Configuring Users and Permissions

1. Creating User

Property	Description	Values
username	Name of the user to be created	`string`
password	Password for the user	`string`
tags	Tags to assign to the user (e.g., administrator, management)	`string`

Example: Creating a User via CLI

rabbitmqctl add_user myuser mypassword

Example: Setting User Tags

rabbitmqctl set_user_tags myuser administrator

2. Deleting User

Operation	Description	Command	Notes
Delete User	Removes a user from the RabbitMQ server	`rabbitmqctl delete_user <username>`	Must be run with appropriate permissions (e.g., as admin)

Example: Delete a User

rabbitmqctl delete_user testuser

Note: Deleting a user also removes all permissions associated with that user.

3. Changing Password

Property	Value	Description
rabbitmqctl	`rabbitmqctl change_password <username> <newpassword>`	Command to change the password for a specific user

Example: Changing User Password

rabbitmqctl change_password guest myNewSecurePassword

Note: The rabbitmqctl command must be run from the RabbitMQ server or with appropriate permissions.

4. Using Guest User

Property	Value	Description
user	`guest`	Default user for initial access
password	`guest`	Default password for guest user
vhost	`/`	Default virtual host for guest user

Example: Connecting with Guest User

rabbitmqctl authenticate_user guest guest

Note: The guest user should only be used for initial setup and testing. It is highly recommended to create a dedicated user with appropriate permissions for production environments.

Warning: The guest user has full permissions by default and can access all virtual hosts. Using it in production environments poses a significant security risk.

5. Setting User Tags

Tag	Description	Permissions
administrator	Full administrative access to all features and configuration	Read, write, and configure all resources
monitoring	Read-only access to monitoring and management features	Read access to queues, exchanges, and connections
management	Access to management UI and API for basic operations	Read, write, and configure permissions within defined vhosts
policymaker	Access to set and manage policies on exchanges, queues, and vhosts	Read and write access to policies
tunable	Access to configure various tunables and settings	Read and write access to specific configuration parameters

Example: Setting User Tags via CLI

rabbitmqctl set_user_tags <username> administrator monitoring

Note: User tags can be managed using the rabbitmqctl command or through the management API.

6. Granting Permissions

Permission	Resource	Patterns	Notes
configure	`.*`	`.*`	Allows configuration operations on resources matching the pattern
read	`.*`	`.*`	Allows reading from queues and exchanges matching the pattern
write	`.*`	`.*`	Allows publishing to exchanges and sending messages to queues matching the pattern

Example: Setting Permissions for a User

rabbitmqctl set_permissions -p / myapp_user ".*" ".*" ".*"

Note: The permissions are set for a specific virtual host using the -p flag.

Warning: Be cautious when granting broad permissions like ".*" as they can pose security risks.

7. Understanding Permission Scopes

Scope	Description	Permissions
administrator	Full administrative access to all resources	Read, write, and configure all queues, exchanges, bindings, users, permissions, policies, and definitions
monitoring	Read-only access to monitoring and management resources	Read access to queues, exchanges, bindings, users, permissions, policies, and definitions
management	Read and write access to management resources	Read and write access to queues, exchanges, bindings, users, permissions, policies, and definitions

Note: The administrator scope grants full control over the entire RabbitMQ instance, including creating and deleting users and permissions. The monitoring scope is ideal for read-only dashboards or monitoring tools.

Example: Setting User Permissions

rabbitmqctl set_user_permissions <username> <vhost> <permissions>

8. Using Regular Expressions

Example: Setting up user permissions with regex

rabbitmqctl set_user_permissions -p / myuser "^queue.*" "^exchange.*" "^channel.*"

Permission Type	Regex Pattern	Description
configure	`^queue.*$`	Allows configuration of queues matching the pattern
read	`^exchange.*$`	Allows reading from exchanges matching the pattern
write	`^channel.*$`	Allows publishing to channels matching the pattern

Note: The regex patterns must be enclosed in quotes to prevent shell interpretation.

Warning: Be cautious with overly broad regex patterns as they may grant unintended access.

9. Listing User Permissions

User	Permissions	Virtual Host
admin	`.*`	`/`
monitoring	`.*`	`/`
publisher	`.*`	`/`

Example: Using rabbitmqctl to list permissions

rabbitmqctl list_permissions

Note: The list_permissions command shows all users and their permissions across all virtual hosts.

10. Listing vhost Permissions

Permission	Description	Usage
vhost	Name of the virtual host	Used to scope permissions to a specific vhost
user	Username of the user	Identifies the user for whom permissions are listed
configure	Permissions for configuration operations	Controls access to configure vhost settings
write	Permissions for write operations	Allows publishing messages and managing queues
read	Permissions for read operations	Allows consuming messages and viewing queues

Example: Listing vhost permissions using rabbitmqctl

rabbitmqctl list_user_permissions <user>

Example: Listing permissions for a specific vhost

rabbitmqctl list_user_permissions <user> <vhost>

11. Implementing RBAC

Example: Creating a User with RBAC

rabbitmqctl add_user myuser mypassword
rabbitmqctl set_user_tags myuser administrator
rabbitmqctl set_permissions -p / myuser ".*" ".*" ".*"

Permission	Pattern	Description
configure	`.*`	Allows configuration operations
read	`.*`	Allows reading from queues and exchanges
write	`.*`	Allows publishing to exchanges and queues

Note: The -p / flag specifies the virtual host. Adjust as needed for your setup.

Warning: Be cautious with .* patterns as they grant broad permissions. Use specific patterns for better security.

RBAC Configuration Summary

NEW Use rabbitmqctl set_user_tags to assign roles
NEW Permissions are set per virtual host using rabbitmqctl set_permissions
DEPRECATED Old rabbitmqctl set_permissions -p / myuser ".*" ".*" syntax is still supported but not recommended

12. Auditing User Activity

Event Type	Description	Fields	Notes
user.login	User successfully logs in	`user_id`, `timestamp`, `ip_address`	Logged if audit logging is enabled
user.logout	User logs out or session expires	`user_id`, `timestamp`	Logged if audit logging is enabled
permission.change	Permission for a user or vhost is modified	`user_id`, `vhost`, `permission`, `timestamp`	Logged when permissions are updated via CLI or API
user.created	A new user is created	`user_id`, `timestamp`, `created_by`	Logged if audit logging is enabled
user.deleted	A user is deleted	`user_id`, `timestamp`, `deleted_by`	Logged if audit logging is enabled

Example: Enabling Audit Logging

rabbitmqctl set_user_permissions audit_user ".*" ".*" ".*"
rabbitmqctl set_user_tags audit_user auditor

Note: Audit logging must be enabled via rabbitmq.conf or the management plugin to capture user activity events.

Audit Logging Configuration

Enable audit_log in rabbitmq.conf
Assign auditor tag to users who need audit access
Use rabbitmqctl set_user_tags to assign tags
Permissions can be configured via CLI or management UI