Access an Open-source Authentication Instance over the Public Endpoint - ApsaraMQ for RabbitMQ

You need to do extra configurations on certain instances, when accessing the instance through a public endpoint.

Applicable scope

This topic applies to ApsaraMQ for RabbitMQ instances that meet all of the following conditions:

The instance uses the open-source authentication and permission management mode. See Open-source auth.
The instance edition is:
- Serverless:
  - (Exclusive) Pay-by-Provisioned-Capacity-and-Elastic-Traffic
  - (Shared) Pay-by-Provisioned-Capacity-and-Elastic-Traffic
  - (Shared) Pay-by-Messaging-Request
- Subscription:
  - Enterprise Edition
  - Enterprise Platinum Edition
A public endpoint is displayed on the Instance Details page.

Prerequisites

Before you connect, complete the following configurations:

Important

To ensure access security, you must enable the public IP address whitelist when you access an instance over the Internet. Add the actual public IP address or CIDR block of the client to the whitelist. Only clients within the whitelist range can access the instance.

On the Users and Permissions page of the instance, create a custom username and password, and grant the user the operation permissions on the target vhost and related resources. For more information, see Users and Permissions.
Add the actual public IP address or CIDR block of the client to the public IP address whitelist of the instance. For more information, see Whitelist.
On the Instance Details page, obtain the Instance ID and the public endpoint. Copy the public endpoint displayed in the console directly. Do not concatenate the domain name manually.

Configure the instance ID on the client

When connecting over the public endpoint, different editions have different client configuration requirements:

Instance series	Edition	Instance ID required	Description
Serverless	(Exclusive) Pay-by-Provisioned-Capacity-and-Elastic-Traffic	No	The server can automatically identify the target instance.
Serverless	(Shared) Pay-by-Provisioned-Capacity-and-Elastic-Traffic	Yes	The client must specify the target instance through AMQP Client Properties.
Serverless	(Shared) Pay-by-Messaging-Request	Yes	The client must specify the target instance through AMQP Client Properties.
Subscription	Enterprise Platinum Edition	No	The server can automatically identify the target instance.
Subscription	Enterprise Edition	Yes	The client must specify the target instance through AMQP Client Properties.

Java configuration example

If your edition requires the instance ID (see the table above), configure the public endpoint, username, password, and vhost by following the instructions in Use an SDK to send and receive messages. Then, add the following configuration before you call newConnection():

String instanceId = "amqp-cn-xxxxxxxx";

// The factory has been configured with the public endpoint, username, password, and vhost.
Map<String, Object> clientProperties =
        new HashMap<String, Object>(factory.getClientProperties());
clientProperties.put("aliyun_rabbitmq_instance_id", instanceId);
factory.setClientProperties(clientProperties);

Connection connection = factory.newConnection();

Note the following items:

The value of aliyun_rabbitmq_instance_id must be the instance ID displayed in the console, not the public endpoint.
For the (Shared) Pay-by-Provisioned-Capacity-and-Elastic-Traffic edition, the (Shared) Pay-by-Messaging-Request edition of the Serverless series, and the Enterprise Edition of the Subscription series, you must set this property before you create a connection.
Copy and retain the default properties from factory.getClientProperties() to avoid overwriting the built-in client information of the Java client.
The (Exclusive) Pay-by-Provisioned-Capacity-and-Elastic-Traffic edition of the Serverless series and the Enterprise Platinum Edition of the Subscription series do not require this property. If you set the property, the value must match the actual instance ID.

Troubleshooting connection failures

If the public connection is rejected, check the following items in order:

Verify that the actual public IP address of the client has been added to the public IP address whitelist of the target instance.
If you use the (Shared) Pay-by-Provisioned-Capacity-and-Elastic-Traffic edition, the (Shared) Pay-by-Messaging-Request edition of the Serverless series, or the Enterprise Edition of the Subscription series, verify that aliyun_rabbitmq_instance_id is set and matches the target instance ID exactly. The (Exclusive) Pay-by-Provisioned-Capacity-and-Elastic-Traffic edition and the Enterprise Platinum Edition do not require this property.
Verify that the custom username and password are correct and that the user has access permissions on the target vhost.
Verify that the client is configured with the public endpoint of the instance, not the OpenAPI service endpoint.

For issues related to network timeouts, resource permissions, or general SDK configurations, see Possible causes and solutions for connection failures.