{"action":"created","issue":{"url":"https://api.github.com/repos/jpmens/mosquitto-auth-plug/issues/180","repository_url":"https://api.github.com/repos/jpmens/mosquitto-auth-plug","labels_url":"https://api.github.com/repos/jpmens/mosquitto-auth-plug/issues/180/labels{/name}","comments_url":"https://api.github.com/repos/jpmens/mosquitto-auth-plug/issues/180/comments","events_url":"https://api.github.com/repos/jpmens/mosquitto-auth-plug/issues/180/events","html_url":"https://github.com/jpmens/mosquitto-auth-plug/issues/180","id":194385499,"number":180,"title":"ACL Check with JWT backend","user":{"login":"Tryforce","id":13351403,"avatar_url":"https://avatars.githubusercontent.com/u/13351403?v=3","gravatar_id":"","url":"https://api.github.com/users/Tryforce","html_url":"https://github.com/Tryforce","followers_url":"https://api.github.com/users/Tryforce/followers","following_url":"https://api.github.com/users/Tryforce/following{/other_user}","gists_url":"https://api.github.com/users/Tryforce/gists{/gist_id}","starred_url":"https://api.github.com/users/Tryforce/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Tryforce/subscriptions","organizations_url":"https://api.github.com/users/Tryforce/orgs","repos_url":"https://api.github.com/users/Tryforce/repos","events_url":"https://api.github.com/users/Tryforce/events{/privacy}","received_events_url":"https://api.github.com/users/Tryforce/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2016-12-08T16:44:57Z","updated_at":"2016-12-08T17:19:35Z","closed_at":null,"body":"I have a RESTful API running express.js that is catching the different routes for my user/superuser/acl checks.\r\nMosquitto doesn't seem to be running the aclcheck to the uri that I have configured here:\r\n\r\n```\r\nauth_plugin /home/kyle/Documents/mqtt2/mosquitto-auth-plug-master/auth-plug.so\r\nauth_opt_backends jwt\r\nauth_opt_http_ip localhost\r\nauth_opt_http_port 8085\r\nauth_opt_http_getuser_uri /auth\r\nauth_opt_http_superuser_uri /superuser\r\nauth_opt_http_aclcheck_uri /acl\r\n```\r\n\r\nThe auth check works fine.  I am passing a token as my username when I connect and decoding it, checking for a username, and responding with a 200 status code, obviously just for testing purposes, it's extremely simple:\r\n(in my /auth path)\r\n\r\n```\r\nauth: function(req, res) {\r\n        var token = req.headers.authorization.substr(req.headers.authorization.indexOf(' ') + 1);\r\n        var decoded = jwtDecode(token);\r\n        if (decoded.username != null) {\r\n            res.json(200);\r\n        }\r\n    }\r\n```\r\n\r\nThis seems to work fine:\r\n\r\n```\r\n1481214677: Config loaded from /home/kyle/Documents/mqtt2/mosquitto-1.4.10/mosquitto.conf.\r\n1481214677: |-- *** auth-plug: startup\r\n1481214677: |-- ** Configured order: jwt\r\n\r\n1481214677: |-- with_tls=false\r\n1481214677: |-- getuser_uri=/auth\r\n1481214677: |-- superuser_uri=/superuser\r\n1481214677: |-- aclcheck_uri=/acl\r\n1481214677: |-- getuser_params=(null)\r\n1481214677: |-- superuser_params=(null)\r\n1481214677: |-- aclcheck_paramsi=(null)\r\n1481214677: Opening websockets listen socket on port 1883.\r\n1481214679: |-- mosquitto_auth_unpwd_check(eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJleHAiOjE0ODE4MTY5NjE5NzIsInVzZXJuYW1lIjoia3lsZWJha2VyMTdAZ21haWwuY29tIiwidXNlcl9pZCI6NjYsImN1c3RvbWVyX2lkIjozNn0.hp8ie3atkHLB84XBzqN6HblHEqmvzQR0w-ER3dkl5Wo)\r\n1481214679: |-- ** checking backend jwt\r\n1481214679: |-- url=http://localhost:8085/auth\r\n1481214679: |-- data=topic=&acc=-1&clientid=\r\n1481214679: |-- getuser(eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJleHAiOjE0ODE4MTY5NjE5NzIsInVzZXJuYW1lIjoia3lsZWJha2VyMTdAZ21haWwuY29tIiwidXNlcl9pZCI6NjYsImN1c3RvbWVyX2lkIjozNn0.hp8ie3atkHLB84XBzqN6HblHEqmvzQR0w-ER3dkl5Wo) AUTHENTICATED=1 by jwt\r\n1481214679: New client connected from 10.10.10.18 as mqttjs_e3767eae (c1, k60, u'eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJleHAiOjE0ODE4MTY5NjE5NzIsInVzZXJuYW1lIjoia3lsZWJha2VyMTdAZ21haWwuY29tIiwidXNlcl9pZCI6NjYsImN1c3RvbWVyX2lkIjozNn0.hp8ie3atkHLB84XBzqN6HblHEqmvzQR0w-ER3dkl5Wo').\r\n\r\n```\r\n\r\nHowever, when we try to subscribe, no where does the aclcheck (/acl) get called:\r\n\r\n```\r\n1481214679: Sending CONNACK to mqttjs_e3767eae (0, 0)\r\n1481214680: Received SUBSCRIBE from mqttjs_e3767eae\r\n1481214680: \t/mrs/cgw/+/gps (QoS 0)\r\n1481214680: mqttjs_e3767eae 0 /mrs/cgw/+/gps\r\n1481214680: Sending SUBACK to mqttjs_e3767eae\r\n1481214680: Socket error on client mqttjs_e3767eae, disconnecting.\r\n\r\n```\r\n\r\nIt gets the subscription request and (tries to) send back immediately, without running through my API to do the acl check. Am I missing something?\r\n"},"comment":{"url":"https://api.github.com/repos/jpmens/mosquitto-auth-plug/issues/comments/265798579","html_url":"https://github.com/jpmens/mosquitto-auth-plug/issues/180#issuecomment-265798579","issue_url":"https://api.github.com/repos/jpmens/mosquitto-auth-plug/issues/180","id":265798579,"user":{"login":"PierreF","id":359833,"avatar_url":"https://avatars.githubusercontent.com/u/359833?v=3","gravatar_id":"","url":"https://api.github.com/users/PierreF","html_url":"https://github.com/PierreF","followers_url":"https://api.github.com/users/PierreF/followers","following_url":"https://api.github.com/users/PierreF/following{/other_user}","gists_url":"https://api.github.com/users/PierreF/gists{/gist_id}","starred_url":"https://api.github.com/users/PierreF/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/PierreF/subscriptions","organizations_url":"https://api.github.com/users/PierreF/orgs","repos_url":"https://api.github.com/users/PierreF/repos","events_url":"https://api.github.com/users/PierreF/events{/privacy}","received_events_url":"https://api.github.com/users/PierreF/received_events","type":"User","site_admin":false},"created_at":"2016-12-08T17:19:35Z","updated_at":"2016-12-08T17:19:35Z","body":"From a quick look to Mosquitto code, Mosquitto do ACL check when sending/receiving message, not on subscribe.\r\nYou could always subscribe to any topic, but if ACL deny it, you won't receive anything.\r\n\r\nACL will be checked when you sent a message, and 2 times:\r\n\r\n* One ACL check that the sender is allowed to sent on the topic\r\n* One ACL check that the subscriber is allowed to read from the topic\r\n\r\nNote that mosquitto-auth-plug does some caching, so this won't happen for each message."}}
{"actor":{"display_login":"PierreF"}}