Authorization Options for Your HiveMQ Extension

public class MySimpleAuthenticator implements SimpleAuthenticator {

    @Override
    public void onConnect(@NotNull final SimpleAuthInput simpleAuthInput, @NotNull final SimpleAuthOutput simpleAuthOutput) {

        //Get the default permissions from the output
        final ModifiableDefaultPermissions defaultPermissions = simpleAuthOutput.getDefaultPermissions();

        //create a PUBLISH permission for topic "allowed/topic"
        final TopicPermission permission = Builders.topicPermission()
                .topicFilter("allowed/topic")
                .qos(TopicPermission.Qos.ALL)
                .activity(TopicPermission.MqttActivity.PUBLISH)
                .type(TopicPermission.PermissionType.ALLOW
                .retain(TopicPermission.Retain.ALL)
                .build();

        //add the permission to the default permissions for this client
        defaultPermissions.add(permission);

        //authenticate the client successfully
        simpleAuthOutput.authenticateSuccessfully();
    }

}

public class MyClientInitializer implements ClientInitializer {

        @Override
        public void initialize(@NotNull final InitializerInput initializerInput, @NotNull final ClientContext clientContext) {

            //Get the default permissions from the clientContext
            final ModifiableDefaultPermissions defaultPermissions = clientContext.getDefaultPermissions();

            //Get the client identifier from the input
            final String clientId = initializerInput.getClientInformation().getClientId();

            //create a permission for all topics starting with the client identifier
            final TopicPermission clientIdPermission = Builders.topicPermission()
                    .topicFilter(clientId + "/#")
                    .build();

            defaultPermissions.add(clientIdPermission);
        }
    }

public class MyClientInitializer implements ClientInitializer {

        @Override
        public void initialize(@NotNull final InitializerInput initializerInput, @NotNull final ClientContext clientContext) {

            //Get the default permissions from the clientContext
            final ModifiableDefaultPermissions defaultPermissions = clientContext.getDefaultPermissions();

            final TopicPermission adminPermission = Builders.topicPermission()
                    .topicFilter("admin/#")
                    //set the type to deny to deny every action that matches the topic filter "admin/#"
                    .type(TopicPermission.PermissionType.DENY)
                    .build();

            defaultPermissions.add(adminPermission);

            //change the default behaviour to ALLOW, so all other topics are allowed
            defaultPermissions.setDefaultBehaviour(DefaultAuthorizationBehaviour.ALLOW);
        }
    }

public class MyPublishAuthorizer implements PublishAuthorizer {

    @Override
    public void authorizePublish(final @NotNull PublishAuthorizerInput input, final @NotNull PublishAuthorizerOutput output) {

        //get the PUBLISH packet contents
        final PublishPacket publishPacket = input.getPublishPacket();

        //allow every Topic Filter starting with "admin"
        if (publishPacket.getTopic().startsWith("admin")) {
            output.authorizeSuccessfully();
            return;
        }

        //disallow publishes to forbidden topics
        if (publishPacket.getTopic().startsWith("forbidden")) {
            output.failAuthorization();
            return;
        }

        //get the user properties from the PUBLISH packet
        final UserProperties userProperties = publishPacket.getUserProperties();

        //disconnect all clients with a user property "notallowed" set.
        if (userProperties.getFirst("notallowed").isPresent()) {
            //Use a custom reason code and reason string for the server sent DISCONNECT
            output.disconnectClient(DisconnectReasonCode.ADMINISTRATIVE_ACTION, "User property not allowed");
            return;
        }

        //otherwise let the other extension or default permissions decide
        output.nextExtensionOrDefault();

    }
}

public class MyAsyncPublishAuthorizer implements PublishAuthorizer {

    @Override
    public void authorizePublish(final @NotNull PublishAuthorizerInput input, final @NotNull PublishAuthorizerOutput output) {

        //get the managed extension executor service
        final ManagedExtensionExecutorService extensionExecutorService = Services.extensionExecutorService();

        //make the output async with a timeout of 2 seconds
        final Async<PublishAuthorizerOutput> async = output.async(Duration.ofSeconds(2));

        //submit a task to the extension executor
        extensionExecutorService.submit(new Runnable() {
            @Override
            public void run() {

                //call an external service to decide the outcome
                final boolean result = callExternalTaks();

                if (result) {
                    output.authorizeSuccessfully();
                } else {
                    output.failAuthorization();
                }

                //Always resume the async output, otherwise it will time out
                async.resume();
            }
        });

    }
}

public class MySubscriptionAuthorizer implements SubscriptionAuthorizer {

        @Override
        public void authorizeSubscribe(@NotNull final SubscriptionAuthorizerInput input, @NotNull final SubscriptionAuthorizerOutput output) {

            //allow every Topic Filter starting with "admin"
            if (input.getSubscription().getTopicFilter().startsWith("admin")) {
                output.authorizeSuccessfully();
                return;
            }

            //disallow a shared subscription
            if (input.getTopicFilter().startsWith("$shared")) {
                output.failAuthorization();
                return;
            }

            //get the user properties from the SUBSCRIBE packet
            final UserProperties userProperties = input.getUserProperties();

            //disconnect all clients with a user property "notallowed" set.
            if (userProperties.getFirst("notallowed").isPresent()) {
                //Use a custom reason code and reason string for the server sent DISCONNECT
                output.disconnectClient(DisconnectReasonCode.ADMINISTRATIVE_ACTION, "User property not allowed");
                return;
            }

            //otherwise let the other extension or default permissions decide
            output.nextExtensionOrDefault();
        }
    }

public class MyAsyncSubscriptionAuthorizer implements SubscriptionAuthorizer {

    @Override
    public void authorizeSubscribe(@NotNull final SubscriptionAuthorizerInput input, @NotNull final SubscriptionAuthorizerOutput output) {

        //get the managed extension executor service
        final ManagedExtensionExecutorService extensionExecutorService = Services.extensionExecutorService();

        //make the output async with a timeout of 2 seconds
        final Async<SubscriptionAuthorizerOutput> async = output.async(Duration.ofSeconds(2));

        //submit a task to the extension executor
        extensionExecutorService.submit(new Runnable() {
            @Override
            public void run() {

                //call an external service to decide the outcome
                final boolean result = callExternalTaks();

                if (result) {
                    output.authorizeSuccessfully();
                } else {
                    output.failAuthorization();
                }

                //Always resume the async output, otherwise it will time out
                async.resume();
            }
        });

    }
}