By @aaron-seo: Adds a new auth backend that only accepts loopback connections

[michaelklishin]

This is #13767 by @aaron-seo.

[mergify]

⚠️ The sha of the head commit of this PR conflicts with #13767. Mergify cannot evaluate rules on this PR. ⚠️

[michaelklishin]

@aaron-seo so the only failure there is is a Selenium suite but it does seem to be directly related.

@MarcialRosales is there anything that would immediately stand out to you?

[MarcialRosales]

When I run one of the failing selenium tests I capture the following stack trace in the logs. I can consistently reproduce this issue. If I run it from main it works fine:

2025-04-25 11:38:32.743764+02:00 [debug] <0.1229.0> [{rabbit_http_util,quote_plus,
2025-04-25 11:38:32.743764+02:00 [debug] <0.1229.0>                    [#Port<0.5439>,[]],
2025-04-25 11:38:32.743764+02:00 [debug] <0.1229.0>                    [{file,"rabbit_http_util.erl"},{line,136}]},
2025-04-25 11:38:32.743764+02:00 [debug] <0.1229.0>  {rabbit_auth_backend_http,escape,2,
2025-04-25 11:38:32.743764+02:00 [debug] <0.1229.0>                            [{file,"rabbit_auth_backend_http.erl"},{line,236}]},
2025-04-25 11:38:32.743764+02:00 [debug] <0.1229.0>  {rabbit_auth_backend_http,'-q/1-lc$^0/1-0-',1,
2025-04-25 11:38:32.743764+02:00 [debug] <0.1229.0>                            [{file,"rabbit_auth_backend_http.erl"},{line,230}]},
2025-04-25 11:38:32.743764+02:00 [debug] <0.1229.0>  {rabbit_auth_backend_http,'-q/1-lc$^0/1-0-',1,
2025-04-25 11:38:32.743764+02:00 [debug] <0.1229.0>                            [{file,"rabbit_auth_backend_http.erl"},{line,230}]},
2025-04-25 11:38:32.743764+02:00 [debug] <0.1229.0>  {rabbit_auth_backend_http,q,1,
2025-04-25 11:38:32.743764+02:00 [debug] <0.1229.0>                            [{file,"rabbit_auth_backend_http.erl"},{line,230}]},
2025-04-25 11:38:32.743764+02:00 [debug] <0.1229.0>  {rabbit_auth_backend_http,user_login_authentication,2,
2025-04-25 11:38:32.743764+02:00 [debug] <0.1229.0>                            [{file,"rabbit_auth_backend_http.erl"},{line,36}]},
2025-04-25 11:38:32.743764+02:00 [debug] <0.1229.0>  {rabbit_auth_backend_cache,with_cache,3,
2025-04-25 11:38:32.743764+02:00 [debug] <0.1229.0>                             [{file,"rabbit_auth_backend_cache.erl"},
2025-04-25 11:38:32.743764+02:00 [debug] <0.1229.0>                              {line,90}]},
2025-04-25 11:38:32.743764+02:00 [debug] <0.1229.0>  {rabbit_access_control,try_authenticate,3,
2025-04-25 11:38:32.743764+02:00 [debug] <0.1229.0>                         [{file,"rabbit_access_control.erl"},{line,95}]}]

@aaron-seo To run the test locally and from source you can follow these instructions:

1. From a terminal, launch rabbitmq for the suite that is failing, for instance: suites/authnz-messaging/auth-cache-http-backends.sh

cd selenium
suites/authnz-messaging/auth-cache-http-backends.sh start-rabbitmq

This command starts up RabbitMQ using gmake and configured for the test suite

2. From another terminal, run these commands. npm install is required the fist time you run the tests. start-others runs any component the test suite depends on. This suite, in particular, needs a mock http backend. It is launched as a docker container and in the background.

cd selenium
npm install
suites/authnz-messaging/auth-cache-http-backends.sh start-others
suites/authnz-messaging/auth-cache-http-backends.sh test

3. Go to the logs of RabbitMQ

If you do not want to run it from source but directly against a RabbitMQ docker image, all you need to do is run this command (this is explained here):

cd selenium
RABBITMQ_DOCKER_IMAGE=<docker_image:tag> suites/authnz-messaging/auth-cache-http-backends.sh 

[michaelklishin]

OK, it had nothing to do with any permissions, so let's close this one and continue in the original PR by @aaron-seo.