RabbitMQ does not validate configuration settings when run from release archive #13783
Replies: 4 comments 13 replies
-
|
The plot thickens ... I added the following to my https://github.com/lukebakken/rabbitmq/blob/main/src/discussions/1/Makefile#L12-L18 Usage: Both of the above start successfully, even though they should have failed due to the Note that no plugins were started, either 🤔 |
Beta Was this translation helpful? Give feedback.
-
|
Starting up the Windows |
Beta Was this translation helpful? Give feedback.
-
|
I followed the Debian Bookworm instructions here and can start RabbitMQ using the invalid configuration files that have |
Beta Was this translation helpful? Give feedback.
-
|
@lukebakken by "invalid" do you mean a syntactically invalid Erlang term file? |
Beta Was this translation helpful? Give feedback.
-
|
I think the title of this discussion could be improved 😸 I mean that the What I'm observing is that RabbitMQ boots just fine when I observe the correct behavior (RabbitMQ fails to boot) only when running RabbitMQ from I'm doing all testing with RabbitMQ 4.1.0. |
Beta Was this translation helpful? Give feedback.
-
|
Understood. Yup, that sounds like a |
Beta Was this translation helpful? Give feedback.
-
|
@michaelklishin - more information about this issue. When you start RabbitMQ from You can see where boot stops due to errors at the bottom of that output. If I start RabbitMQ from I'll see if I can figure out why the difference exists. |
Beta Was this translation helpful? Give feedback.
-
|
In fact, a post-launch version would be able to tell the user which plugin must be enabled. Or at least we can handle a few common cases there easily. |
Beta Was this translation helpful? Give feedback.
-
|
Sounds like a good solution. Hopefully re-scanning |
Beta Was this translation helpful? Give feedback.
-
|
I can’t come up with a generic solution because it may be fine and expected to have a plugin configured but not enabled, so that it can be enabled at runtime after boot. I think the problem is that the authentication subsystem doesn’t check its configuration on boot. I suggest we add a boot step that compares the selected auth module to the list of modules provided by plugins, and if it belongs to a plugin that is not enabled, we throw an error with the name of the plugin to enable. It’s a bit tricky to get the list of enabled plugins, the plugins subsystem doesn’t provide such an API. Otherwise, we should have all the bits to implement that. What do you think? |
Beta Was this translation helpful? Give feedback.
-
I was going to comment exactly this 🙂 I think it's valid to have a plugin configured and not enabled. An example would be during a troubleshooting session, you disable a plugin and leave RMQ configuration unchanged, and later restart the node. IMO the current behaviour, an exception in the logs, is fine. I would change the log level, or perhaps add a dedicated log message, for the specific case of authentication backends provided by disabled plugins. I don't think RMQ should fail to boot if a plugin is configured and disabled. |
Beta Was this translation helpful? Give feedback.
-
In the case of the LDAP plugin, the only indication that this was the case was a pretty unhelpful stack trace.
I agree that this is what should happen with authentication-related plugins. |
Beta Was this translation helpful? Give feedback.
-
|
Related issue: #2085 |
Beta Was this translation helpful? Give feedback.
-
|
Hi Luke! I will think about this issue next week when I get back from holidays. Thank you for the detailed report! :-) |
Beta Was this translation helpful? Give feedback.
-
RabbitMQ version used
4.1.0
Erlang version used
27.3.x
Operating system (distribution) used
Arch Linux (via WSL)
How is RabbitMQ deployed?
Community Docker image
https://github.com/lukebakken/rabbitmq/tree/main/src/discussions/1
Hello Team RabbitMQ!
I was helping a community user with LDAP, and noticed that he could start RabbitMQ (via docker) with
auth_ldapsettings in hisrabbitmq.conffile, even thoughrabbitmq_auth_backend_ldapwas NOT enabled. However, when I start RabbitMQ from source, and use the samerabbitmq.conffile, the validation works as expected, and RabbitMQ fails to boot.Original issue reported via Discord:
https://discord.com/channels/1092487794984755311/1092487794984755314/1362805174208303405
User followed-up here:
lukebakken/rabbitmq#1
Notice that, because
rabbitmq_auth_backend_ldapwas not enabled, this user got the following stack trace when trying to authenticate a user (noproc):Any ideas? I'm going to continue investigating.
Beta Was this translation helpful? Give feedback.
All reactions