Abstract

This page describes how MQTT Engine and MQTT Transmission configurations interact using the Ignition Security Context to inhibit write commands to tags by unauthorized users. 

When using Ignition Security context, the user authorization is encrypted and included with the published write event message from MQTT Engine. At MQTT Transmission, if the user is authorized to write to the tag, this results in a successful write, and the tag change is published. If the user is not authorized to write to the tag, there is no action taken. 

Review the Standard Tag Properties table for details on setting the Security property.  

MQTT Engine Configuration

In the Ignition Gateway web UI, navigate to the MQTT Engine Settings in the left side bar. From the Main tab, set the following elements in the Command Setting section.

• Select checkbox Include Security Context in write command to be validated at the Edge Node
  
  
• Select the Security Context Hashing Algorithm algorithm to use when encrypting the Security Context. Options include SHA_1, SHA_224, SHA_256, SHA_384 and SHA_512
  
  
• Select checkbox Change Password? and set the Password to be used when encrypting the Security Context
  
  

MQTT Transmission Configuration

In the Ignition Gateway web UI, navigate to the MQTT Transmission Settings in the left side bar. From the Transmitters tab, for each transmitter set the following elements in the Command Setting section.

• Select checkbox Validate Security Context in to validate the security context in write command
  
  

• Select the Security Context Hashing Algorithm algorithm to use when decrypting the Security Context. 
  
  

• Select checkbox Change Password? and set the Password to be used when encrypting the Security Context

  
  

  The Security Context Hashing Algorithm and the Password must be the SAME as configured at MQTT Engine.

  
  

  Block Commands must be de-selected for the Validate Security Context feature to be enabled