MQTT User Authentication

Choose between password and certificate authentication for MQTT clients.

Connectware supports two authentication methods for MQTT clients: Username/password and x.509 certificate with Mutual TLS for CybusMQ connections. You can set the authentication method via the CYBUS_BROKER_USE_MUTUAL_TLS environment variable.

Method
Configuration
Client requirements

Username/Password

CYBUS_BROKER_USE_MUTUAL_TLS=no

Client must provide username and password

Mutual TLS

CYBUS_BROKER_USE_MUTUAL_TLS=yes

Client must provide valid x.509 certificate

Username/Password Authentication

When Mutual TLS is disabled, MQTT clients authenticate using a username and password:

This authentication method works with all MQTT connection schemes (TCP, WebSocket, SSL/TLS).

Mutual TLS Authentication

Mutual TLS offers enhanced security by eliminating password transmission and providing stronger client verification. When enabled, Mutual TLS provides certificate-based authentication:

  • Requires a valid x.509 client certificate signed by the Connectware CA.

  • The certificate's Common Name (CN) must match a Connectware username with grant type certificate.

  • No username or password needed - possession of a valid certificate proves identity.

MQTT Permissions

Once authenticated (by either method), MQTT clients can interact with topics based on their assigned permissions:

Permission
Allowed actions

read

Subscribe to topics

write

Publish to topics

readWrite

Both subscribe and publish

To manage MQTT user permissions efficiently, create specific roles with appropriate topic permissions and assign them to users rather than configuring permissions individually. For more information, see Permissions.

Last updated

Was this helpful?