Configurable default user & password

[viktorerlingsson]

WHAT is this pull request doing?

Makes it possible to configure default user and password. Takes a hashed value for password.

Also adds api endpoint /api/auth/hash_password/:password and lavinmqctl command lavinmqctl hash_password password to hash passwords.

Also changes guest-only-loopback to default-user-only-loopback, since the default user no longer has to be guest.

Fixes #877

Configuration

Values can be configured by environment variables, in the config file or by command line arguments.
Env

LAVINMQ_DEFAULT_USER=USER
LAVINMQ_DEFAULT_PASSWORD=PASSWORD

Config file

[main]
default_user=USER
default_password=PASSWORD

Command line
--default-user=USER --default-password=PASSWORD

HOW can this pull request be tested?

Run specs.

[snichme]

Not sure how much this is used but this is considered breaking change.
If we keep the other flag and add this new we get around it

[viktorerlingsson]

Yeah. Maybe we should just keep the guest_only_loopback name instead of changing it. 🤔

[snichme]

One way to handle changes is to add the new flag and keep the old, the old still works but logs a deprecation warning and then we remove it next major release

[snichme]

Whats this?

[viktorerlingsson]

Since we use a hashed password I think there should be an easy way to generate that hash. I've taken some inspiration from https://www.rabbitmq.com/docs/passwords#computing-password-hash

[snichme]

Ok, I think it's better to send the password in body, since it's a PUT, URLs tends to show up in logs.

Like so: curl -d my_strong_password -XPUT http://localhost:15672/api/auth/hash_password

yes, it's a different API but maybe better? :)

[viktorerlingsson]

Hmm, yeah that should be a little safer. Maybe we can support both ways? Password in the URL for compatibility, but we recommend/document sending password as body?

[snichme]

Agree. Lets add that the endpoint with password in body as well. But I can open another issue for that and we can put that in a separate PR

[dentarg]

If we want to achive compatibility, it should be GET, not PUT?

I think this could be a thing where we intentionally does not aim for compatibility, as @snichme states, web server logs will contain the plain text password.