Enterprise security extension sql based realm does not work, the broker allows unauthenticated users and unauthorized clients to publish/subscribe topics

22

Should the password in the option be the plain password?
Should the password in the database be the hashed value?

The table schema is id, username, password, salt, iteraction, hash_algorithm. That is the schema from the documentation. The column salt, iteraction, hash_algorithm can not be null by the documentation.

23

Hi @lllle

Thank you for your inquiry and for seeking clarification on the password configurations in our C# application and ESE database.

To address your questions:

  1. Should the password in the option be the plain password?
  • Yes, that is correct.
  1. Should the password in the database be the hashed value?
  • Yes, it should be stored as a hashed value in the database.

I would like to provide additional information based on our documentation. If the interaction is not specified, the default value is 100, and if the hash_algorithm is not specified, SHA256 is used by default. Therefore, if you did not explicitly specify these values, the system defaults would have been applied.

Considering the defaults, I understand that replicating the same hash might be challenging. To assist you better, could you please share the parameters you used to generate the password hash?

Best,
Dasha from HiveMQ Team

25

There is only hivemq-ese-helper.jar file under the $HIVEMQ_HOME/extensions/hivemq-enterprise-security-extension/helper/jvm. I am not with my company computer now, with MacBook, I can not open the file, so I could not check the example.

27

Hello @lllle,

I hope this message finds you well.

I wanted to provide additional information about the ESE Helper tool. Its main functionalities include generating password hashes or creating insert statements for the ESE database.

If the tool is not currently on your laptop, you can easily obtain it by downloading the HiveMQ broker distribution from HiveMQ Download. Once downloaded, unzip the package and locate the ESE Helper tool in $HIVEMQ_HOME/extensions/hivemq-enterprise-security-extension/helper.

It’s important to note that the MQTT client should not encode the password; rather, it should use the plain text password. For a practical example, please refer to https://www.hivemq.com/article/how-to-build-dot-net-iot-application-using-c-sharp-mqtt-client/ · GitHub.

If you encounter any uncertainties, you can test connectivity by attempting to connect with the same username and password using an alternative client, such as MQTT.fx (Download – Softblade) or MQTT-CLI (Home - MQTT CLI).

If you have any further questions or need assistance, please don’t hesitate to ask. I’m here to help.

Best regards,
Dasha from HiveMQ Team

29

Thanks Daria!

Now we have tried jwt, file and sql base realm authentication. All work as expected. Now we can demo them to the team.

Regards,
Lejuan

30

Hi Daria,

Can you tell me how to get the hashed password with docker? The broker is from the cloud, we are using the docker to make the hivemq run.

31

Hi @lllle

to provide you with an accurate solution, could you please provide more details about the specific challenges you’re encountering? What are you trying to do regarding the hashed password in docker, what is your expectation and what is actual result.

Looking forward to helping you resolve this matter.

Best regards,
Dasha from HiveMQ Team