MQTT and Certificates

[JimmyBjorklund]

Hi I am looking to see if i can replace out mqtt servers with nats servers, but in order to do this i need to be able to setup the
topics so that clients only can subscribe to /client/clientId/>, where clientId is the common name of the client certificate.
I cannot figure out how to do this in the config or if its even possible.
If any one know its possible or if it impossible it would be greate to know ;)
Thanks

[derekcollison]

How is the NATS system configured? Is it in operator mode or simple server config mode?

If server config and authorization is based in user/pass you can just the normal authorization blocks for NATS server configs.

[derekcollison]

For anything elaborate that ties client certs etc to permissions, we have a feature in 2.10 called authorization callouts that allows mapping exterior AuthN to NATS authZ.

The general ADRs for future (and past) features in NATS can be found here -> https://github.com/nats-io/nats-architecture-and-design

This specific one is here -> https://github.com/nats-io/nats-architecture-and-design/blob/main/adr/ADR-26.md

[JimmyBjorklund]

The original server have client server cert and in the client cert the common namn is used as username

[derekcollison]

This may help as well.

https://docs.nats.io/running-a-nats-service/configuration/securing_nats/auth_intro/tls_mutual_auth#mapping-client-certificates-to-a-user

[JimmyBjorklund]

Is there a generic way, e.g not to have to configure all users in advance but to say user=CN and then in the subscribe and publish section use something like
publish = ["$MQTT.client.$user.sub.>"]
subscribe = ["$MQTT.client.$user.sub.>"]

in mosquito this would be
pattern readwrite client/%u/#

[derekcollison]

Not directly at this time but we are working with some customers on features they may want.

[JimmyBjorklund]

Thanks for good support.