Oauth2-proxy: Question: rabbitmq ui behind oauth2_proxy

[rstrazza]

We have rabbitmq deployed on Kubernetes and the management ui exposed via nginx-ingress controller using basic-auth. Everything works well! The user enters the url, say: https://myrabbitmq.domain.com, receives the popup screen for basic-auth, enters credentials and is presented with the RabbitMQ UI Login page https://myrabbitmq.domain.com/#/

Then, we introduced oauth by using oauth2_proxy so users can get to https://myrabbitmq.domain.com url to access the RabbitMQ UI. The problem we are facing is that after the user enters the oauth credentials (using google) the redirect to the RabbitMQ UI for some reason is missing a / (forward-slash) causing the url to be https://myrabbitmq.domain.com/# instead of https://myrabbitmq.domain.com/#/, which causes the UI to malfunction. If we reload the url https://myrabbitmq.domain.com or correct it by adding the extra / to the https://myrabbitmq.domain.com/#/ everything works. Similarly, if we close the browser and reopen the base url https://myrabbitmq.domain.com everything works fine.

So in summary, the problem is that RabbitMQ UI javascript adds #/ to the url but the last / is missing in the first time the oauth flow is executed. This is the ingress file:

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: rabbitmq-ingress
  namespace: default
  annotations:
    kubernetes.io/ingress.class: nginx
    nginx.ingress.kubernetes.io/auth-response-headers: Authorization
    nginx.ingress.kubernetes.io/auth-url: "https://$host/oauth2/auth"
    nginx.ingress.kubernetes.io/auth-signin: "https://$host/oauth2/start?rd=$escaped_request_uri"
    nginx.ingress.kubernetes.io/configuration-snippet: |
      auth_request_set $name_upstream_1 $upstream_cookie_name_1;
      access_by_lua_block {
        if ngx.var.name_upstream_1 ~= "" then
          ngx.header["Set-Cookie"] = "name_1=" .. ngx.var.name_upstream_1 .. ngx.var.auth_cookie:match("(; .*)")
        end
      }

spec:
  rules:
  - host: myrabbitmq.domain.com
    http:
      paths:
      - backend:
          serviceName: rabbitmq
          servicePort: 15672
  tls:
    - secretName: my-tls
      hosts:
      - myrabbitmq.domain.com
---
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: rabbitmq-ingress-api
  namespace: default
  annotations:
    kubernetes.io/ingress.class: nginx
    nginx.ingress.kubernetes.io/affinity: cookie
spec:
  rules:
  - host: myrabbitmq.domain.com
    http:
      paths:
      - backend:
          serviceName: rabbitmq
          servicePort: 15672
        path: /api
  tls:
    - secretName: my-tls
      hosts:
      - myrabbitmq.domain.com
---
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: rabbitmq-ingress-oauth2-proxy
  namespace: default
  annotations:
    kubernetes.io/ingress.class: nginx
spec:
  rules:
    - host: myrabbitmq.domain.com
      http:
        paths:
        - backend:
            serviceName: oauth2-proxy
            servicePort: http-port
          path: /oauth2
  tls:
    - secretName: my-tls
      hosts:
        - myrabbitmq.domain.com

Please let me know if you have any questions and thanks in advance for any comments/suggestions.

[kaspernissen]

I think we are experiencing a similar issue. When we put pusher/oauth2_proxy in front of rabbitmq, we experience issues with the management ui.

The issue we are seeing, is that we get 404s from rabbitmq when requesting specific queues with a vhost named /.

It seems that rabbitmq is responding with a 301, and it seems that the %2F (/) is stripped from the path. Resulting in a 404.

The following shows the request to: https://rabbitmq.dev.com/api/queues/%2F/dev-....... The location header in this response directs to: /api/queues/dev-....... Without %2F.

This leads to a 404, because of the missing vhost information:

Is there any way to tweak this behavior?

The proxy is configured with the following arguments:

--email-domain=example.com","--http-address=0.0.0.0:80","--cookie-refresh=1h","--pass-user-headers=false","--pass-basic-auth=false","--upstream=http://rabbitmq-management

[junkiebev]

Same issue with a kubernetes instance, deployed with the helm chart, with an NGINX load balancer

[entersb]

HI all.

Did anyone solve this issue with trailing /%2F? I use gocd and same issue is problem, and my rewrite rules are not managing to solve this issue.

[isouzasoares]

Hi all,
I'm with same problem. When I try to add a new queues /rabbitmq/api/queues/%2F/aa.

[entersb]

It is issue with some rewrite. Check your rewrite rules and it should be all OK. We had some hidden undocumented rule to add trailing slash to path where ingress was adding it by itself

[bruegth]

relates/duplicate of https://github.com/oauth2-proxy/oauth2-proxy/issues/459

[github-actions[bot]]

This issue has been inactive for 60 days. If the issue is still relevant please comment to re-activate the issue. If no action is taken within 7 days, the issue will be marked closed.