Strange behavior with mysql backend about mosquitto-go-auth HOT 4 CLOSED

Are you setting allow_anonymous true at mosquitto's conf while setting up the plugin too? Because in that case I think mosquitto would let anonymous clients connect, but the plugin doesn't allow anonymous users and thus neither authenticates nor authorizes them. Also, this scenario would be backend independent, i.e., it has nothing to do with the mysql one.

I've thought about including support for anonymous users, but I fail to see the advantage over some default restricted user that every client could use instead of connecting anonymously. Do you have a use case for supporting them?

from mosquitto-go-auth.

Thank you. I find out that allow_anonymous false should be set explicitly for disabling connection from anonymous user.
Sorry for the title that says "strange behavior with mysql backend". I should investigate more deeply.

Also I have a question about the anonymous user, what you means is that creating a user account for anonymous connection and set some acl rules on this user?

from mosquitto-go-auth.

If you check mosquitto's conf man page, you'll see that static ACLs may mention rules for anonymous users:

The first set of topics are applied to anonymous clients, assuming allow_anonymous is true.

The thing is these general rules are achievable with some default user, e.g. every client that's granted general permissions should connect with username <insert-your-desired-default-here>, and you can throw those rules in your ACLs file under that name and you are done. The benefit is that I don't have to define anonymous users semantics for the rest of the backends. I certainly could, I think jpmen's plugin does by passing a default anonymous user with username anonymous (or something like that, I'd have to check) when an anonymous user is checked for ACLs, but that means the backends need to actually define rules for the user with username anonymous, which would be the same as connecting with username anonymous instead of just connecting anonymously (i.e., without username).

So until now I just went with this default: anonymous users won't get authenticated nor authorized. It's simple and understandable (I mean, you are using an auth plugin, that means you want to control what clients can do), and there's the obvious workaround of telling clients to use a default username for general stuff.

The downside is that it's not consistent with mosquitto's default behaviour, which is why I've considered adding support for anonymous users. I think I probably will when I get the time, it's just not a priority right now. So let's leave this issue open as a reminder that I should do something about it.

from mosquitto-go-auth.

Going against my words, I'll close this because I believe the easy workaround fits better the idea of having "anonymous" clients. But still, I'd love to see you argue against it! Just let me know.

from mosquitto-go-auth.