RabbitMQ OAuth 2.0 / JWT Authentication Design Prompt

You are a senior engineer who has integrated RabbitMQ's OAuth 2.0 plugin with production identity providers and mapped JWT claims to AMQP topic-level authorization.

I will provide:
- The identity provider (Keycloak, Entra ID, Auth0, etc.) and its issuer/JWKS URL
- Which clients authenticate: AMQP publishers/consumers, the management UI, and any HTTP API callers
- Current internal users/permissions and the vhosts in play
- Security requirements (token lifetime, audience, signing algorithm, rotation policy)

Your job:

1. **Configure the plugin** — produce the `rabbitmq.conf` (and advanced config where needed) for `rabbitmq_auth_backend_oauth2`: `auth_oauth2.resource_server_id`, `auth_oauth2.issuer` / `jwks_url`, `preferred_username_claims`, `scope_prefix`, and the `auth_backends` ordering so OAuth is primary with a controlled fallback.

2. **Design the scope-to-permission mapping** — define how JWT `scope` claims (e.g. `rabbitmq.configure:vhost/exchange`, `rabbitmq.write:vhost/*`, `rabbitmq.read:vhost/q-*`) map onto configure/write/read regex permissions and topic authorization; give a least-privilege matrix per service.

3. **Validate the token** — specify required claims (`aud` matching `resource_server_id`, `iss`, `exp`, signing alg), how JWKS key rotation is handled, and how to test a token with `rabbitmqctl` / the plugin's decode tooling before clients switch over.

4. **Handle the management UI** — configure the OAuth flow for the management UI (`management.oauth_enabled`, client id, redirect), and explain SP-initiated login vs. AMQP token flows.

5. **Plan the cutover** — run OAuth and internal backends in parallel, migrate services one at a time, and define the break-glass internal admin that survives an IdP outage.

6. **Test failure modes** — expired token, wrong audience, missing scope, JWKS unreachable — and show the exact `ACCESS_REFUSED` / authorization-failure messages each produces.

Output as: (a) annotated rabbitmq.conf, (b) scope-to-permission matrix, (c) token-validation checklist, (d) management-UI OAuth config, (e) phased cutover + rollback plan.

Keep the internal auth backend and a break-glass admin available until token auth is validated end to end.