Search code examples
mqttmosquitto

Client authorization Mosquitto?

We want to achieve certain Authorization checks using Mosquitto MQTT Broker:

  1. The SAN (Subject Alt Name) of the client certificate shall contain the clientID of the incoming MQTT request.

  2. A client shall be able to subscribe only those topics which contain it's clientID i.e Topic Authorization.

  3. Only known clientID's shall be able to subscribe to wildcard topics.

Can these be achieved with configuration changes without changing Mosquitto code ?

Solution

    1. If you combine both use_identity_as_username and use_username_as_clientid you can use the CN (note not the SAN) as both the username and client id.

    2. That will depend a little on the topic structure, but you can probably use the %c pattern to build a ACL entry that will match e.g. %c/# will allow all topics starting with the client id

    3. The ACLs are controlled by username not client id, but given 1. both should be the same so again this should be possible with the default options.