Management UI HTTP access log should use resolved preferred_username for OAuth2 sessions instead of client_id.
enhancement
### Is your feature request related to a problem? Please describe.
When using OAuth2 authentication (via rabbit_auth_backend_oauth2 and keycloak) with the RabbitMQ Management UI, the HTTP access log records the OAuth2 client_id as the username instead of the actual user identity resolved from the token's preferred_username claim.
For example, with two users — one authenticated via OAuth2 (rmq_admin) and one via basic auth (basic_user) — performing the same operation (creating a queue), the access log shows:
```
172.20.0.1 - rabbitmq [28/May/2026:09:37:37 +0000] "PUT /api/queues/tradingsystems/from_oauth.q HTTP/1.1" 201 0
172.20.0.1 - basic_user [28/May/2026:09:38:04 +0000] "PUT /api/queues/tradingsystems/from_basic.q HTTP/1.1" 201 0
```
The OAuth2 user appears as rabbitmq (the client_id) rather than rmq_admin (the preferred_username from the token), even though auth_oauth2.preferred_username_claims is correctly configured and RabbitMQ resolves the username internally for authorization purposes.
This makes the management UI HTTP access log unreliable for auditing and tracing user activity when OAuth2 authentication is used, as all OAuth2 users appear under the same client_id identity.
### Describe the solution you'd like
Given the case described above would like to see in the logs:
```
172.20.0.1 - rmq_admin [28/May/2026:09:37:37 +0000] "PUT /api/queues/tradingsystems/from_oauth.q HTTP/1.1" 201 0
172.20.0.1 - basic_user [28/May/2026:09:38:04 +0000] "PUT /api/queues/tradingsystems/from_basic.q HTTP/1.1" 201 0
```
Where `rmq_admin` is the user that logged with oauth2
### Describe alternatives you've considered
_No response_
### Additional context
Here is the `rabbitmq.conf` file
```
# =================================================================
# AUTHENTICATION BACKENDS
# =================================================================
auth_backends.1 = internal
auth_backends.2 = rabbit_auth_backend_oauth2
# =================================================================
# OAUTH2 PROVIDER (Keycloak)
# =================================================================
auth_oauth2.issuer = https://localhost:8443/realms/rabbitmq-demo
auth_oauth2.jwks_url = https://keycloak:8443/realms/rabbitmq-demo/protocol/openid-connect/certs
auth_oauth2.https.verify = verify_none
auth_oauth2.https.peer_verification = verify_none
auth_oauth2.resource_server_id = rabbitmq
auth_oauth2.preferred_username_claims.1 = preferred_username
auth_oauth2.preferred_username_claims.2 = sub
auth_oauth2.additional_scopes_key = roles
auth_oauth2.scope_prefix = rabbitmq.
# =================================================================
# MANAGEMENT UI – OAuth2 LOGIN
# =================================================================
management.oauth_enabled = true
management.oauth_client_id = rabbitmq
management.oauth_scopes = openid rabbitmq-roles administrator management
management.oauth_disable_basic_auth = false
management.login_session_timeout = 15
management.http_log_dir = /var/log/rabbitmq/
# =================================================================
# GENERAL SETTINGS
# =================================================================
default_vhost = /
default_queue_type = quorum
management.load_definitions = /etc/rabbitmq/definitions.json
# --- LOGGING ----------------------------------------------------
log.console = true
log.console.level = debug
log.file = /var/log/rabbitmq/rabbit.log
log.file.level = info
```
In the UI `rmq_admin` user is well displayed
<img width="3438" height="566" alt="Image" src="https://github.com/user-attachments/assets/331a5f8f-4f92-4e84-a70f-632892e8c34e" />
But not in the logs where we can see `rabbitmq`
```
172.20.0.1 - rabbitmq [28/May/2026:14:30:18 +0000] "GET /api/overview HTTP/1.1" 200 9447 "http://localhost:15672/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) Gecko/20100101 Firefox/128.0"
172.20.0.1 - rabbitmq [28/May/2026:14:30:18 +0000] "GET /api/vhosts HTTP/1.1" 200 429 "http://localhost:15672/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) Gecko/20100101 Firefox/128.0"
```
Access token :
```
{
"exp": 1779979117,
"iat": 1779978817,
"jti": "8386fda8-4df1-4caf-8d5d-aca07738135c",
"iss": "https://localhost:8443/realms/rabbitmq-demo",
"aud": "rabbitmq",
"typ": "Bearer",
"azp": "rabbitmq",
"sid": "554ea096-be83-4dbb-b146-469586eaf0ed",
"scope": "openid administrator rabbitmq-roles management",
"roles": [
"rabbitmq.read:*/*",
"rabbitmq.write:*/*",
"rabbitmq.tag:administrator",
"offline_access",
"uma_authorization",
"default-roles-rabbitmq-demo",
"rabbitmq.configure:*/*"
],
"preferred_username": "rmq_admin"
}
```
0 条评论