1

I'm attempting to stand up a new RabbitMq server (Version 3.7.23, Erlang Version 22.2.3), and I've managed to get LDAP authentication working. Unfortunately, it seems that the authentication is quite slow, so my monitoring tools sporadically report errors when checking the aliveness endpoint and the UI occasionally shows a red "could not connect to server" error when navigating through the application that eventually goes away.

While researching my issue, it seems that the rabbit_auth_backend_cache plugin should help with this. I implemented the cache but it does not seem to be working. The rabbit log still shows Rabbitmq attempting to connect to LDAP for each request and I'm not seeing any errors that would explain what's going on with the cache.

Here is my config:

[
  {kernel, [

  ]},
  {rabbitmq_management, [
    {listener, [
                {port, 15672}
    ]}
  ]},
  {rabbit, [
    {auth_backends, [rabbit_auth_backend_cache,rabbit_auth_backend_ldap]},
    {cluster_partition_handling,autoheal},

{tcp_listeners, [5672]},

    {tcp_listen_options, [binary,
                          {packet, raw},
                          {reuseaddr, true},
                          {backlog, 128},
                          {nodelay, true},
                          {exit_on_close, false},
                          {keepalive, false},
                          {linger, {true,0}}]},

    {log_levels, [{ connection, info }]},
    {disk_free_limit, {mem_relative, 1.5}},
    {vm_memory_high_watermark, 0.66},

    {default_user, <<"guest">>},
    {default_pass, <<"guest">>},
    {heartbeat, 60}
  ]}
    ,{rabbitmq_auth_backend_ldap, [
...omitted because it contains sensitive data...
] }}
    ]}
        ,{rabbitmq_auth_backend_cache, [{cached_backend, rabbit_auth_backend_ldap}, {cache_ttl, 5000}]}
        ,{rabbit_auth_backend_ldap, []}
].

Here is what I'm seeing in the Log:
during start up:

2020-08-21 15:37:52.239 [info] <0.8.0> Server startup complete; 10 plugins started.
 * rabbitmq_auth_backend_ldap
 * rabbitmq_shovel_management
 * rabbitmq_shovel
 * rabbitmq_federation_management
 * rabbitmq_top
 * rabbitmq_management
 * rabbitmq_web_dispatch
 * rabbitmq_management_agent
 * rabbitmq_federation
 * rabbitmq_auth_backend_cache

on shutdown

2020-08-21 15:37:44.095 [info] <0.43.0> Application cowboy exited with reason: stopped
2020-08-21 15:37:44.095 [info] <0.11984.0> Stopping application 'cowlib'
2020-08-21 15:37:44.095 [info] <0.43.0> Application cowlib exited with reason: stopped
2020-08-21 15:37:44.095 [info] <0.11984.0> Stopping application 'rabbitmq_auth_backend_ldap'
2020-08-21 15:37:44.096 [info] <0.43.0> Application rabbitmq_auth_backend_ldap exited with reason: stopped
2020-08-21 15:37:44.096 [info] <0.11984.0> Stopping application 'rabbitmq_management_agent'
2020-08-21 15:37:44.098 [info] <0.43.0> Application rabbitmq_management_agent exited with reason: stopped
2020-08-21 15:37:44.098 [info] <0.11984.0> Stopping application 'rabbitmq_auth_backend_cache'
2020-08-21 15:37:44.099 [info] <0.43.0> Application rabbitmq_auth_backend_cache exited with reason: stopped
2020-08-21 15:37:44.099 [info] <0.11984.0> Stopping application 'rabbit'

Thanks,
Alex

Alexander Brehm
  • 15
  • 2

1 Answers1

0

@Alexander Brehm how have you come to conclusion that cache is not working ? If you are getting some connect issue occasionally this can be because of multiple other factors ?

Is you ldap server a vip or single server ? Have you tried increasing cache_ttl. Is you application http have you tried using http backend for ldap ?

Amrit Pal Singh
  • 16
  • 3
  • I believe that it's not working because I see logs which say that it's hitting the LDAP servers for every call. If it were using the cache, I should not see those logs. This is a VM that I have set up locally, so it's only one single server. I will try increasing the cache_ttl and see if that helps. I don't know what the LDAP HTTP backend is, so I was just leaving that one alone. Does it work better than the normal LDAP? – Alexander Brehm Aug 24 '20 at 13:34
  • increasing the TTL seemed to have worked, thanks. – Alexander Brehm Aug 24 '20 at 13:43