Skip to content

Commit 8a8ee5e

Browse files
prmerger-automator[bot]prmerger-automator[bot]
authored
Merge pull request #298984 from PatAltimore/patricka-release-2504-aio
Add CLI to broker authorization
2 parents 6392f38 + 3fe85a8 commit 8a8ee5e

File tree

1 file changed

+273
-1
lines changed

1 file changed

+273
-1
lines changed

‎articles/iot-operations/manage-mqtt-broker/howto-configure-authorization.md

Lines changed: 273 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ ms.subservice: azure-mqtt-broker
77
ms.topic: how-to
88
ms.custom:
99
- ignite-2023
10-
ms.date: 11/11/2024
10+
ms.date: 04/28/2025
1111

1212
#CustomerIntent: As an operator, I want to configure authorization so that I have secure MQTT broker communications.
1313
ms.service: azure-iot-operations
@@ -43,6 +43,64 @@ The following example shows how to create a BrokerAuthorization resource by usin
4343

4444
:::image type="content" source="media/howto-configure-authorization/authorization-rules.png" alt-text="Screenshot that shows using the Azure portal to create broker authorization rules.":::
4545

46+
# [Azure CLI](#tab/cli)
47+
48+
Use the [az iot ops broker authz apply](/cli/azure/iot/ops/broker/authz#az-iot-ops-broker-authz-apply) command to create or change an authorization policy.
49+
50+
```azurecli
51+
az iot ops broker authz apply --resource-group <ResourceGroupName> --instance <AioInstanceName> --broker <BrokerName> --name <AuthenticationResourceName> --config-file <ConfigFilePathAndName>
52+
```
53+
54+
In this example, assume a configuration file named `my-authz-policy.json` with the following content stored in the user's home directory:
55+
56+
```json
57+
{
58+
"authorizationPolicies": {
59+
"cache": "Enabled",
60+
"rules": [
61+
{
62+
"brokerResources": [
63+
{
64+
"clientIds": [],
65+
"method": "Connect",
66+
"topics": []
67+
},
68+
{
69+
"clientIds": [],
70+
"method": "Publish",
71+
"topics": [
72+
"odd-numbered-orders"
73+
]
74+
},
75+
{
76+
"clientIds": [],
77+
"method": "Subscribe",
78+
"topics": [
79+
"orders"
80+
]
81+
}
82+
],
83+
"principals": {
84+
"attributes": [
85+
{
86+
"group": "authz-sat"
87+
}
88+
],
89+
"clientIds": [],
90+
"usernames": []
91+
}
92+
}
93+
]
94+
}
95+
}
96+
```
97+
98+
An example command to create a new authorization policy named `my-authz-policy` is:
99+
100+
```azurecli
101+
az iot ops broker authn apply --resource-group myResourceGroupName --instance myAioInstanceName --broker default --name my-authz-policy --config-file ~/my-authz-policy.json
102+
```
103+
46104
# [Bicep](#tab/bicep)
47105

48106
To edit an authorization policy, create a `.bicep` file with the following content. Update the settings as needed, and replace the placeholder values like `<AIO_INSTANCE_NAME>` with your own.
@@ -217,6 +275,59 @@ In the broker authorization rules for your authorization policy, use the followi
217275
]
218276
```
219277

278+
# [Azure CLI](#tab/cli)
279+
280+
Use the [az iot ops broker authz apply](/cli/azure/iot/ops/broker/authz#az-iot-ops-broker-authz-apply) command to create or change an authorization policy.
281+
282+
```azurecli
283+
az iot ops broker authz apply --resource-group <ResourceGroupName> --instance <AioInstanceName> --broker <BrokerName> --name <AuthenticationResourceName> --config-file <ConfigFilePathAndName>
284+
```
285+
In the broker authorization rules for your authorization policy, create a configuration file named `client-id-policy.json` with the following configuration stored in the user's home directory:
286+
287+
```json
288+
{
289+
"authorizationPolicies": {
290+
"cache": "Enabled",
291+
"rules": [
292+
{
293+
"brokerResources": [
294+
{
295+
"clientIds": [
296+
"{principal.attributes.building}*"
297+
],
298+
"method": "Connect",
299+
"topics": []
300+
},
301+
{
302+
"clientIds": [],
303+
"method": "Publish",
304+
"topics": [
305+
"sensors/{principal.attributes.building}/{principal.clientId}/telemetry"
306+
]
307+
}
308+
],
309+
"principals": {
310+
"attributes": [
311+
{
312+
"building": "building22"
313+
},
314+
{
315+
"building": "building23"
316+
}
317+
]
318+
}
319+
}
320+
]
321+
}
322+
}
323+
```
324+
325+
An example command to create a new authorization policy named `client-id-authz-policy` is:
326+
327+
```azurecli
328+
az iot ops broker authn apply --resource-group myResourceGroupName --instance myAioInstanceName --broker default --name my-authz-policy --config-file ~/client-id-authz-policy.json
329+
```
330+
220331
# [Bicep](#tab/bicep)
221332

222333
To edit an authorization policy, create a `.bicep` file with the following content. Update the settings as needed, and replace the placeholder values like `<AIO_INSTANCE_NAME>` with your own.
@@ -382,6 +493,64 @@ In the broker authorization rules for your authorization policy, use the followi
382493
]
383494
```
384495

496+
# [Azure CLI](#tab/cli)
497+
498+
Use the [az iot ops broker authz apply](/cli/azure/iot/ops/broker/authz#az-iot-ops-broker-authz-apply) command to create or change an authorization policy.
499+
500+
```azurecli
501+
az iot ops broker authz apply --resource-group <ResourceGroupName> --instance <AioInstanceName> --broker <BrokerName> --name <AuthenticationResourceName> --config-file <ConfigFilePathAndName>
502+
```
503+
504+
In this example, assume a configuration file named `my-authz-policy.json` with the following content stored in the user's home directory:
505+
506+
```json
507+
{
508+
"authorizationPolicies": {
509+
"cache": "Enabled",
510+
"rules": [
511+
{
512+
"brokerResources": [
513+
{
514+
"clientIds": [],
515+
"method": "Connect",
516+
"topics": []
517+
},
518+
{
519+
"clientIds": [],
520+
"method": "Publish",
521+
"topics": [
522+
"odd-numbered-orders"
523+
]
524+
},
525+
{
526+
"clientIds": [],
527+
"method": "Subscribe",
528+
"topics": [
529+
"orders"
530+
]
531+
}
532+
],
533+
"principals": {
534+
"attributes": [
535+
{
536+
"group": "authz-sat"
537+
}
538+
],
539+
"clientIds": [],
540+
"usernames": []
541+
}
542+
}
543+
]
544+
}
545+
}
546+
```
547+
548+
An example command to create a new authorization policy named `my-authz-policy` is:
549+
550+
```azurecli
551+
az iot ops broker authn apply --resource-group myResourceGroupName --instance myAioInstanceName --broker default --name my-authz-policy --config-file ~/my-authz-policy.json
552+
```
553+
385554
# [Bicep](#tab/bicep)
386555

387556
To edit an authorization policy, create a `.bicep` file with the following content. Update the settings as needed, and replace the placeholder values like `<AIO_INSTANCE_NAME>` with your own.
@@ -514,6 +683,22 @@ Include the `stateStoreResources` section in the rules for your authorization po
514683
]
515684
```
516685

686+
# [Azure CLI](#tab/cli)
687+
688+
Include the `stateStoreResources` section in the rules for your authorization policy.
689+
690+
```json
691+
"stateStoreResources": [
692+
{
693+
"method": "", // Values: read, write, readwrite
694+
"keyType": "", //Values: string, pattern, binary. Default is pattern
695+
"keys": [
696+
// List of patterns to match
697+
]
698+
},
699+
]
700+
```
701+
517702
# [Bicep](#tab/bicep)
518703

519704
In Bicep, include the `stateStoreResources` section in your authorization policy.
@@ -643,6 +828,79 @@ In the broker authorization rules for your authorization policy, add a similar c
643828
]
644829
```
645830

831+
# [Azure CLI](#tab/cli)
832+
833+
In this example, assume a configuration file named `state-store-authz-policy.json` in the user's home directory. In the broker authorization rules for your authorization policy, add a similar configuration:
834+
835+
```json
836+
{
837+
"authorizationPolicies": {
838+
"cache": "Enabled",
839+
"rules": [
840+
{
841+
"brokerResources": [
842+
{
843+
"clientIds": [
844+
"{principal.attributes.building}*"
845+
],
846+
"method": "Connect"
847+
},
848+
{
849+
"method": "Publish",
850+
"topics": [
851+
"sensors/{principal.attributes.building}/{principal.clientId}/telemetry/*"
852+
]
853+
},
854+
{
855+
"method": "Subscribe",
856+
"topics": [
857+
"commands/{principal.attributes.organization}"
858+
]
859+
}
860+
],
861+
"principals": {
862+
"attributes": [
863+
{
864+
"building": "17",
865+
"organization": "contoso"
866+
}
867+
],
868+
"usernames": [
869+
"temperature-sensor",
870+
"humidity-sensor"
871+
]
872+
},
873+
"stateStoreResources": [
874+
{
875+
"method": "Read",
876+
"keyType": "Pattern",
877+
"keys": [
878+
"myreadkey",
879+
"myotherkey?",
880+
"mynumerickeysuffix[0-9]",
881+
"clients/{principal.clientId}/*"
882+
]
883+
},
884+
{
885+
"method": "ReadWrite",
886+
"keyType": "Binary",
887+
"keys": [
888+
"xxxxxxxxxxxxxxxxxxxx"
889+
]
890+
}
891+
]
892+
}
893+
]
894+
}
895+
}
896+
```
897+
898+
An example command to create a new authorization policy named `state-store-authz-policy` is:
899+
900+
```azurecli
901+
az iot ops broker authn apply --resource-group myResourceGroupName --instance myAioInstanceName --broker default --name my-authz-policy --config-file ~/state-store-authz-policy.json
902+
```
903+
646904
# [Bicep](#tab/bicep)
647905

648906
To edit an authorization policy, create a `.bicep` file with the following content. Update the settings as needed, and replace the placeholder values like `<AIO_INSTANCE_NAME>` with your own.
@@ -774,6 +1032,20 @@ kubectl edit brokerauthorization my-authz-policies
7741032
1. Select the broker listener you want to edit from the list.
7751033
1. On the port where you want to disable authorization, select **None** in the authorization dropdown.
7761034

1035+
# [Azure CLI](#tab/cli)
1036+
1037+
Use the [az iot ops broker listener port add](/cli/azure/iot/ops/broker/listener#az-iot-ops-broker-listener-port-add) command to disable authorization for a port. To disable authentication, don't include the `--authz-ref` parameter.
1038+
1039+
```azurecli
1040+
az iot ops broker listener port add --resource-group <ResourceGroupName> --instance <AioInstanceName> --broker default --listener <ListenerName> --port <ListenerServicePort>
1041+
```
1042+
1043+
The following example disables authorization for port 8884 to the listener named `aio-broker-loadbalancer`:
1044+
1045+
```azurecli
1046+
az iot ops broker listener port add --resource-group myResourceGroupName --instance myAioInstanceName --broker default --listener aio-broker-loadbalancer --authn-ref default --port 8884
1047+
```
1048+
7771049
# [Bicep](#tab/bicep)
7781050

7791051
To disable authorization, omit `authorizationRef` in the `ports` setting of your BrokerListener resource.

0 commit comments

Comments
 (0)