Support for HTTP Authentication Backend

[carlhoerberg]

In combination with Websockets it makes sense to delegate authentication to a http backend.

Can look at https://github.com/rabbitmq/rabbitmq-server/tree/master/deps/rabbitmq_auth_backend_http for inspiration.

Probably integrate caching by default, as every user action, including publishes requires an authentication lookup.

[JadeKharats]

Is this need still relevant today?
I would like to try to suggest an implementation for you.

[paxinos]

It's pretty much mandatory for us... we need an external mechanism to authenticate users.

[kickster97]

@JadeKharats Hi :) a contribution would be very appreciated, feel free to fork and make a PR if you have something in mind!

[JadeKharats]

I was thinking of redefining UserStore as an abstract class.
Rename the current UserStore class to FSUserStore or LocalUserStore.
Then create a UserStore as needed (e.g., rabbimq-http-backend for this issue).
Finally, initialize the UserStore type through configuration.

I'll try to do that this weekend, if the solution works for you.

P.S.: I'll also add cache management and a validity period in the config.

[paxinos]

speaking as a user, that makes perfect sense to me. I was just getting familiar with the code (and the language). Your timing is perfect for us.

[JadeKharats]

Hi,

I would like to add in the spec_helper the code for an auth backend server and a with_auth_backend method to launch the server.

Today the spec_helper does not require any other file.

You prefer that I put my code directly in the spec_helper or that I externalize it

[JadeKharats]

I should add the backend parameters in the config.
I hesitate between the main section and the mgmt section.

[carlhoerberg]

I should add the backend parameters in the config.
I hesitate between the main section and the mgmt section.

Main for sure, it applies to all interfaces, mgmt, amqp and mqtt

[carlhoerberg]

Make sure that multiple backends can be used at the same time. You can have some admin user in the built in user store and the rest in the http backend for instance.

[carlhoerberg]

I should add the backend parameters in the config.
I hesitate between the main section and the mgmt section.

Main for sure, it applies to all interfaces, mgmt, amqp and mqtt

Or make a new section called [auth]

[kickster97]

@JadeKharats I opened a draft PR that might cross over what you are doing, feel free to add comments there with any findings/input you have gained while looking at this.