search

rabbitmq / rabbitmq-auth-backend-http

HTTP-based authorisation and authentication for RabbitMQ
Other
199 stars 72 forks source link

Routing requests for different virtual hosts to different endpoints #96

Closed devansharora68 closed 4 years ago

devansharora68 commented 4 years ago

Hello

Raising this issue regarding below discussion thread in rabbitmq-users group Http auth backend for multi vhost environments

Problem statement :

We are using rabbitmq auth backend http to authenticate rabbit users. In multi tenant(vhost) environments, We have different dedicated servers to authenticate different vhost`s users. Like vhost01 auth requests should be authenticated by server01 and vhost2 auth requests should be authenticated by server02.

In rabbitmq config file we define a proxy url to send auth http requests. In our proxy currently, we read the http get request params to route the request to correct backend servers(server01, server02) Like when vhost param value is "vhost01", route the request to "server01" backend server. when vhost param value is "vhost02" route the request to "server02" backend server.

This according to our architects is not a safe approach and when using ssl we need to offload such ssl requests at our proxy server which takes up computation cycle. Can we have a mechanism so that we can have vhost value in our http request url itself. So that we our able to route requests using url path to appropriate backend servers(server01, server02).

michaelklishin commented 4 years ago

I'm not convinced this is a common enough scenario. This plugin's responsibility is to hand some data to a service, and if you need to route requests for different servers to different backends (sounds like what most people DO NOT do these days), that service can do it, and use proxies and/or TLS termination at any step that makes sense.

@acogoluegnes @lukebakken I'm leaning towards a wontfix as this scenario is too environment-specific. WDYT?

devansharora68 commented 4 years ago

can we just allow to parameterize url of auth backend for post type requests

Like user_path = https://ahost1:8080/auth/user/{vhost} We could then just redirect using url in my proxy.

michaelklishin commented 4 years ago

That would be a lot more flexible and interesting. Please file a new issue with a more detailed description of how you envision that work.

devansharora68 commented 4 years ago

Thanks Raised this Vhost as a Path parameter for http auth backend #97