RabbitMQ user roles and permission control

RabbitMQ: Basic commands

to install, start and stop
rabbitmq rabbitmq-service.bat install
rabbitmq-service.bat start
rabbitmq-service.bat stop

list all queues rabbitmqctl

list_queues

list the information of the specified queue list all exchanges rabbitmqctl list_exchanges list all bindings rabbitmqctl list_bindings install web-based management plugin rabbitmq-plugins.bat enable rabbitmq_management Reference: http://www.cnblogs.com/happyframework/p/3997307.html ###### ################ #User roles ######################## RabbitMQ user role classification: none , management, policymaker, monitoring, administrator
























Description of various roles in RabbitMQ:
none
can not access management plugin

management
anything that users can do through AMQP Plus:
list virtual hosts that they can log in through AMQP 
View queues, exchanges and bindings in their virtual hosts
View and close their own channels and connections
to view "global" statistics about your own virtual hosts, including the activities of other users in those virtual hosts.

Anything policymaker
management can do plus:
view, create and delete the policies and parameters to which its own virtual hosts belong

monitoring 
management can do plus:
list all virtual hosts, including those they cannot log in to
View other users' connections and channels
view node-level data like clustering and memory usage
view

administrator  
policymaker and monitoring can do anything plus:
create and delete virtual hosts
View, create and delete usersView
create and delete permissionsClose
connections of other usersCreate

users and set roles :
You can create administrator users to be responsible for the operation and maintenance of the entire MQ, for example:

under windows, enter the sbin directory of the rabbitMQ installation
quote
rabbitmqctl add_user  user_admin  passwd_admin


Give it the administrator role:

quote
rabbitmqctl set_user_tags user_admin administrator


RabbitMQ monitoring users can be created to be responsible for monitoring the entire MQ, for example:
quote
rabbitmqctl add_user  user_monitoring  passwd_monitor 


Give it the monitoring role:
quote
rabbitmqctl set_user_tags user_monitoring monitoring 


Can create a dedicated user for a project and can only access the project's own virtual hosts
quote
rabbitmqctl  add_user  user_proj  passwd_proj 


Give it the monitoring role:
quote
rabbitmqctl set_user_tags user_proj management


After creating and assigning roles, check and confirm:
quote
rabbitmqctl list_users 


##########################
#RabbitMQ permission control:
##################### ###
Default virtual host: "/"
Default user: guest
guest has all permissions on "/", only localhost can access RabbitMQ including Plugin, it is recommended to delete or change the password. The local access restriction can be canceled by setting loopback_users in the configuration file:
[{rabbit, [{loopback_users, []}]}]

Users can only operate the resources in the virtual hosts that they can access. The resources here refer to exchanges, queues, etc. in virtual hosts, and operations include configuring, writing, and reading resources. Configure permissions to create, delete, and modify the behavior of resources, write permissions to send messages to resources, and read permissions to get messages from resources. For example:
the declare and delete of exchange and queue need configuration permissions on exchange and queue respectively
. bind and unbind of exchange need read and write
permissions of exchange. bind and
unbind exchange. Write
permission The read permission

of the queue is required to obtain or clear (get, consume, purge) messages. The resources that have configuration, write and read permissions are matched by regular expressions. The specific commands are as follows:
set_permissions [-p <vhostpath>] <user> <conf> <write> <read>
Among them, the positions of <conf> <write> <read> use regular expressions to match specific resources, such as '^(amq\ .gen.*|amq\.default)$' can match the exchange generated by the server and the default exchange, '^$' does not match any resources. It

should be noted that RabbitMQ will cache the permission verification result of each connection or channel, so the permission occurs. After the change, you need to reconnect to take effect.

To empower users :
quote
rabbitmqctl set_permissions -p /vhost1 user_admin '.*' '.*' '.*'
The correct command is: rabbitmqctl set_permissions -p /vhost1 user_admin .* .* .*

This command enables the user user_admin to have configuration, write and read permissions for all resources in the virtual host /vhost1 in order to manage the resources in it

quote
When using the rabbitMQ client command to grant permissions to a user, '' cannot be used, otherwise the following error will be reported when inserting a message: Caused by: com.rabbitmq.client.ShutdownSignalException: channel error; protocol method: # method<channel.close>(reply-code=403, reply-text=ACCESS_REFUSED - access to queue 'hello' in vhost '/' refused for user 'admin', class-id=50, method-id=10)


Permission control

1. Create a virtual host
# rabbitmqctl add_vhost vhostpath
2. Delete a virtual host
# rabbitmqctl delete_vhost vhostpath
3. List all virtual hosts
# rabbitmqctl list_vhosts
4. Set user permissions
# rabbitmqctl set_permissions [-p vhostpath] username regexp regexp regexp
5. Clear User permissions
# rabbitmqctl clear_permissions [-p vhostpath] username
6. List all permissions on the virtual host
# rabbitmqctl list_permissions [-p vhostpath]
7. List user permissions
# rabbitmqctl list_user_permissions username

reference: http://blog.csdn.net /zyz511919766/article/details/42292655

rabbitmq operation command: http://a52071453.iteye.com/blog/1559011 The

rabbitmq web management interface cannot log in with the guest user
https://www.cnblogs.com/mingaixin/p/4134920 .html

Guess you like

Origin http://10.200.1.11:23101/article/api/json?id=326894006&siteId=291194637