Multiple agents authentication to MQTT

Question

I am building a small IoT platform. I have a webapp reading data from MongoDB. There is a worker that reads from MQTT and stores the data to mongo.

Until here, all good.

I want to be able to ship an agent to whatever device, be it a RaspberryPi or an Arduino Yún etc. The agent should read/send data from and to the MQTT broker.

Users need to register and add their device on my app before being able to do so. How do I handle authentication correctly? Do I allow anyone to add stuff to mqtt? Do I force devices to authenticate via HTTP on the app first, and then they can use the agent?

Do I go for public key or maybe token authentication? I don't understand therefore I am asking you.

Answer 1

There should be no need to use Authentication via HTTP first for MQTT devices. MQTT supports Authentication which can be linked to ACLs to control what topics a given user/device can publish/subscribe to. Authentication can be user/password at the MQTT protocol level or TLS certificate based the transport level.

Most brokers support wildcard (and variable substitution e.g. {username}) topics in ACLs which allows you to build topic structures that can create topic trees that can only be accessed by a given user.

When a user registers a new device you can have the system either issue a username/password/clientid for that device or a certificate that can be used to uniquely identify the device and attach it to the right ACL structure.

It's hard to answer in a more specific way without knowing more about the sort of information you will be passing round and what sort of MQTT topic structure you intend to use.

Answer 2

Never let "anyone" add stuff via MQTT to a database ;) Once bad data gets into the database, any results from your analysis programs will be skewed at best, or down right wrong at worse. Any time you have MQTT traffic coming from "outside", you want to have a few things in place: DDoS protection so someone can't swamp your database, Topic Validation...is the Topic on the 'Access' list? and Payload validation...should this 3,000 byte payload be allowed in to my MQTT Broker that is normally seeing 50 byte payloads?

To your question; since the user has to register the device before the first MQTT packet is sent, you could use something like a token + SSL for auth & encryption. Your client software asks for the token and its sent as the username or password when it connects with the MQTT broker, and since you generated it ahead of time, the broker can do a quick lookup to make sure its valid and assigned to that agent.

Answer 3

If you do not want to bother with broker yourself and embed any authentication scheme inside it I have solution for you (non commercial, e.g. it is free):

Per each instance of your small IoT platform you need to have separate flespi.io account(we call it customer). Your platform will have in configuration one flespi supertoken (for accessing flespi.io) and is able to create restricted tokens either by using MQTT or HTTP API. Per each device during registration or activation you will issue token with specified ACL that limits sub/pub access only to specified topics.

And token is used by the device for authentication to MQTT broker (see authorization in the middle of the page).

In that scheme you can listen to all published messages from devices and create entries in your database automatically ensuring that they are coming from authenticated (real) devices.