# JWT Authentication flow - Client credentials grant

**URL:** https://community.hivemq.com/t/jwt-authentication-flow-client-credentials-grant/2493
**Category:** HiveMQ Community Edition
**Created:** [November 15, 2023, 9:10am UTC](https://community.hivemq.com/t/jwt-authentication-flow-client-credentials-grant/2493 "2023-11-15T09:10:16Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![daniel.dg.gutierrez](https://avatars.discourse-cdn.com/v4/letter/d/ea666f/32.png) [@daniel.dg.gutierrez](https://community.hivemq.com/u/daniel.dg.gutierrez)
#### Post date: [November 15, 2023, 9:10am UTC](https://community.hivemq.com/t/jwt-authentication-flow-client-credentials-grant/2493/1 "2023-11-15T09:10:16Z")

</div>

Hi all,

While reading the documentation, it is actually not clear how the `jwt-realm` should be configured in terms of minimum requirements to get the security extension available for Client Credentials grant and without using a SQL Server data storage.

To give you a context, I do have a Federation Server (Ory Hydra) and a Client configured already (Access token generated). Now, it is clear that the extension needs to be a jwt-realm and also specification about jwks and introspection endpoints. The issue for this scenario is that the systems prompts the next:

```auto
2023-11-14 15:22:53,753 INFO - Started HiveMQ Enterprise Security Extension successfully in 202ms.
2023-11-14 15:22:53,753 INFO - Extension "HiveMQ Enterprise Security Extension" version 4.22.0 started successfully.
2023-11-14 15:22:53,755 WARN - No security extension present, MQTT clients can not connect to this broker.

```

I hope i am not too lazy on this, but to be honest i could not found any clear example how can this be configured correctly without using any sql database but only a federation server.

Also, every time I include a pipeline option, it always ask for sql, authentication preprocesor and more you probably know. This happens when using only jwt-authentication-manager.

It is possible you guys can help to get a clear configuration in order to succeed on this for testing purpose before purchasing a Enterprise license?

Thanks in advance.

---

<div class="post-metadata">

### Author: ![Daria\_H](https://avatars.discourse-cdn.com/v4/letter/d/dfb087/32.png) [@Daria\_H](https://community.hivemq.com/u/Daria_H)
#### Post date: [November 15, 2023, 10:40am UTC](https://community.hivemq.com/t/jwt-authentication-flow-client-credentials-grant/2493/2 "2023-11-15T10:40:32Z")

</div>

Hi @daniel.dg.gutierrez ,

For testing purposes, you can get rid of the SQL realm and allow to authorize all authenticated clients:

```auto
<?xml version="1.0" encoding="UTF-8" ?>
<enterprise-security-extension
        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
        xsi:noNamespaceSchemaLocation="config.xsd"
        version="1">
    <realms>
        <!-- a oauth provider-->
        <jwt-realm>
            <name>jwt-provider</name>
            <enabled>true</enabled>
            <configuration>
                <jwks-endpoint>https://jwt-host/keys</jwks-endpoint>
                <introspection-endpoint>https://jwt-host/introspection</introspection-endpoint>
                <simple-auth>
                    <username>hivemq</username>
                    <password>password</password>
                </simple-auth>
            </configuration>
        </jwt-realm>
    </realms>
    <pipelines>
        <!-- secure access to the mqtt broker -->
        <listener-pipeline listener="ALL">
            <!-- authenticate with provided jwts -->
            <jwt-authentication-manager>
                <realm>jwt-provider</realm>
                <jwt-validation>
                    <exp-grace disconnect-after-expiry="true">300</exp-grace>
                </jwt-validation>
            </jwt-authentication-manager>
            <allow-all-authorization-manager />
        </listener-pipeline>
    </pipelines>
</enterprise-security-extension>

```

I hope it helps.  
Kind regards,  
Dasha from HiveMQ Team