2026-05 Monthly Summary — goauthentik/authentik Key features delivered: - RabbitMQ integration and security hardening: Integrated RabbitMQ support using the rabbitmq_auth_backend_oauth2 plugin, enabling Management UI login via OpenID Connect and AMQP/HTTP API authentication with a JWT as the password. Implemented required scope mappings (aud claim) and the synthetic group bindings (rabbitmq-administrator, rabbitmq-monitoring) along with application policy bindings that gate login at the authentik layer. This work aligns with the commit 002178e2e1d4aaa18eb44f143fd77498111d6d09 and includes infrastructure/documentation changes to support the integration. Major bugs fixed (security fixes): - Security bypass hardening for service accounts: Replaced broad suffix-based bypass checks with a strict internal_service_account type check (request.user.type == "internal_service_account"), eliminating the risk of admin-created service accounts bypassing policies and strengthening the client_credentials access path. Overall impact and accomplishments: - Enables secure, auditable RabbitMQ access for both UI management and programmatic clients, reducing operational risk through centralized, policy-driven authentication and authorization. - Improves security posture with precise service account handling and robust authentication flows, delivering end-to-end OAuth2/OpenID Connect and JWT-based access for RabbitMQ usage. Technologies/skills demonstrated: - OAuth2/OpenID Connect integration, JWT-based authentication, and RabbitMQ OAuth backend (rabbitmq_auth_backend_oauth2). - Policy-based access control, scope mapping, and group-based authorization (rabbitmq-administrator, rabbitmq-monitoring). - Security hardening practices, internal_service_account typing, documentation/infrastructure updates, and cross-team collaboration.