1

We have an app that publishing to single exchange (using amqp). Additionally we have a number of apps interested in consuming messages from this exchange. To that end, they create queues and bindings from the queues to the exchange.

We would like to ensure that each app's queues and bindings can only be managed by that app and the user that the app connects with. I envisaged using virtual hosts so that the exchange sat in a /common virtual host which each app's user had read access to and each app's queues and bindings lived in their own /<app> virtual host which the user had full access to.

The documentation, however, suggests that a user cannot access more than one virtual host simultaneously within a channel and the API doesn't provide an option to specify virtual host as part of bindQueue().

Is there a way to achieve this?

3 Answers 3

1

You specify the Virtual Hosts (vhost) in the connection string. Vhosts makes it possible to separate applications on one broker. You can isolate users, exchanges, queues etc to one specific vhost. You can separate environments, e.g. production to one vhost and staging to another vhost within the same broker, instead of setting up multiple brokers.

https://devcenter.heroku.com/articles/cloudamqp#separate-applications

1
  • That I understand. My issue is that we have several apps that we want to keep separate but they need to bind to the same exchange. I want each app to login using their own user, create their own queues without having access to another apps queues but being able to bind to a shared exchange. If each app has vhosts vhost1 and vhost2 and the exchange lives in vhost common there seems to be no way to bind a queue in vhost1 to an exchange in common.
    – Tom
    Jan 27, 2017 at 15:38
0

I think to achieve what you asked you need to use federation. I have the same domain problem. One exchange and then different application consuming from different queues. If I am right the step are:

Exchange A => federation To Exchange 1/2/3/4/... these exchange have a different vhost each other.

create different vhost and user for different applications. Give the access to these vhost to different exchange (Exchange 1/2/3/4/)

create different queue to bind from the different Exchange 1/2/3/4/

Is this clear?

1
  • 1
    Hi - I think you have the answer and I believe it may also be possible using the shovel plugin that we are already using so I'm going to try that first. Thanks for the lead.
    – Tom
    Apr 27, 2017 at 9:41
0

The queues are managed by rabbitmq. Consumers cannot manage them. Consumers may create/declare the queues with this or that set of parameters. One of those parameters is "exclusive", indicating that only current connection may access the queue.

Virtual host is specified at connecting, not at binding as you said, so you would need to do this in a separate thread. Either that or re-organize you vhosts.

Maybe you don't need any of it and it would be sufficient to have routing keys and declare queues exclusive instead of the '/app' vhostand have a fanout exchange instead of the '/common' vhost.

1
  • We use routing keys. There are different messages passing through the common exchange and each app is interested in a different selection of messages, so they route them to the queues they are interested in. The issue is that the user that app logs in with (is the same user that the developer uses to log in to the console) has privileges to do everything so they can manage their queues. I'd like to limit their privileges to only the queues their app uses.
    – Tom
    Jan 27, 2017 at 15:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.