Docs

Cloud Native Message Engine

Client authorization

Client authorization overview

You can quickly configure the MQTT authorization mechanism through the Dashboard visual interface, without writing code or manually editing configuration files, to control permissions for publish and subscribe operations performed by the MQTT client after connection. This document describes the principles of MQTT client authorization, the supported types of authorization resources, and the authorization process.

Authorization principles

Authorization refers to controlling permissions for publish and subscribe operations of MQTT clients. When a client attempts to publish or subscribe, MQTT retrieves the client's permission data from a specified data source according to a specific process or user-defined query statement, matches the retrieved permissions with the operation the client intends to perform, and allows or denies the operation based on the matching result.

The client's permission list must be stored in a specific data source in advance, and then an authorization checker must be created in MQTT based on the corresponding data source type.

Authorization data sources

Authorization data sources are used to store client authorization rules. On the MQTT Dashboard Client Authorization page, you can quickly create authorization checkers based on various types of data sources. Currently, three types of data sources are supported: File, Built-in Database, and MySQL.

File: Use ACL files to edit and save authorization rule content.

Built-in database: Use the MQTT built-in database to edit and save authorization rule content. Authorization specifications can be configured through the Dashboard. For detailed steps, see Configure built-in database authorization rules.

MySQL: Use cloud database (MySQL edition) to edit and save authorization rule content, and obtain client permission data through specified SQL query statements.

Note

You cannot create more than one authorization checker of the same type in a single MQTT instance.

The authorization data source must be in the same VPC as the MQTT instance.

To avoid errors in authorization checking, disable or remove authorization checkers based on ACL files when necessary, because the special rule {allow, all} at the end of the ACL file allows all requests by default.

Authorization checking process

You can create multiple authorization checkers within a single MQTT instance to form an authorization chain, enabling more flexible authorization checks. MQTT will perform authorization checks sequentially according to the order of checkers configured in the authorization chain.

The authorization checking process is as follows:

When the current authorization checker is executed and retrieves the client's permission information, it matches the operation being performed with the client's permission information:

If the operation matches the permission, allow or deny the client's operation based on the permission;

If the operation does not match the permission, pass it to the next authorization checker for further checking.

If the current authorization checker does not retrieve the client's permission information during execution, continue to check whether other authorization checkers exist in the authorization chain:

If so, skip the current authorization checker and pass the request to the next authorization checker for further checking.

If not, allow or deny the client's operation according to the action when not matched parameter configuration.

You can configure the action when not matched parameter in the Dashboard Authorization Settings panel. For details, see Configure Authorization.

Last updated: 2026.01.26 16:15:21