# ACL restriction based on clientids

**URL:** https://community.hivemq.com/t/acl-restriction-based-on-clientids/3231
**Category:** HiveMQ Community Edition
**Created:** [September 20, 2024, 2:37pm UTC](https://community.hivemq.com/t/acl-restriction-based-on-clientids/3231 "2024-09-20T14:37:01Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![alexchow](https://avatars.discourse-cdn.com/v4/letter/a/f6c823/32.png) [@alexchow](https://community.hivemq.com/u/alexchow)
#### Post date: [September 20, 2024, 2:37pm UTC](https://community.hivemq.com/t/acl-restriction-based-on-clientids/3231/1 "2024-09-20T14:37:01Z")

</div>

Hello,

Can anyone kindly help me with ACL configuration of HiveMQ community/enterprise edition where we can restrict based on client IDs?

I tested few configurations using the file-rbac-extension, but it just supports defining users and roles and mapping the roles to those users.  
There isn’t a way to map the roles to specific clientIDs, like for example, for clientIDs falling under the regex ^abc-client, I need to control the publish and subscribe - how can I do this?

---

<div class="post-metadata">

### Author: ![Daria\_H](https://avatars.discourse-cdn.com/v4/letter/d/dfb087/32.png) [@Daria\_H](https://community.hivemq.com/u/Daria_H)
#### Post date: [September 20, 2024, 3:41pm UTC](https://community.hivemq.com/t/acl-restriction-based-on-clientids/3231/2 "2024-09-20T15:41:57Z")

</div>

Hi @alexchow,

I hope you’re doing well!

Here’s an example of mapping the current client ID to a permission topic that may help with your implementation:

[GitHub - HiveMQ File RBAC Extension Example](https://github.com/hivemq/hivemq-file-rbac-extension/blob/032e282734144bb008096fc70c00a3e0ef4581ba/src/hivemq-extension/conf/credentials.xml#L31)

Please let me know if this addresses your question and helps with your use case. I’m happy to assist further if needed!

Best regards,  
Dasha from The HiveMQ Team

---

<div class="post-metadata">

### Author: ![alexchow](https://avatars.discourse-cdn.com/v4/letter/a/f6c823/32.png) [@alexchow](https://community.hivemq.com/u/alexchow)
#### Post date: [September 20, 2024, 4:10pm UTC](https://community.hivemq.com/t/acl-restriction-based-on-clientids/3231/3 "2024-09-20T16:10:50Z")

</div>

Hello @Daria_H,  
Thank you for the prompt response.

I understand the configuration provided helps to get the connected clientID and use that in the topic restriction, which I have already done. But this doesn’t address my requirement/issue.

I have below set of permissions defined for a role,

```
        <id>test-role</id>
        <permissions>
            <permission>
                <!-- PUBLISH to pub/# -->
                <topic>pub/#</topic>
                <activity>PUBLISH</activity>
            </permission>
            <permission>
                <!-- SUBSCRIBE to sub/# -->
                <topic>sub/#</topic>
                <activity>SUBSCRIBE</activity>
            </permission>
        </permissions>
    </role>

```

Now, how can I map this role to only a set of clientIDs which falls under a regex pattern, say ^abc-client - meaning, only the clientIDs which starts with abc-client would get this permission/role, other clientIDs shouldn’t get this role/permission even if they use the same username/password.

---

<div class="post-metadata">

### Author: ![Daria\_H](https://avatars.discourse-cdn.com/v4/letter/d/dfb087/32.png) [@Daria\_H](https://community.hivemq.com/u/Daria_H)
#### Post date: [September 23, 2024, 2:35pm UTC](https://community.hivemq.com/t/acl-restriction-based-on-clientids/3231/4 "2024-09-23T14:35:49Z")

</div>

Hi @alexchow

Thank you for your follow-up!

To restrict permissions based on specific client IDs, you can use the HiveMQ File RBAC Extension’s substitution feature. The special markers `${{clientid}}` and `${{username}}` in the topic filter for a permission are automatically replaced by the extension with the client identifier and username of the client for which authorization is performed: [HiveMQ File RBAC Extension - Substitution](https://github.com/hivemq/hivemq-file-rbac-extension?tab=readme-ov-file#substitution).

If you have any further questions or need assistance, please don’t hesitate to reach out!

Best,  
Dasha from The HiveMQ Team