4 This plugin provides the ability for your RabbitMQ server to perform
5 authentication (determining who can log in) and authorisation
6 (determining what permissions they have) by deferring to an external
7 LDAP server. To use this plugin, some editing of the RabbitMQ
8 configuration file is required. You must enable the plugin, and then
9 configure it. You are advised to read this entire file before
15 You can build and install it like any other plugin (see
16 http://www.rabbitmq.com/plugin-development.html).
21 To enable the plugin, set the value of the "auth_backends" configuration item
22 for the "rabbit" application to include "rabbit_auth_backend_ldap".
23 "auth_backends" is a list of authentication providers to try in order.
25 Therefore a complete RabbitMQ configuration that enables this plugin would
28 [{rabbit, [{auth_backends, [rabbit_auth_backend_ldap]}]}].
33 [{auth_backends, [rabbit_auth_backend_ldap, rabbit_auth_backend_internal]}]
36 to use LDAP and the internal database.
38 Configuring the plugin
39 ======================
41 You must then configure the plugin. This plugin has quite a few configuration
42 options, but most have sensible defaults.
44 The most complex part of configuring the plugin pertains to
45 authorisation (i.e. granting permissions to your users via LDAP). This
46 is documented separately in README-authorisation.
48 The default configuration allows all users to access all objects in
49 all vhosts, but does not make them administrators. If you're happy
50 with that, there is no need to read README-authorisation.
52 The options not directly related to authorisation are:
59 List of LDAP servers to attempt to bind to, in order. You almost certainly
65 Default: "cn=${username},ou=People,dc=example,dc=com"
67 Pattern for a user's DN. Must contain exactly one instance of
68 "${username}". This will be where the username supplied by the client
69 is substituted. You almost certainly want to change this.
76 Normally for authentication this plugin binds to the LDAP server as
77 the user it is trying to authenticate. This option controls how to
78 bind for authorisation queries, and to retrieve the details of a user
79 who is logging in without presenting a password (e.g. SASL EXTERNAL).
81 This option must either be the atom anon, or a tuple {UserDN, Password}.
88 Whether to use LDAP over SSL. Uses the same SSL configuration as elsewhere in
96 Port on which to connect to the LDAP servers.
103 Set to true to cause LDAP traffic to be written to the RabbitMQ
104 log. You probably only want to use this for debugging, since it will
105 usually cause passwords to be written to the logs.
107 Example configuration file
108 ==========================
110 A minimal configuration file with some options specified might look
114 {rabbit, [{auth_backends, [rabbit_auth_backend_ldap]}]},
115 {rabbitmq_auth_backend_ldap,
116 [ {servers, ["my-ldap-server"]},
117 {user_dn_pattern, "cn=${username},ou=People,dc=example,dc=com"} ] }
123 Currently this plugin is rather chatty with LDAP connections when
124 doing authorisation over LDAP.
126 There might need to be more types of queries.
128 It hasn't received much testing.