Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Make it possible to configure OpenId Connect endpoints rather than discover them dynamically via OpenId Connect Discovery endpoint #11103

Open
MarcialRosales opened this issue Apr 26, 2024 · 0 comments

Comments

@MarcialRosales
Copy link
Contributor

MarcialRosales commented Apr 26, 2024

Is your feature request related to a problem? Please describe.

This feature addresses two possible problems users may encounter:
a) their Identity Provider does not expose the OpenId Connect Discovery endpoint at all, or it is missing key endpoints such as end_session_endpoint
b) the Identity Provider does not support CORS when accessing the OpenId Connect Discovery endpoint.

Describe the solution you'd like

For these 2 cases, it should be possible to configure (via rabbitmq.conf) all or some of the OpenId Connect endpoints. For instance, if the configuration has the variable auth_oauth2.issuer RabbitMQ would try to connect to the OpenId Connect Discovery endpoint to discover the other endpoints unless all the endpoints required by RabbitMQ are already set via the appropriate configuration variables. In that case, RabbitMQ would not contact the OpenId Connect Discovery endpoint.

The solution described above is what RabbitMQ oauth2 backend plugin supports for two OpenId Connect endpoints: token_endpoint and jwks_uri endpoint. However, the management plugin needs at least two more endpoints. They are authorization_endpoint and end_session_endpoint.

This feature is only for edge case scenarios as the majority of users of the management UI with OAuth 2.0 authentication rely on OpenId Connect Discovery endpoint.

Describe alternatives you've considered

No response

Additional context

No response

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants