Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Missing authentication support for existing MQTT server #167

Open
MrMep opened this issue Apr 27, 2017 · 7 comments
Open

Missing authentication support for existing MQTT server #167

MrMep opened this issue Apr 27, 2017 · 7 comments

Comments

@MrMep
Copy link

MrMep commented Apr 27, 2017

If I understood well, when told to use a FIND created MQTT server configuration, the server requires user and password authentication and uses them.
But when using an existing MQTT server, user and passwords are ignored (mqtt.go line 33).

thanks,
gl

@schollz
Copy link
Owner

schollz commented May 17, 2017

Sorry, that was my mistake. It should be fixed now

@MrMep
Copy link
Author

MrMep commented May 19, 2017

I'm sorry, but I don't find any related changes in the source, what am I missing?
Perhaps I had to explain myself better. Here's what I did in my installation. I changed line 33 of mqtt.go from:
opts.AddBroker(server).SetClientID(RandStringBytesMaskImprSrc(5)).SetCleanSession(true)
to:
opts.AddBroker(server).SetClientID(RandStringBytesMaskImprSrc(5)).SetCleanSession(true).SetUsername(RuntimeArgs.MqttAdmin).SetPassword(RuntimeArgs.MqttAdminPassword)

so now I can launch find with:
./find -mqtt localhost:1883 -mqttadmin find -mqttadminpass <secret> &

This way I can connect to my existing mosquitto server, authenticating with username (find in my case) and password.
Obviously this isn't a solution, just a workaround. You might want to add two parameters mqttuser and mqttuserpass that are passed to line 33 of mqtt after proper check.
I'm sorry, I would do it myself but I don't know enough neither the project nor go, and you might want to find another solution to this problem.
thanks!

@schollz
Copy link
Owner

schollz commented May 19, 2017

So the whole MQTT thing is a bit of a workaround. The problem was that my server needed to start with the configuration file used by FIND. That configuration file specifies the password file and configuration.

The MQTT on the public server is a little complicated because it allows users to register themselves on the MQTT server. Its pretty hard to do that I've found, so my workaround was to give FIND admin access to MQTT and allow FIND to hot-reload the configuration file.

I'd love to have a better solution to all this, but its tricky because personal users don't really care about having to support a bunch of random people using their MQTT server, whereas I still do :|

@MrMep
Copy link
Author

MrMep commented May 19, 2017

I understand.
But in my personal installation I gave the mosquitto's find user just the privileges to read/write anything under my FIND group topic, something like:
user find topic readwrite myfindgroup/#

That is working well so I think that, if you'd just add support for two additional parameters (mqttuser mqttpass), to be passed optionally only in case of an existing mosquitto service, you would solve a simple but, I guess, common problem:

  • the way FIND is now, it requires an existing mosquitto allowing for anonymous access.
    I think that is rare. I think the most common situation is an existing setup already containing a mosquitto service that is very likely password protected.

I think you could add the management of the two parameters mqttuser and mqtttuserpass to server.go and then, in mqtt.go, line 33, if both parameter are not empty, add them to the options, otherwise not.

What do you think?

@aherbjornsen
Copy link

Having spent a some time struggling with findserver, I can confirm that is an issue for me as well. Patching mqtt.go as outlined above works, but having options for username and password would make much more sense.

@schollz
Copy link
Owner

schollz commented May 24, 2017

@aherbjornsen @MrMep Okay, that sounds good. I'll give it a try myself too and then issue an update!

@fab33
Copy link

fab33 commented Dec 30, 2017

Same problem here. Any news ?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

4 participants