OAuth2 with EntraID: permission to create queue and exchanges but not bindings

[s-clauw]

Describe the bug

RabbitMQ 4.0.2
Erlang 26.2.5.4

I configured our RabbitMQ cluster to use EntraID authentication. I can log in to the management UI fine and can create exchanges and queues.

My user has all the following roles defined in the token EntraID token:

  "roles": [
    "56c14f41-xxxx-xxxx-xxxx-xxxxxxxxxxxxx.write:*/*",
    "56c14f41-xxxx-xxxx-xxxx-xxxxxxxxxxxxx.configure:*/*",
    "56c14f41-xxxx-xxxx-xxxx-xxxxxxxxxxxxx.tag:administrator",
    "56c14f41-xxxx-xxxx-xxxx-xxxxxxxxxxxxx.read:*/*"
  ],

Initially I only added configure which gave me the rights to create topics and exchanges. When trying to add a binding between the new exchange and queue, the log showed that I also needed write and read roles, however it does not seem to be enough still.
When trying to save the binding I get logged out and 'Access refused' is shown:

This is the request that fails:

What am I missing?

Reproduction steps

1. Login to Management UI with EntraID OAuth2 configured (with at least configure:/ role)
2. Create exchange of type 'topic' and queue of type 'quorum'
3. Create a binding between created exchange and queue without routing key
4. My user is logged out and a message is shown 'Access refused.'

Expected behavior

1. Login to Management UI with EntraID OAuth2 configured (with at least configure:/ role)
2. Create exchange and queue
3. Create a binding between created exchange and queue
4. Binding is created

Additional context

rabbitmq.conf:

auth_backends.1 = oauth2
auth_backends.2 = internal

management.oauth_enabled = true
management.oauth_client_id = 56c14f41-xxxx-xxxx-xxxx-xxxxxxxxxxxxx
management.oauth_provider_url = https://login.microsoftonline.com/xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxxx

auth_oauth2.preferred_username_claims.1 = name
auth_oauth2.resource_server_id = 56c14f41-xxxx-xxxx-xxxx-xxxxxxxxxxxxx
auth_oauth2.additional_scopes_key = roles
auth_oauth2.jwks_url = https://login.microsoftonline.com/xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxxx/discovery/keys?appid=56c14f41-xxxx-xxxx-xxxx-xxxxxxxxxxxxx

[michaelklishin]

@s-clauw please never file issues for questions in this org. All repos have discussions enabled.

Per our Community Support Policy, we will not assist with troubleshooting OAuth 2 to non-paying users.

There are several extensive documentation guides for OAuth 2:

• The main OAuth 2 guide
• A troubleshooting guide
• Examples for five different IDPs including Entra

On top of that, the OAuth 2 plugin and the authN/authZ subsystem in general logs key decisions (actually, way more than that) at debug level. Start with inspecting logs from the node that handles your request.