Contents
Cirrus Link Resources
Chariot MQTT Server v1 (previous version)
Cirrus Link Modules for Ignition
Contact Us (Sales/Support)
Forum
Page History
...
LDAP Schema Object Classes
| Name | Identifier | Type | Description |
|---|---|---|---|
cls-mqttCredential | 1.3.6.1.4.1.60051.2.2.1 | Auxiliary | This class represents ACLs associate with an MQTT client. It may include one or more of either of the attributes cls-subTopicFilter or cls-pubTopicFilter |
LDAP Schema Attributes
| Name | Identifier | Description |
|---|---|---|
cls-subTopicFilter | 1.3.6.1.4.1.60051.2.1.1 | An MQTT topic filter to subscribe on |
cls-pubTopicFilter | 1.3.6.1.4.1.60051.2.1.2 | An MQTT topic filter to publish on |
Chariot Configuration
The following configuration file must be manually added to configure LDAP authentication and authorization in the MQTT server:
conf/com.cirruslink.chariot.server.auth.ldap.configExample (OpenDJ) LDAP configuration:
| No Format |
|---|
usernameAttributeName="uid"
subTopicAttributeName="cls-subTopicFilter"
pubTopicAttributeName="cls-pubTopicFilter"
credentialObjectClassName="cls-mqttCredential"
baseDn="dc=cirruslink,dc=com"
url="ldap://localhost:389"
username="cn=chariot"
password="123456"
aclCheckInterval="10000" |
Example Microsoft Active Directory configuration:
...
MQTT Credentials LDAP configuration can be found by navigating to the following page on the Chariot UI and selecting the LDAP tab:
CONFIGURATION → MQTT Credentials
The configuration fields are described below. Note that the format of the attributes and object class name might differ in the configuration than the name in the schema (as is the case with Microsoft Active Directory). An administrator for the LDAP directory server should be consulted to fill in the correct values for the configuration (see examples below).
LDAP auth configuration properties:
| Property | Required | Default | Description |
|---|---|---|---|
| usernameAttributeName | yes | The attribute of an entry that represents the username of the MQTT client to authenticate | |
| subTopicAttributeName | yes | The multivalued attribute of an entry that represents a subscription topic filters | |
| pubTopicAttributeName | yes | The multivalued attribute of an entry that represents a publish topic filters | |
| credentialObjectClassName | yes | The ObjectClass of an entry that holds the credentials |
| host | yes | The URL of the LDAP server |
| sysUsername | yes | The distinguished name (DN) that Chariot uses to authenticate with the LDAP server | |
| password | yes | The password that Chariot uses to authenticate with the LDAP server | |
| baseDn | yes | The base distinguished name (DN) where entries used for ACLs will be searched for | |
| aclCheckInterval | yes | The interval (in ms) between ACL updates |
Additionally the Chariot MQTT server must be configured to use the LDAP authentication instead of the internal MQTT Credentials. This can be done by manually editing the following configuration file:
...
LDAP Realm configuration properties:
| Property | Required | Default | Description |
|---|---|---|---|
| authenticationService.target | yes | (type=default) | The Authentication Service target must be set to "(type=ldap)" |
| authorizationService.target | yes | (type=default) | The Authorization Service target must be set to "(type=ldap)" |
Examples
Example Microsoft Active Directory configuration:
Example (OpenDJ) LDAP configuration:
Overview
Content Tools