auth_oauth2.default_key = id1\n        auth_oauth2.signing_keys.id1 = test/config_schema_SUITE_data/certs/key.pem\n        auth_oauth2.signing_keys.id2 = test/config_schema_SUITE_data/certs/cert.pem\n        auth_oauth2.jwks_uri = https://my-jwt-issuer/jwks.json\n        auth_oauth2.jwks_url = https://my-jwt-issuer/jwks.json\n        auth_oauth2.https.cacertfile = test/config_schema_SUITE_data/certs/cacert.pem\n        auth_oauth2.https.peer_verification = verify_none\n        auth_oauth2.https.depth = 5\n        auth_oauth2.https.fail_if_no_peer_cert = false\n        auth_oauth2.https.hostname_verification = wildcard\n        auth_oauth2.https.crl_check = true\n        auth_oauth2.algorithms.1 = HS256\n        auth_oauth2.algorithms.2 = RS256\n        auth_oauth2.resource_servers.1.id = rabbitmq-operations\n        auth_oauth2.resource_servers.1.scope_prefix = api://\n        auth_oauth2.resource_servers.customers.id = rabbitmq-customers\n        auth_oauth2.resource_servers.customers.additional_scopes_key = roles",
             []},
            [{rabbitmq_auth_backend_oauth2,
              [{extra_scopes_source,<<"my_custom_scope_key">>},
               {jwks_uri,"--.///:ehijjjkmnoprssssstttuwwy"},
               {key_config,
                [{algorithms,[<<"HS256">>,<<"RS256">>]},
                 {cacertfile,".///EISTU___aaaacccccdeeeeefghimmnoprrsssttttt"},
                 {crl_check,true},
                 {default_key,<<"id1">>},
                 {depth,5},
                 {fail_if_no_peer_cert,false},
                 {hostname_verification,wildcard},
                 {jwks_url,"--.///:ehijjjkmnoprssssstttuwwy"},
                 {peer_verification,verify_none},
                 {signing_keys,
                  #{<<"id1">> => {pem,<<"I'm not a certificate">>},
                    <<"id2">> => {pem,<<"I'm not a certificate">>}}}]},
               {preferred_username_claims,
                [<<"email">>,<<"user_name">>,<<"username">>]},
               {resource_server_id,<<"new_resource_server_id">>},
               {resource_server_type,<<"new_resource_server_type">>},
               {resource_servers,
                #{<<"rabbitmq-customers">> =>
                   [{additional_scopes_key,<<"roles">>},
                    {id,<<"rabbitmq-customers">>}],
                  <<"rabbitmq-operations">> =>
                   [{scope_prefix,<<"api://">>},
                    {id,<<"rabbitmq-operations">>}]}},
               {scope_prefix,<<"new_resource_server_id.">>},
               {verify_aud,true}]}],
            [{rabbitmq_auth_backend_oauth2,
              [{extra_scopes_source,<<"my_custom_scope_key">>},
               {jwks_uri,"--.///:ehijjjkmnoprssssstttuwwy"},
               {key_config,
                [{algorithms,[<<"HS256">>,<<"RS256">>]},
                 {cacertfile,".///EISTU___aaaacccccdeeeeefghimmnoprrsssttttt"},
                 {crl_check,true},
                 {default_key,<<"id1">>},
                 {depth,5},
                 {fail_if_no_peer_cert,false},
                 {hostname_verification,wildcard},
                 {jwks_url,"--.///:ehijjjkmnoprssssstttuwwy"},
                 {peer_verification,verify_none},
                 {signing_keys,
                  #{<<"id1">> => {pem,<<"I'm not a certificate">>},
                    <<"id2">> => {pem,<<"I'm not a certificate">>}}}]},
               {preferred_username_claims,
                [<<"email">>,<<"user_name">>,<<"username">>]},
               {resource_server_id,<<"new_resource_server_id">>},
               {resource_server_type,<<"new_resource_server_type">>},
               {resource_servers,
                #{<<"rabbitmq-customers">> =>
                   [{extra_scopes_source,<<"roles">>},
                    {id,<<"rabbitmq-customers">>}],
                  <<"rabbitmq-operations">> =>
                   [{scope_prefix,<<"api://">>},
                    {id,<<"rabbitmq-operations">>}]}},
               {scope_prefix,<<"new_resource_server_id.">>},
               {verify_aud,true}]}]},
           [{rabbit_ct_config_schema,test_snippet,5,
             [{file,"rabbit_ct_config_schema.erl"},{line,68}]},
            {lists,foreach_1,2,[{file,"lists.erl"},{line,1686}]},
            {rabbit_ct_config_schema,run_snippets,1,
             [{file,"rabbit_ct_config_schema.erl"},{line,27}]},
            {config_schema_SUITE,run_snippets1,1,[]}]},
          [{erpc,call,5,[{file,"erpc.erl"},{line,702}]},
           {config_schema_SUITE,run_snippets,1,
            [{file,"config_schema_SUITE.erl"},{line,46}]},
           {test_server,ts_tc,3,[{file,"test_server.erl"},{line,1793}]},
           {test_server,run_test_case_eval1,6,
            [{file,"test_server.erl"},{line,1302}]},
           {test_server,run_test_case_eval,9,
            [{file,"test_server.erl"},{line,1234}]}]}}

It tests rabbitmq.conf setting translation, you can run it with

cd deps/rabbitmq_auth_backend_oauth2
gmake ct-config_schema

[michaelklishin]

So yeah, the key under resource_servers is different in the generated snippet vs. the expected one.

[Hathoute]

Should be good now, took some time to have a working environment on my Windows laptop.

[michaelklishin]

@Hathoute thank you for the quick turnaround, I have cherry-picked 6459111 to #12752 and will deal with any flakes that may pop up.

[michaelklishin]

@Hathoute in case you'd like to test this change in a build, use RabbitMQ 4.1.0-alpha.0081e1d0.

A 4.0.4 equivalent is 4.0.4-alpha.63e327fc.