CODEWITHSUNDEEP
rabbitmq
AlexTheOpsGuy
AlexTheOpsGuy

Reputation: 21

Authorize a RabbitMQ user to create a dynamic shovel via the API

I want to create a user that has only the authorization to create a dynamic shovel between 2 queues. The user should be able to make the following call to the API.

curl -u "shoveluser:superpassword"  -X PUT "http://rabbitmq.mycompany.com:15672/api/parameters/shovel/%2f/shovelit" \
                       -H "content-type: application/json" \
                       -d @- <<EOF
{
  "value": {
    "src-uri": "amqp://",
    "src-queue": "email.send.error",
    "dest-uri": "amqp://",
    "dest-queue": "email.send",
    "delete-after": "queue-length"
  }
}
EOF

But after calling it, I get the response:

{"error":"not_authorised","reason":"User not authorised to access object"}%

I set the following Topic permissions

Virtual host Exchange Write regexp Read regexp
/ email.send.error .* .*
/ email.send .* .*

I also add the management-Tag to the user.

Upvotes: 1

Views: 26

Answers (1)

AlexTheOpsGuy
AlexTheOpsGuy

Reputation: 21

I had to set the tag policymaker for the new user in order for it to work.

https://www.rabbitmq.com/docs/shovel-dynamic#using-http-api

The endpoint requires that the user that invokes it has policymaker privileges (tag).

Upvotes: 0

Related Questions