Mnesia Authentication

Mnesia authentication uses the built-in Mnesia database of EMQX to store client Client ID/Username and password, and supports management of authentication data through HTTP API.

Mnesia authentication does not depend on external data sources, and it is simple and lightweight to use.

Plugin:

  1. emqx_auth_mnesia

Authentication rules

Hash method

Mnesia authentication uses sha256 for password hash encryption by default, which can be changed in etc/plugins/emqx_auth_mnesia.conf:

  1. # etc/plugins/emqx_auth_mnesia.conf
  3. ## Value: plain | md5 | sha | sha256
  4. auth.mnesia.password_hash = sha256

After configuring [Hash Method](./auth.md#Password salting rules and hash methods), the newly added preset authentication data and authentication data added through the HTTP API will be stored in the EMQX built-in database in the format of hash ciphertext.

Preset authentication data

You can preset authentication data through the configuration file and edit the configuration file: etc/plugins/emqx_auth_mnesia.conf

  1. # etc/plugins/emqx_auth_mnesia.conf
  3. ## The first group of authentication data
  4. auth.client.1.clientid = admin
  5. auth.client.1.password = public
  7. ## The second group of authentication data
  8. auth.user.2.username = admin
  9. auth.user.2.password = public

When the plugin starts, it will read the preset authentication data and load it into the EMQX built-in database, and the authentication data on the node will be synchronized to the cluster at this stage.

TIP

The preset authentication data uses a clear text password in the configuration file. For security and maintainability, this function should be avoided.

The preset authentication data cannot be modified or deleted through the API, please use it with caution.

Use the HTTP API to manage authentication data

Add authentication data

  • Clientid

    1. # Request
    2. POST api/v4/auth_clientid
    3. {
    4.     "clientid": "emqx_c",
    5.     "password": "emqx_p"
    6. }
    7. # Response
    8. {
    9.     "code": 0
    10. }

  • Username

    1. # Request
    2. POST api/v4/auth_username
    3. {
    4.     "username": "emqx_u",
    5.     "password": "emqx_p"
    6. }
    8. # Response
    9. {
    10.     "code": 0
    11. }

Add authentication data in batch

  • Clientid

    1. # Request
    2. POST api/v4/auth_clientid
    3. [
    4.     {
    5.         "clientid": "emqx_c_1",
    6.         "password": "emqx_p"
    7.     },
    8.     {
    9.         "clientid": "emqx_c_2",
    10.         "password": "emqx_p"
    11.     }
    12. ]
    14. # Response
    15. {
    16.     "data": {
    17.         "emqx_c_2": "ok",
    18.         "emqx_c_1": "ok"
    19.     },
    20.     "code": 0
    21. }

  • Username

    1. # Request
    2. POST api/v4/auth_username
    3. [
    4.     {
    5.         "username": "emqx_u_1",
    6.         "password": "emqx_p"
    7.     },
    8.     {
    9.         "username": "emqx_u_2",
    10.         "password": "emqx_p"
    11.     }
    12. ]
    14. # Response
    15. {
    16.     "data": {
    17.         "emqx_c_2": "ok",
    18.         "emqx_c_1": "ok"
    19.     },
    20.     "code": 0
    21. }

Check the added authentication data

  • Clientid

    1. # Request
    2. GET api/v4/auth_clientid?_like_clientid=emqx_c
    4. # Response
    5. {
    6.   "meta": {
    7.     "page": 1,
    8.     "limit": 10,
    9.     "count": 1
    10.   },
    11.   "data": [
    12.               "clinetid": "emqx_c",
    13.               "clinetid": "emqx_c_1",
    14.               "clinetid": "emqx_c_2"
    15.           ],
    16.   "code": 0
    17. }

  • Username

    1. # Request
    2. GET api/v4/auth_username?_like_username=emqx_u
    4. # Response
    5. {
    6.   "meta": {
    7.     "page": 1,
    8.     "limit": 10,
    9.     "count": 1
    10.   },
    11.   "data": [
    12.               "username": "emqx_u",
    13.               "username": "emqx_u_1",
    14.               "username": "emqx_u_2"
    15.           ],
    16.   "code": 0
    17. }

Change the added authentication data

  • Clientid

    1. # Request
    2. PUT api/v4/auth_clientid/${clientid}
    3. {
    4.     "password": "emqx_new_p"
    5. }
    7. # Response
    8. {
    9.     "code": 0
    10. }

  • Username

    1. # Request
    2. PUT api/v4/auth_username/${username}
    3. {
    4.     "password": "emqx_new_p"
    5. }
    7. # Response
    8. {
    9.     "code": 0
    10. }

Check the specified authentication data

Note that the password returned here is the password encrypted using the hash method specified in the configuration file:

  • Clientid

    1. # Request
    2. GET api/v4/auth_clientid/${clientid}
    4. # Response
    5. {
    6.     "code": 0,
    7.     "data": {
    8.         "clientid": "emqx_c",
    9.         "password": "091dc8753347e7dc5d348508fe6323735eecdb84fa800548870158117af8a0c0"
    10.     }
    11. }

  • Username

    1. # Request
    2. GET api/v4/auth_username/${username}
    4. # Response
    5. {
    6.     "code": 0,
    7.     "data": {
    8.         "username": "emqx_u",
    9.         "password": "091dc8753347e7dc5d348508fe6323735eecdb84fa800548870158117af8a0c0"
    10.     }
    11. }

Delete the authentication data

  • Clinetid

    1. # Request
    2. DELETE api/v4/auth_clientid/${clientid}
    4. # Response
    5. {
    6.     "code": 0
    7. }

  • Username

    1. # Request
    2. DELETE api/v4/auth_username/${username}
    4. # Response
    5. {
    6.     "code": 0
    7. }