{"action":"created","issue":{"url":"https://api.github.com/repos/hivemq/hivemq-spi/issues/4","repository_url":"https://api.github.com/repos/hivemq/hivemq-spi","labels_url":"https://api.github.com/repos/hivemq/hivemq-spi/issues/4/labels{/name}","comments_url":"https://api.github.com/repos/hivemq/hivemq-spi/issues/4/comments","events_url":"https://api.github.com/repos/hivemq/hivemq-spi/issues/4/events","html_url":"https://github.com/hivemq/hivemq-spi/issues/4","id":291892923,"node_id":"MDU6SXNzdWUyOTE4OTI5MjM=","number":4,"title":"Last Will of authenticated client affected by permissions for anonymous clients","user":{"login":"Matthimatiker","id":1383323,"node_id":"MDQ6VXNlcjEzODMzMjM=","avatar_url":"https://avatars1.githubusercontent.com/u/1383323?v=4","gravatar_id":"","url":"https://api.github.com/users/Matthimatiker","html_url":"https://github.com/Matthimatiker","followers_url":"https://api.github.com/users/Matthimatiker/followers","following_url":"https://api.github.com/users/Matthimatiker/following{/other_user}","gists_url":"https://api.github.com/users/Matthimatiker/gists{/gist_id}","starred_url":"https://api.github.com/users/Matthimatiker/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Matthimatiker/subscriptions","organizations_url":"https://api.github.com/users/Matthimatiker/orgs","repos_url":"https://api.github.com/users/Matthimatiker/repos","events_url":"https://api.github.com/users/Matthimatiker/events{/privacy}","received_events_url":"https://api.github.com/users/Matthimatiker/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-01-26T12:53:32Z","updated_at":"2018-06-08T11:38:00Z","closed_at":null,"author_association":"NONE","body":"We developed an authentication/authorization plugin for HiveMQ.\r\nIn our authorization callback, we do not grant any permissions if the client is not marked as *authenticated*:\r\n\r\n    public class MyAuthorizationCallback implements OnAuthorizationCallback {\r\n\r\n        @Override\r\n        public List<MqttTopicPermission> getPermissionsForClient(final ClientData clientData) {\r\n            if (!clientData.isAuthenticated()) {\r\n                return Collections.emptyList();\r\n            }\r\n            // [...]\r\n        }\r\n\r\n        // [...]\r\n    }\r\n\r\nWe noticed that a client that is *not* marked as authenticated (although valid credentials were provided) is passed to the authorization callback if a Last Will is provided on connect.\r\nAs shown above, we do not grant any permissions in that case and the client connection is rejected.\r\nIf we grant the permissions regardless of the authentication status, then the connection is accepted.\r\n\r\nWe reproduced that behavior with a plugin based on `hivemq-spi` in version `3.3.0` and HiveMQ brokers in the versions `3.2.8` and `3.3.1`.\r\n\r\nWe checked the [HiveMQ Plugin Developer Guide](https://www.hivemq.com/docs/plugins/latest/), but did not find information regarding that special case.\r\n\r\nWe would have expected an *authenticated* client whose permissions for the Last Will topic are checked.\r\n\r\nAre we using the plugin API in a wrong way or is this a bug? \r\nIf it's not a bug, then additional documentation might help.\r\n\r\nWe are happy to provide additional information if that helps to clarify this case."},"comment":{"url":"https://api.github.com/repos/hivemq/hivemq-spi/issues/comments/395734949","html_url":"https://github.com/hivemq/hivemq-spi/issues/4#issuecomment-395734949","issue_url":"https://api.github.com/repos/hivemq/hivemq-spi/issues/4","id":395734949,"node_id":"MDEyOklzc3VlQ29tbWVudDM5NTczNDk0OQ==","user":{"login":"crmolinaz","id":14848371,"node_id":"MDQ6VXNlcjE0ODQ4Mzcx","avatar_url":"https://avatars1.githubusercontent.com/u/14848371?v=4","gravatar_id":"","url":"https://api.github.com/users/crmolinaz","html_url":"https://github.com/crmolinaz","followers_url":"https://api.github.com/users/crmolinaz/followers","following_url":"https://api.github.com/users/crmolinaz/following{/other_user}","gists_url":"https://api.github.com/users/crmolinaz/gists{/gist_id}","starred_url":"https://api.github.com/users/crmolinaz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/crmolinaz/subscriptions","organizations_url":"https://api.github.com/users/crmolinaz/orgs","repos_url":"https://api.github.com/users/crmolinaz/repos","events_url":"https://api.github.com/users/crmolinaz/events{/privacy}","received_events_url":"https://api.github.com/users/crmolinaz/received_events","type":"User","site_admin":false},"created_at":"2018-06-08T11:38:00Z","updated_at":"2018-06-08T11:38:00Z","author_association":"NONE","body":"The Authentication of clients with LWT can’t be completed until the OnAuthorizationCallback was called. \r\nThe reason for that is that the LWT can’t be checked without the permissions that are set on the OnAuthorizationCallback.\r\n\r\nFor that reason, the “isAuthenticated()” method cannot be used as a qualifier for clients connecting with an LWT."}}
{"actor":{"display_login":"crmolinaz"}}