History

Zaiming Shi 5bb0cccb53 refactor(build): Clean up app version management Starting from 5.0.0, all apps in apps dir should follow semver strictly. Do not use the umbrella project's release tags. The universal tags made sense when we have applications scattered in different repos. Now since this is an umbrella project, it is enough to have a single package level version number corelated with git tag.		2020-12-01 23:22:33 +01:00
..
.ci	Migrate plugins from tag 4.2.2	2020-10-31 12:10:19 +08:00
include	Migrate plugins from tag 4.2.2	2020-10-31 12:10:19 +08:00
priv	Migrate plugins from tag 4.2.2	2020-10-31 12:10:19 +08:00
src	refactor(build): Clean up app version management	2020-12-01 23:22:33 +01:00
test	Migrate plugins from tag 4.2.2	2020-10-31 12:10:19 +08:00
README.md	Migrate plugins from tag 4.2.2	2020-10-31 12:10:19 +08:00
rebar.config	Migrate plugins from tag 4.2.2	2020-10-31 12:10:19 +08:00

README.md

emqx_auth_redis

EMQ X Redis Authentication/ACL Plugin

Features

Full Authentication, Superuser, ACL support
IPv4, IPv6 support
Connection pool by ecpool
Support single, sentinel, cluster deployment structures of Redis
Completely cover Redis 5, Redis 6 in our tests

Build Plugin

make && make tests

Configure Plugin

File: etc/emqx_auth_redis.conf

## Redis server address.
##
## Value: Port | IP:Port
##
## Redis Server: 6379, 127.0.0.1:6379, localhost:6379, Redis Sentinel: 127.0.0.1:26379
auth.redis.server = 127.0.0.1:6379

## redis sentinel cluster name
## auth.redis.sentinel = mymaster

## Redis pool size.
##
## Value: Number
auth.redis.pool = 8

## Redis database no.
##
## Value: Number
auth.redis.database = 0

## Redis password.
##
## Value: String
## auth.redis.password =

## Authentication query command.
##
## Value: Redis cmd
##
## Variables:
##  - %u: username
##  - %c: clientid
##  - %C: common name of client TLS cert
##  - %d: subject of client TLS cert
##
## Examples:
##  - HGET mqtt_user:%u password
##  - HMGET mqtt_user:%u password
##  - HMGET mqtt_user:%u password salt
auth.redis.auth_cmd = HMGET mqtt_user:%u password

## Password hash.
##
## Value: plain | md5 | sha | sha256 | bcrypt
auth.redis.password_hash = plain

## sha256 with salt prefix
## auth.redis.password_hash = salt,sha256

## sha256 with salt suffix
## auth.redis.password_hash = sha256,salt

## bcrypt with salt prefix
## auth.redis.password_hash = salt,bcrypt

## pbkdf2 with macfun iterations dklen
## macfun: md4, md5, ripemd160, sha, sha224, sha256, sha384, sha512
## auth.redis.password_hash = pbkdf2,sha256,1000,20

## Superuser query command.
##
## Value: Redis cmd
##
## Variables:
##  - %u: username
##  - %c: clientid
##  - %C: common name of client TLS cert
##  - %d: subject of client TLS cert
auth.redis.super_cmd = HGET mqtt_user:%u is_superuser

## ACL query command.
##
## Value: Redis cmd
##
## Variables:
##  - %u: username
##  - %c: clientid
auth.redis.acl_cmd = HGETALL mqtt_acl:%u

SuperUser

HSET mqtt_user:<username> is_superuser 1

User Hash with Password Salt

Set a 'user' hash with 'password' 'salt' field, for example:

HMSET mqtt_user:<username> password "password" salt "salt"

User Set with Password

Set a 'user' Set with 'password' field for example:

HSET mqtt_user:<username> password "password"

ACL Rule Hash

The plugin uses a redis hash to store ACL rules:

HSET mqtt_acl:<username> topic1 1
HSET mqtt_acl:<username> topic2 2
HSET mqtt_acl:<username> topic3 3

NOTE: 1: subscribe, 2: publish, 3: pubsub

Subscription Hash

NOTICE: Move to emqx_backend_redis...

The plugin could store the static subscriptions into a redis Hash:

HSET mqtt_sub:<username> topic1 0
HSET mqtt_sub:<username> topic2 1
HSET mqtt_sub:<username> topic3 2

Load Plugin

./bin/emqx_ctl plugins load emqx_auth_redis

Author

EMQ X Team.