[Questions] OAUTH2: no audience claim with multiple ressource servers and providers

[cvuillemez]

RabbitMQ version used

4.1.1

Erlang version used

27.3.4

What problem are you trying to solve?

Hi,

I use OAUTH2 to perform authorizations with management plugin.
I use multiple providers and resource servers.
I understand RabbitMQ needs the audience claim to identify which RS to use.
But in my case, there is one provider which doesn't set "aud" claim in JWT (this claim is optional, cf RFC 7519 about JWT).

Is there a way to use a default resource server ?

When trying to authenticate, it fails with the following error:

2025-10-14 08:55:40.294718+02:00 [warning] <0.92407.0> HTTP access denied: Authentication using OAuth 2/JWT token failed: {error,
2025-10-14 08:55:40.294718+02:00 [warning] <0.92407.0>                                                 no_aud_found_cannot_pick_one_from_too_many_resource_servers}

[cvuillemez]

It's possible to solve this in advanced.config file, e.g.:

 {rabbitmq_auth_backend_oauth2, [
   {resource_servers,
             #{<<"rs_id_1">> =>
                   {oauth_provider_id,<<"rs_id_1">>},
                   {id,<<"rs_id_1">>}],
               <<"rs_id_2">> =>
                   {oauth_provider_id,<<"rs_id_2">>},
                   {id,<<"rs_id_2">>},
                   {verify_aud, false}
                   ]
              }
   }

 ]}