Search code examples
aclmosquitto

How to perform acl check with mosquitto-auth-plugin

I've setup the plugin to use the HTTP backend. When connecting with username and password the http_getuser_uri is used like it should. But I would like to use the ACL check with http_aclcheck_uri.

My server configuration:

log_type all
connection_message true
listener 1883 localhost
listener 8883
certfile /etc/mosquitto/certs/cert.pem
cafile /etc/mosquitto/certs/chain.pem
keyfile /etc/mosquitto/certs/privkey.pem
auth_plugin /home/ubuntu/mqtt/mosquitto/auth-plug.so
auth_opt_backends http
auth_opt_http_ip 127.0.0.1
auth_opt_http_port 80
auth_opt_http_getuser_uri /auth
auth_opt_http_superuser_uri /superuser
auth_opt_http_aclcheck_uri /acl

There are two publish events but it seems that mosquitto performs the acl check instead of the plugin.

log:

1519727880: New connection from xxx.xxx.xxx.xxx on port 8883.
1519727881: mosquitto_auth_unpwd_check(UserName)
1519727881: ** checking backend http
1519727881: url=http://127.0.0.1:80/auth
1519727881: data=username=UserName&password=PassWord&topic=&acc=-1&clientid=
1519727881: getuser(UserName) AUTHENTICATED=1 by http
1519727881: New client connected from xxx.xxx.xxx.xxx as 110299159666937 (c1, k60, u'UserName').
1519727881: Sending CONNACK to 110299159666937 (0, 0)
1519727881: Received SUBSCRIBE from 110299159666937
1519727881:     alarm (QoS 0)
1519727881: 110299159666937 0 alarm
1519727881: Sending SUBACK to 110299159666937
1519727881: Received SUBSCRIBE from 110299159666937
1519727881:     alarm (QoS 0)
1519727881: 110299159666937 0 alarm
1519727881: Sending SUBACK to 110299159666937
1519727881: mosquitto_auth_acl_check(..., 110299159666937, UserName, alarm, MOSQ_ACL_WRITE)
1519727881: aclcheck(UserName, alarm, 2) CACHEDAUTH: 0
1519727881: Received PUBLISH from 110299159666937 (d0, q0, r0, m0, 'alarm', ... (31 bytes))
1519727881: mosquitto_auth_acl_check(..., 110299159666937, UserName, alarm, MOSQ_ACL_READ)
1519727881: aclcheck(UserName, alarm, 1) CACHEDAUTH: 0
1519727881: Sending PUBLISH to 110299159666937 (d0, q0, r0, m0, 'alarm', ... (31 bytes))

Do I have to configure something extra in mosquitto.conf for passing the acl check to the backend?

Kind regards,

Bart

Solution

  • Disabling the cache (auth_opt_acl_cacheseconds 0) and setting the correct HTTP-response (4**) in the /superuser solved the issue. The superuser is called before the acl (so configuring the superuser is obliged).