Not able to enable oauth2 login with management UI

[suxiaoxiaomm]

Describe the bug

Hi experts,
I am working with rabbitmq integration with oauth2 for management UI. I am using keycloak as my identity provider.
I have tried successfully with the example in tutorial. For which, I run a docker locally with the configuration provided inside tutorial repo, and keycloak is already setup and used by many other applications(public access).

However, I tried to apply similar configuration to the instance that I deployed in a kubernetes cluster, it doesn't work. I cannot even see the "Click here to log in" button. I can only see the login ui with username and password.

When checking the log from rabbitmq server, I can see the log as below:

2024-01-28 11:46:33.621271+00:00 [debug] <0.942.0> Authentication using an OAuth 2/JWT token failed: provided token is invalid
2024-01-28 11:46:33.621396+00:00 [debug] <0.942.0> User 'guest' failed authentication by backend rabbit_auth_backend_oauth2
2024-01-28 11:46:33.621483+00:00 [warning] <0.942.0> HTTP access denied: Authentication using an OAuth 2/JWT token failed: provided token is invalid

I am using cluster-operator to deploy rabbitmq with below configuration:

apiVersion: rabbitmq.com/v1beta1
kind: RabbitmqCluster
metadata:
  name: hello-world
spec:
  replicas: 1
  rabbitmq:
    additionalPlugins:
      - rabbitmq_auth_backend_oauth2
    additionalConfig: |
      log.console.level = debug
      default_user=guest
      default_pass=guest
      auth_backends.1 = rabbit_auth_backend_oauth2

      management.oauth_enabled = true
      management.oauth_client_id = rabbitmq-client-code
      management.oauth_scopes = openid profile rabbitmq.tag:administrator
      management.oauth_provider_url = https://xxxxxxxxx/realms/test

      auth_oauth2.resource_server_id = rabbitmq
      auth_oauth2.jwks_url = https://xxxxxxxx/realms/test/protocol/openid-connect/certs

Reproduction steps

1.Deploy rabbitmq with above setup
2.Open rabbitmq management UI

Expected behavior

Expect UI:

Additional context

I also tried to use helmchart deployment from bitnami, same issue

[michaelklishin]

Please use GitHub Discussions for questions. You have not provided any evidence of a bug in the OAuth 2 plugin.

Take a look at the logs:

Authentication using an OAuth 2/JWT token failed: provided token is invalid

We cannot suggest much more than investigating what may be going on with the token. Key validation steps are documented, and there are several detailed examples available for various identity providers, including Keycloak.

Enabling debug logging might help reveal additional information. Otherwise, we don't have much to work with since you have left out essential pieces of information, like the structure of the token and the details of your setup as compared to the Keycloak example.