Unable to Login to RabbitMQ Management UI (Grayed-Out Login Button) with LDAP Configuration

Products

• RabbitMQ

Issue/Introduction

• Users are unable to log into the RabbitMQ Management UI.
  
  
• The "Login" button remains grayed out or unresponsive after entering credentials.
  
  
• The RabbitMQ cluster service is confirmed up and running via CLI (rabbitmqctl status).
  
  
• Running rabbitmqctl authenticate_user [username] [password] returns no output or hangs.
  
  
• The issue may affect both LDAP and local users when LDAP is enabled in the configuration.

Environment

Rabbitmq

Cause

This behavior is typically caused by a failure in the authentication backend that prevents the handshake from completing. Common causes include:

1. Erlang 26 TLS Defaults: Starting with Erlang 26, peer verification for TLS/SSL is enabled by default. If RabbitMQ is connecting to an LDAP server via LDAPS without explicit certificate verification settings, the connection fails.
   
   
2. Missing DN Lookup: In Kubernetes or Active Directory environments, the absence of dn_lookup_attribute or dn_lookup_base prevents RabbitMQ from resolving the user's Distinguished Name.
   
   
3. Backend Timeout: If the LDAP server is unreachable or misconfigured, the authentication process may hang, blocking the UI from processing the login attempt.

Resolution

1. Verify LDAP TLS Peer Verification (Erlang 26+)

If you have recently upgraded or are using Erlang 26, ensure that the LDAP SSL options are explicitly set. As a troubleshooting step, you can disable peer verification to confirm the root cause:

In your advanced.config:

erlang

 

{rabbitmq_auth_backend_ldap, [    {use_ssl, true},    {ssl_options, [{verify, verify_none}]},    ...]}

Note: For production environments, it is recommended to properly configure CA certificates and set verify_peer once the connection is confirmed.

2. Configure Distinguished Name (DN) Lookup

Ensure the LDAP plugin is configured to properly resolve users from your directory (especially for Active Directory):

• dn_lookup_attribute: Set to sAMAccountName.
• dn_lookup_base: Set to your domain base (e.g., "DC=example,DC=com").

3. Check Authentication Backends

Ensure that the LDAP backend is correctly listed in your rabbitmq.conf or advanced.config. If the LDAP plugin is loaded but not in the auth_backends list, authentication will fail.

Example rabbitmq.conf:

ini

 

auth_backends.1 = rabbit_auth_backend_internalauth_backends.2 = rabbit_auth_backend_ldap

4. Isolation Test

To confirm if the LDAP configuration is blocking local user access:

1. Temporarily disable the LDAP plugin or remove it from the auth_backends list.
2. Restart the RabbitMQ node.
3. Attempt to log in with a local administrator account.
4. If successful, the issue is confirmed to be within the LDAP integration settings.

 

Additional Information

For detailed logging, enable debug logs by adding the following to rabbitmq.conf: log.console.level = debug

Look for specific error strings in the logs:

• ldap_connect_error
• failed authenticating [user]: {error, ldap_connect_error}