{"id":21580724,"url":"https://github.com/wiomoc/mosquitto-jwt-auth","last_synced_at":"2025-07-27T07:09:08.284Z","repository":{"id":57640405,"uuid":"199079088","full_name":"wiomoc/mosquitto-jwt-auth","owner":"wiomoc","description":"Mosquitto Auth Plugin which enables authentication via JWTs and authorisation via ACLs stored in JWT claims","archived":false,"fork":false,"pushed_at":"2023-01-03T10:04:35.000Z","size":41,"stargazers_count":47,"open_issues_count":8,"forks_count":13,"subscribers_count":4,"default_branch":"master","last_synced_at":"2025-07-09T10:49:11.485Z","etag":null,"topics":["jwt","mosquitto","mqtt","security"],"latest_commit_sha":null,"homepage":"","language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/wiomoc.png","metadata":{"files":{"readme":"Readme.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2019-07-26T20:56:52.000Z","updated_at":"2025-06-14T21:21:40.000Z","dependencies_parsed_at":"2023-02-01T05:46:28.452Z","dependency_job_id":null,"html_url":"https://github.com/wiomoc/mosquitto-jwt-auth","commit_stats":null,"previous_names":[],"tags_count":4,"template":false,"template_full_name":null,"purl":"pkg:github/wiomoc/mosquitto-jwt-auth","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/wiomoc%2Fmosquitto-jwt-auth","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/wiomoc%2Fmosquitto-jwt-auth/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/wiomoc%2Fmosquitto-jwt-auth/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/wiomoc%2Fmosquitto-jwt-auth/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/wiomoc","download_url":"https://codeload.github.com/wiomoc/mosquitto-jwt-auth/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/wiomoc%2Fmosquitto-jwt-auth/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":267320259,"owners_count":24068527,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-07-27T02:00:11.917Z","response_time":82,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["jwt","mosquitto","mqtt","security"],"created_at":"2024-11-24T14:09:31.731Z","updated_at":"2025-07-27T07:09:08.264Z","avatar_url":"https://github.com/wiomoc.png","language":"Rust","funding_links":[],"categories":[],"sub_categories":[],"readme":"# mosquitto-jwt-auth\n\n![Build](https://github.com/wiomoc/mosquitto-jwt-auth/actions/workflows/build.yml/badge.svg)\n[![Coverage Status](https://coveralls.io/repos/github/wiomoc/mosquitto-jwt-auth/badge.svg)](https://coveralls.io/github/wiomoc/mosquitto-jwt-auth)\n\nSimple Plugin for Mosquitto which enables authentication and authorisation via JWT as MQTT password.\n\nRequires at least Mosquitto v1.6.3. Tested on Mac OS and Linux.\n\n## Building\n**Prebuild** version for Linux is available [here](https://github.com/wiomoc/mosquitto-jwt-auth/releases/latest)\n\n1. If not done yet, [install Rust](https://www.rust-lang.org/tools/install)\n2. Clone `git clone git@github.com:wiomoc/mosquitto-jwt-auth.git`\n3. Build `cargo build --release`, on success plugin should be located at `target/release/libmosquitto_jwt_auth.so`\n\n## Configuration\nOne could choose between the basic JWT validation and the more advanced JWKS validation.\n### Basic JWT validation\nTo enable this, the configuration property `auth_opt_jwt_alg` has to be set to the desired JWT / JWS algorithm.\nThe key to validate the JWT could be supplied over various ways:\n* in a file: `auth_opt_jwt_sec_file` has to be set to the filename containing the key\n* over an environment variable: `auth_opt_jwt_sec_env` has to be set to name of the environment variable\n* directly in the config: `auth_opt_jwt_sec_base64` has to be set to the base64 encoded key\nIf a asymmetric algorithm is used (eg. `RS256` or `ES256`) the key has to be given in DER format. \n\n### JWKS validation\nTo enable this, the configuration property `auth_opt_jwt_jwks_file` has to be set to the filename\ncontaining the JWK set. Note that both the JWK and the JWT have to have the keyid (`kid`) set.\n\n#### Key rotation\nIf you want to implement key rotation you can update this file using a external program regularly\nand reload the plugin by sending a `SIGHUP` to the mosquitto process.\n\nExample intergrated in crontab using curl:\n````shell\n*/10 * * * * curl -o mosquitto_jwks.json https://my-idp.com/jwks.json \u0026\u0026 killall -SIGHUP mosquitto\n````\n\n### Properties\n`auth_plugin` should point to the path of `libmosquitto_jwt_auth.so`\n\n| Property           | Valid values | Usage |\n|--------------------|------|-------|\n| `auth_opt_jwt_alg` | `HS256`, `HS384`, `HS512`, `ES256`, `ES384`, `RS256`, `RS384`, `RS512`, `PS256`, `PS384`, `PS512`| Sets the algorithm of the JWT signature |\n| `auth_opt_jwt_sec_file` | `\u003cpath to file\u003e` | Path to the file which contains the secret used for verification of the signature.|\n| `auth_opt_jwt_sec_env` | `\u003cenviroment variable name\u003e` | Name of the environment variable which contains the base64 encoded key used for verification of the signature. |\n| `auth_opt_jwt_sec_base64` | `\u003cbase64-encoded-secret\u003e` | Base64 encoded key used for verification of the signature. |\n| `auth_opt_jwt_jwks_file` | `\u003cpath to file\u003e` | Path to the file which contains a JWK set. |\n| `auth_opt_jwt_validate_exp` | _(default)_ `true`, `false` | `true` if the `exp` claim / the expiry date of the JWT should be validated |\n| `auth_opt_jwt_validate_sub_match_username` | _(default)_ `true`, `false` | `true` if the MQTT username has to be the same as specified in the `sub` claim |\n\n## Custom Claims\nThe plugin authorizes subscriptions and publications based on the acl stated in JWT claims.\n\n* `publ` _(Optional)_ Contains the Topics(filters) the client is allowed to publish in\n* `subs` _(Optional)_ Contains the Topics(filters) the client is allowed to subscribe to\n\n\n      {\n        \"sub\": \"mqttUser\",\n        \"iat\": 1516239022,\n        \"exp\": 1616239022,\n        \"subs\": [\"/+/topic\", \"/abc/#\"],\n        \"publ\": [\"/abc\"]\n      }\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fwiomoc%2Fmosquitto-jwt-auth","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fwiomoc%2Fmosquitto-jwt-auth","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fwiomoc%2Fmosquitto-jwt-auth/lists"}