[Questions] How to use auth backend internal_loopback

[cvuillemez]

RabbitMQ version used

4.1.1

Erlang version used

27.3.x

Operating system (distribution) used

Ubuntu 24.04

How is RabbitMQ deployed?

Debian package

Logs from node 1 (with sensitive values edited out)

2025-10-17 10:54:15.441225+02:00 [warning] <0.913.0> HTTP access denied: basic auth disabled

rabbitmq.conf

auth_backends.1 = internal
auth_backends.2 = oauth2
auth_backends.3 = internal_loopback
[...]
management.disable_basic_auth = true
loopback_users.user1= true

What problem are you trying to solve?

Login to HTTP API is refused cause basic auth is disabled:

# rabbitmqadmin list vhosts -H localhost -P 15672 --username=user1 --password=xxxx list vhosts
*** Access refused: /api/vhosts?columns=list,vhosts

I expected "internal loopback" plugin to give access to this user .

@aaron-seo : please could you share (or document) how to use new auth backend "internal loopback" (cf #13819) ?
Thanks .

[laperlej]

Try rabbit_auth_backend_internal_loopback instead.

I think internal_loopback was never added as valid shorthand.

[laperlej]

hopefully this will fix it #14750

[cvuillemez]

Thanks for the alias @laperlej , I tried to use the long name but same issue

[michaelklishin]

We do not guess in this community. Either share your configuration bits and exception or don't expect any help.

[michaelklishin]

@cvuillemez that backend was added for a very specific audience and scenarios. It was introduced together with a separate authN/authZ backend chain for the HTTP API and was meant to be used there, not in the main (messaging and streaming clients) chain.

So, most users do not need to use that backend.

Other than that, like any authN/authZ backend, it simply needs to be enabled and configured, and the internal backend (of which internal_loopback is a specialzied variation) has no configuration to speak of.

[cvuillemez]

@michaelklishin I understand why this backend was created: du to OAUTH2 configuration, I disabled basic auth on HTTP API for higher security. I enabled the plugin to hope using basic auth on loopback interface only (for management purposes, like definitions export).
This plugin seems fine and certainly useful for all users who have configured OAUTH2.
Just one line in documentation would help (you say we just need to enable it ?)
Thanks for your help :-)

[laperlej]

My guess here is that you want to make API calls using internal_loopback but also don't want username/password fields in the UI.

To do that you would need to use:
management.oauth_disable_basic_auth = true
and
management.disable_basic_auth = false

https://www.rabbitmq.com/docs/management#allow-basic-auth-for-http-api

[michaelklishin]

@cvuillemez we will briefly document the plugin.

Even without this plugin, RabbitMQ supports a batshit crazy number of authN, authZ, x.509 certificate, OAuth 2 configurations, so even deciding where to put these docs is not entirely trivial.

[cvuillemez]

Yes you're right, and I want to refuse basic auth on HTTP API too, not only on WebUI (management.disable_basic_auth = false permit basic auth on HTTP API)
But excepted on loopback...
Seems not to be the purpose of this plugin, I found more information here: #13767
Thanks

[cvuillemez]

But on the first discussion the purpose was well to override the "disable_basic_auth" setting: #13205.
So I'm confused.