Access Management Options per Cloud Subscription Plan

Username and password

Client certificates (X.509 / mTLS)

JSON Web Tokens (JWT)

iss

Issuer: Identifies the principal that issued the token.

sub

Subject: Identifies the principal that is the subject of the token.

aud

Audience — identifies the recipients that the token is intended for.

iat

Issued at: The time at which the token was issued.

exp

Expiration time: The time after which the token must not be accepted.

scope

Scope: Specifies the access scope the token grants.

Default permissions (Publish Only, Subscribe Only, Publish and Subscribe)

Custom permissions (user-defined topic filters)

Permissions assigned directly to a credential

Role-based access control (RBAC) (permissions grouped into roles)

Multiple roles per credential

Dynamic topic variables in permission topic filters

Topic Filter

Yes

Any valid MQTT topic filter. Wildcards + (single level) and # (multi-level) are supported.

Activity

Yes

One or both of: Publish, Subscribe.

QoS levels

Yes

One or more of: QoS 0, QoS 1, QoS 2. The permission applies only to the selected levels.

Retained messages

No

Whether the client may publish retained messages. Applies to publish permissions only.

Shared subscription group

No

Whether the client may join a shared subscription. If enabled, specify a group name or # to match all groups. Applies to subscribe permissions only.

${mqtt-clientid}

Any method

The MQTT client ID from the CONNECT packet.

${mqtt-username}

Username and password

The username from the CONNECT packet.

${string-sub}

JWT

The sub claim from the validated JWT.

${string-aud}

JWT

The aud claim from the validated JWT.

${string-iss}

JWT

The iss claim from the validated JWT.

${string-scope}

JWT

The scope claim from the validated JWT.

${string-subject-common-name}

Client certificate

The Common Name (CN) from the certificate subject field.

${string-issuer-common-name}

Client certificate

The Common Name (CN) from the certificate issuer field.

Credential changes (add or remove)

Permission changes

Role changes