JWT ACL is not working in emqx v5

[alexa22013]

In emqx version 5 JWT ACL is not working

emqx.conf

 authentication: [{
    from = password
    mechanism = jwt
    enable = true
    secret = emqxsecret
    secret_base64_encoded = false
    algorithm = hmac-based
    use_jwks = false
    verify_claims {
        clientid = "${clientid}"
    }
    acl_claim_name = "acl"
  }]

token

{
  "username": "test-user",
  "clientid": "mqttx_4f52cd40",
  "acl": {
    "pub": [
      "test/user/",
      "test/device"
    ],
    "sub": [
      "test/device"
    ]
  }
}

still I am able to pub/sub on any topic

Anyway to fix this?
thanks in advance...

[Rory-Z]

Hi @savonarola, do you have any ideas ?

[savonarola]

Hello! I will check the things.

[savonarola]

Hello!
I made a smoke test with the provided authn config and things worked for me:

 authentication = [{
    from = password
    mechanism = jwt
    enable = true
    secret = emqxsecret
    secret_base64_encoded = false
    algorithm = hmac-based
    use_jwks = false
    verify_claims {
        clientid = "${clientid}"
    }
    acl_claim_name = "acl"
}]

With invalid topic sub is denied:

>mosquitto_sub -d -t test/deviceXXX -i mqttx_4f52cd40 -u test-user -P 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VybmFtZSI6InRlc3QtdXNlciIsImNsaWVudGlkIjoibXF0dHhfNGY1MmNkNDAiLCJhY2wiOnsicHViIjpbInRlc3QvdXNlci8iLCJ0ZXN0L2RldmljZSJdLCJzdWIiOlsidGVzdC9kZXZpY2UiXX19.FBoeQWFUNcZl_M87jCuTlgxsTypIoEZq5ywTyjRBanI'
Client mqttx_4f52cd40 sending CONNECT
Client mqttx_4f52cd40 received CONNACK (0)
Client mqttx_4f52cd40 sending SUBSCRIBE (Mid: 1, Topic: test/deviceXXX, QoS: 0, Options: 0x00)
Client mqttx_4f52cd40 received SUBACK
Subscribed (mid: 1): 128
Client mqttx_4f52cd40 sending DISCONNECT
All subscription requests were denied.

With valid topic sub is allowed:

>mosquitto_sub -d -t test/device -i mqttx_4f52cd40 -u test-user -P 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VybmFtZSI6InRlc3QtdXNlciIsImNsaWVudGlkIjoibXF0dHhfNGY1MmNkNDAiLCJhY2wiOnsicHViIjpbInRlc3QvdXNlci8iLCJ0ZXN0L2RldmljZSJdLCJzdWIiOlsidGVzdC9kZXZpY2UiXX19.FBoeQWFUNcZl_M87jCuTlgxsTypIoEZq5ywTyjRBanI'
Client mqttx_4f52cd40 sending CONNECT
Client mqttx_4f52cd40 received CONNACK (0)
Client mqttx_4f52cd40 sending SUBSCRIBE (Mid: 1, Topic: test/device, QoS: 0, Options: 0x00)
Client mqttx_4f52cd40 received SUBACK
Subscribed (mid: 1): 0
^CClient mqttx_4f52cd40 sending DISCONNECT

Could you please provide

• the whole emqx.conf
• the encoded token
• the command/screenshot/code snippet used to subscribe/publish
• the unexpected output?

[alexa22013]

Hey thanks, the acl is working now. May have been some issue from my end, couldn't figure out what was it.
Thanks again...

[MacherelR]

Hi,
Seen that topic and it interests me a lot,
Having kind of basic knowledges in security, could anyone just provide me with instructions on how to create the secret the right way and how to generate a JWT token (for now as a test) like @savonarola did in his answer ?
Thanks in advance for your help