Page History

Prerequisites

• Knowledge of Ignition and Module installation process: Cirrus Link Module Installation
• Have Ignition 8.0.16 or greater installed
• Have MQTT Distributor 4.0.10 or later installed

Abstract

Access Control Lists (ACLs) control what topics a given username/password pair is allowed to publish and subscribe on. ACLs should be designed with a 'principal of least privilege' model while also considering device management and maintenance.  For example gateways and devices in the field should be limited to publishing and subscribing only on the topics for which they should be expected to.  The same should be true of 'consumer' applications that will be either sending commands to devices in the field or consuming data coming from those devices.

...

topic = The topic or wildcard topic representing the scope of the privilege

Examples

RW #

• This allows clients connecting using this username/password to publish and subscribe on any topic

...

If MQTT Engine or MQTT Transmission client attempts to subscribe on a topic that is not allowed by the ACL for that client, the connection will fail and the client will not attempt to reconnect.

For example with With the following ACL, the Transmission client is not able to subscribe to the NCMD and DCMD topics

 R spBv1.0/My MQTT Group/NDEATH/PLC 1, W # 

...

If MQTT Engine or MQTT Transmission client attempts to publish on a topic that is not allowed by the ACL for that client, the connection will be forcefully closed and the client will attempt to reconnect.

For example with With the following ACL, the Transmission client can publish the NBIRTH for PLC 1 but is not able to publish the DBIRTH for edge node device D1

R #, W spBv1.0/My MQTT Group/+/PLC 1

For example with With the following ACL, the MQTT Engine client is not able to send a rebirth request

R #, W spBv1.0/STATE/MyPrimaryHost, W spBv1.0/My MQTT Group/NDEATH/#, W 

Image Added

Connect using a LWT not allowed by the ACL

With the following ACL, the Transmission client My MQTT Group/PLC 1 is able to connect and subscribe but client My MQTT Group/PLC 2 is not authorized to connect with the LWT of spBv1.0/My

...

MQTT

...

Group/NDEATH/PLC 2.

R NBIRTH/#, W spBv1.0/My MQTT Group/DBIRTH+/PLC 1/#

Image RemovedImage Added

Additional Resources

...