EMQX Per-listener ACL

Starting from 5.9, you can use listener or zone in the rules’ “who” conditions.

In acl.conf

For example, to allow all clients connected from the TCP listener subscribing to the topics starting with their own client ID:

acl.conf

{allow, {listener, {re, "tcp:.+"}}, subscribe, ["${clientid}/#"]}.
{deny, all}.

In builtin DB

Mostly, you’d put generic rules in acl.conf, however, if you insist, you can create generic rules (a.k.a the “All Users” rules), in the builtin DB as well.

Here is an API call example to create a generic rule which allows all clients to subscribe to topic ${clientid}/# IIF the client is connected from a TCP listener.

curl '[<http://my_test_app:my_test_token@localhost:18083/api/v5/authorization/sources/built_in_database/rules/all>](<http://admin:ppp@localhost:18083/api/v5/authorization/sources/built_in_database/rules/all>)' \\
-H 'Accept: application/json, text/plain, */*' \\
-H 'Content-Type: application/json' \\
--data-raw '{"rules":[{"listener_re": "tcp:.+","permission":"allow","action":"subscribe","topic":"${clientid}/#"}]}'

TIP

Run EMQX like this

echo 'my_test_app:my_test_token'>/tmp/emqx-bootstrap-api-keys
export EMQX_API_KEY__BOOTSTRAP_FILE=/tmp/emqx-bootstrap-api-keys
emqx console