EMQ http认证

转载自:http://www.5180it.com/bbs/admin/1/532.html


HTTP 认证使用外部自建 HTTP 应用认证数据源,根据 HTTP API 返回的数据判定认证结果,能够实现复杂的认证鉴权逻辑。

官方文档

https://docs.emqx.cn/cn/broker/latest/advanced/auth-http.html

  根目录/etc/plugins/emqx_auth_http.conf

##--------------------------------------------------------------------

## Authentication request.

## Value: URL

auth.http.auth_req = http://192.168.104.50:8787/mqtt/authHttp/auth

## Value: post | get | put

auth.http.auth_req.method = post

## It only works when method=post

## Value: json | x-www-form-urlencoded

auth.http.auth_req.content_type = x-www-form-urlencoded

## Variables:

##  - %u: username

##  - %c: clientid

##  - %a: ipaddress

##  - %r: protocol

##  - %P: password

##  - %p: sockport of server accepted

##  - %C: common name of client TLS cert

##  - %d: subject of client TLS cert

##

## Value: Params

auth.http.auth_req.params = clientid=%c,username=%u,password=%P

##--------------------------------------------------------------------

## Superuser request.

## Value: URL

auth.http.super_req = http://192.168.104.50:8787/mqtt/authHttp/superuser

## Value: post | get | put

auth.http.super_req.method = post

## It only works when method=pos

## Value: json | x-www-form-urlencoded

auth.http.super_req.content_type = x-www-form-urlencoded

## Variables:

##  - %u: username

##  - %c: clientid

##  - %a: ipaddress

##  - %r: protocol

##  - %P: password

##  - %p: sockport of server accepted

##  - %C: common name of client TLS cert

##  - %d: subject of client TLS cert

##

## Value: Params

auth.http.super_req.params = clientid=%c,username=%u

##--------------------------------------------------------------------

## ACL request.

## Variables:

##  - %A: 1 | 2, 1 = sub, 2 = pub

##  - %u: username

##  - %c: clientid

##  - %a: ipaddress

##  - %r: protocol

##  - %m: mountpoint

##  - %t: topic

##

## Value: URL

auth.http.acl_req = http://192.168.104.50:8787/mqtt/authHttp/acl

## Value: post | get | put

auth.http.acl_req.method = get

## It only works when method=pos

## Value: json | x-www-form-urlencoded

auth.http.acl_req.content_type = x-www-form-urlencoded

## Variables:

##  - %u: username

##  - %c: clientid

##  - %a: ipaddress

##  - %r: protocol

##  - %P: password

##  - %p: sockport of server accepted

##  - %C: common name of client TLS cert

##  - %d: subject of client TLS cert

##

## Value: Params

auth.http.acl_req.params = access=%A,username=%u,clientid=%c,ipaddr=%a,topic=%t,mountpoint=%m

启动插件

package com.simba.controller;

import javax.servlet.http.HttpServletResponse;

import org.apache.commons.logging.Log;

import org.apache.commons.logging.LogFactory;

import org.apache.http.HttpStatus;

import org.springframework.stereotype.Controller;

import org.springframework.web.bind.annotation.GetMapping;

import org.springframework.web.bind.annotation.PostMapping;

import org.springframework.web.bind.annotation.RequestMapping;

import org.springframework.web.bind.annotation.ResponseBody;

/**

 * 认证执行顺序为  Authentication request —> Superuser request —> ACL request

 * 当设备连接服务器的时候,首先执行Authentication request,返回值为200时认证通过,非200认证失败。

 * 当Authentication request 通过则会执行Superuser request 返回值为200时认证通过,非200认证失败。(该处失败不影响连接)

 * 当设备订阅主题,亦或是发布内容的时候 会执行ACL request,需要注意的是,如果Superuser request认证通过,则该处不执行,默认通过。

 * @author liusheng

 *

 */

@Controller

@RequestMapping("/mqtt/authHttp")

public class AuthHttpController {


private static final Log logger = LogFactory.getLog(AuthHttpController.class);

    /**

     * 设备连接权限校验

     * @param clientid 客户端ID

     * @param username 用户名

     * @param password 密码

     * @return 认证失败,API 返回4xx

     *         认证成功,API 返回200

     */

    @ResponseBody

    @PostMapping("/auth")

    public void auth(String clientid, String username, String password, HttpServletResponse response){

  logger.info("auth>>>>>>>>>>>>>>>>>>>>>>>>>>>>>");

  logger.info("clientid:"+clientid);

  logger.info("username:"+username);

  logger.info("password:"+password);

  if(username.equals("king")||username.equals("unilink")){

  response.setStatus(HttpStatus.SC_OK);

  }else{

  response.setStatus(HttpStatus.SC_UNAUTHORIZED);

  }

    }


    /**

     * 验证是否为超级用户

     * @param clientid 客户端ID

     * @param username 用户名

     * @return 认证失败,API 返回4xx

     *         认证成功,API 返回200

     */

    @ResponseBody

    @PostMapping("/superuser")

    public void isSuper(String clientid, String username,HttpServletResponse response){

  logger.info("superuser>>>>>>>>>>>>>>>>>>>>>>>>>>>>>");

  logger.info("clientid:"+clientid);

  logger.info("username:"+username);

        response.setStatus(HttpStatus.SC_UNAUTHORIZED);

    }


    /**

     * 设备订阅主题、发布内容时执行,当设备为超级用户时 不执行

     * @return ACL失败,API 返回4xx

     *         ACL成功,API 返回200

     */

    @ResponseBody

    @GetMapping("/acl")

    public void acl(String access, String username, String clientid, String ipaddr, String topic,HttpServletResponse response){

  logger.info("acl>>>>>>>>>>>>>>>>>>>>>>>>>>>>>");

  logger.info("access:"+access);

  logger.info("username:"+username);

  logger.info("clientid:"+clientid);

  logger.info("ipaddr:"+ipaddr);

  logger.info("topic:"+topic);

        response.setStatus(HttpStatus.SC_OK);

    }

}   


说明

    认证执行顺序为  Authentication request —> Superuser request —> ACL request

    当设备连接服务器的时候,首先执行Authentication request,返回值为200时认证通过,非200认证失败。

    当Authentication request 通过则会执行Superuser request 返回值为200时认证通过,非200认证失败。(该处失败不影响连接)

    当设备订阅主题,亦或是发布内容的时候 会执行ACL request,需要注意的是,如果Superuser request认证通过,则该处不执行,默认通过。

这里简单的判断了用户名,后续可进行对应的权限判断

 auth:是在每次登录是都会验证一次。

 superuser:会在登录的时候调用判断是否有超级用户权限

 acl:这个会在发布或订阅数据的时候请求,判断是否允许发布或订阅,不会每次都判断,只对新Topic才进行判断,然后缓存在EMQ里面。

 WebHook采用就是标准的HTTP请求,利用HTTP response的返回状态码表示是否通过。

 通过这种方式,比之前通过查询数据有更强的业务扩展性。比如可以判断设备是否被禁用。设备的ACL权限问题,可以更细微级控制。但是毕竟通过HTTP方式会有性能损耗,这一点为鉴权功能单独划分模块。从业务服务器独立出来单独成为一个服务。

如果验证失败,在mqtt客户端,则会有下面错误:

2021-01-27 14:39:27.853 ERROR 8488 -- [sk-scheduler-10] .m.i.MqttPahoMessageDrivenChannelAdapter : Exception while connecting and subscribing

org.eclipse.paho.client.mqttv3.MqttSecurityException: 错误的用户名或密码

at org.eclipse.paho.client.mqttv3.internal.ExceptionHelper.createMqttException(ExceptionHelper.java:28)

at org.eclipse.paho.client.mqttv3.internal.ClientState.notifyReceivedAck(ClientState.java:988)

at org.eclipse.paho.client.mqttv3.internal.CommsReceiver.run(CommsReceiver.java:145)

at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)

at java.util.concurrent.FutureTask.run(FutureTask.java:266)

at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(ScheduledThreadPoolExecutor.java:180)

at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:293)

at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)

at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)

at java.lang.Thread.run(Thread.java:748)



转载自:http://www.5180it.com/bbs/admin/1/532.html

你可能感兴趣的:(EMQ http认证)