Mnesia ACL

Mnesia ACL 使用 EMQX 内置的 Mnesia 数据库存储 ACL 规则，可以存储数据、动态管理 ACL，方便与外部设备管理系统集成

插件：

emqx_auth_mnesia

ACL 规则结构体

{
    "username":"emqx",
    "clientid":"client1",
    "topic":"testtopic/1",
    "action":"pub",
    "access": "allow"
}

规则字段说明：

• clientid：客户端的 Client ID.
• username: 客户端的 Username.
• topic：控制的主题，可以使用通配符，并且可以在主题中加入占位符来匹配客户端信息，例如 t/%c 则在匹配时主题将会替换为当前客户端的 Client ID
  • %u：用户名
  • %c：Client ID
• action：操作行为，可选值：pub | sub | pubsub
• Access：是否允许，可选值：allow | deny

username和clientid是可选的，当两个都没有提供时，该规则适用于所有的客户端

Mnesia ACL 默认不设规则，你可以使用 HTTP API 和 emqx_ctl 管理 ACL 规则。

使用 HTTP API 管理 ACL 规则

添加 ACL 规则

• Clientid ACL：

  # Request
  POST api/v4/acl
  {
    "clientid":"emqx_c",
    "topic":"Topic/A",
    "action":"pub",
    "access": "allow"
  }
  # Response
  {
      "data": {
          "clientid":"emqx_c",
          "topic":"Topic/A",
          "action":"pub",
          "access": "allow"
          "result": "ok"
      },
      "code": 0
  }

• Username ACL：

  # Request
  POST api/v4/acl
  {
    "username":"emqx_u",
    "topic":"Topic/A",
    "action":"pub",
    "access": "allow"
  }
  # Response
  {
      "data": {
          "username":"emqx_u",
          "topic":"Topic/A",
          "action":"pub",
          "access": "allow"
          "result": "ok"
      },
      "code": 0
  }

• $all ACL:

  # Request
  POST api/v4/acl
  {
    "topic":"Topic/A",
    "action":"pub",
    "access": "allow"
  }
  # Response
  {
      "data": {
          "all": "$all",
          "topic":"Topic/A",
          "action":"pub",
          "access": "allow"
          "result": "ok"
      },
      "code": 0
  }

批量添加 ACL 规则

# Request
POST api/v4/acl
[
  {
    "clientid":"emqx_c_1",
    "topic":"Topic/A",
    "action":"pub",
    "access": "allow"
  },
  {
    "username":"emqx_u_1",
    "topic":"Topic/A",
    "action":"sub",
    "access": "allow"
  },
  {
    "topic":"Topic/+",
    "action":"pubsub",
    "access": "deny"
  }
]
# Response
{
    "data": [
      {
        "clientid":"emqx_c_1",
        "topic":"Topic/A",
        "action":"pub",
        "access": "allow",
        "result": "ok"
      },
      {
        "username":"emqx_u_1",
        "topic":"Topic/A",
        "action":"pub",
        "access": "allow"
        "result": "ok"
      },
      {
        "all": "$all",
        "topic":"Topic/+",
        "action":"pubsub",
        "access": "deny"
      },
    ],
    "code": 0
}

查看已经添加的 ACL 规则

• Clientid ACL：

  # Request
  GET api/v4/acl/clientid
  # Response
  {
    "meta": {
      "page": 1,
      "limit": 10,
      "count": 1
    },
    "data": [
      {
        "clientid": "emqx_c",
        "topic": "Topic/A",
        "action": "pub",
        "access": "allow"
      },
      {
        "clientid": "emqx_c_1",
        "topic": "Topic/A",
        "action": "pub",
        "access": "allow"
      },
      {
        "clientid": "emqx_c_2",
        "topic": "Topic/A",
        "action": "pub",
        "access": "allow"
      }
    ],
    "code": 0
  }

• Username ACL：

  # Request
  GET api/v4/acl/username
  # Response
  {
    "meta": {
      "page": 1,
      "limit": 10,
      "count": 1
    },
    "data": [
      {
        "username": "emqx_u",
        "topic": "Topic/A",
        "action": "pub",
        "access": "allow"
      },
      {
        "username": "emqx_u_1",
        "topic": "Topic/A",
        "action": "pub",
        "access": "allow"
      },
      {
        "username": "emqx_u_2",
        "topic": "Topic/A",
        "action": "pub",
        "access": "allow"
      }
    ],
    "code": 0
  }

• $all ACL：

  # Request
  GET api/v4/acl/$all
  # Response
  {
    "meta": {
      "page": 1,
      "limit": 10,
      "count": 1
    },
    "data": [
      {
        "all": "$all",
        "topic": "Topic/A",
        "action": "pub",
        "access": "allow"
      },
      {
        "all": "$all",
        "topic": "Topic/+",
        "action": "pubsub",
        "access": "deny"
      }
    ],
    "code": 0
  }

查看指定 ACL 规则

• Clientid ACL:

  # Request
  GET api/v4/acl/clientid/emqx_c
  # Response
  {
      "data": [
        {
          "topic": "Topic/A",
          "clientid": "emqx_c",
          "access": "allow",
          "action": "pub"
        },
        {
          "topic": "Topic/B",
          "clientid": "emqx_c",
          "access": "allow",
          "action": "pub"
        }
      ],
      "code": 0
  }

• Username ACL:

  # Request
  GET api/v4/acl/username/emqx_u
  # Response
  {
      "data": [
        {
          "topic": "Topic/A",
          "username": "emqx_u",
          "access": "allow",
          "action": "pub"
        },
        {
          "topic": "Topic/B",
          "username": "emqx_u",
          "access": "allow",
          "action": "pub"
        }
      ],
      "code": 0
  }

删除 ACL 规则

• Client ACL

  # Request
  # 请注意 ${topic} 需要使用 UrlEncode 编码
  DELETE api/v4/acl/clientid/${clientid}/topic/${topic}
  # Response
  {
      "code": 0
  }

• Username ACL

  # Request
  # 请注意 ${topic} 需要使用 UrlEncode 编码
  DELETE api/v4/acl/username/${username}/topic/${topic}
  # Response
  {
      "code": 0
  }

• $all ACL

  # Request
  # 请注意 ${topic} 需要使用 UrlEncode 编码
  DELETE api/v4/acl/$all/topic/${topic}
  # Response
  {
      "code": 0
  }