feat: Support username/password for local broker authentication by rina23q · Pull Request #3823 · thin-edge/thin-edge.io

rina23q · 2025-10-17T16:13:31Z

Proposed changes

Support username/password authentication to the MQTT local broker.

Prepare a /etc/tedge/.password file. The first line is read as the password.

testpassword

Then, configure these parameters.

tedge config set mqtt.client.auth.username testuser
tedge config set mqtt.client.auth.password_file /etc/tedge/.password

If encrypted connection is activated in the broker, configure any secure port (e.g. 8883) and give the CA certificate file or the directory (below is example)

tedge config set mqtt.client.port 8883
tedge config set mqtt.client.auth.ca_file /etc/mosquitto/certs/ca.crt

Todo:

Confirm tedge mqtt pub/sub works
Confirm tedge-agent & tedge-mapper-c8y work with mosquitto bridge
Confirm tedge-agent & tedge-mapper-c8y works with build-in bridge
Confirm it works with non-c8y cloud
Write system tests
Extend the user guide

Types of changes

Bugfix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)
Improvement (general improvements like code refactoring that doesn't explicitly fix a bug or add any new functionality)
Documentation Update (if none of the other choices apply)
Breaking change (fix or feature that would cause existing functionality to not work as expected)

Paste Link to the issue

#3807

Checklist

I have read the CONTRIBUTING doc
I have signed the CLA (in all commits with git commit -s. You can activate automatic signing by running just prepare-dev once)
I ran just format as mentioned in CODING_GUIDELINES
I used just check as mentioned in CODING_GUIDELINES
I have added tests that prove my fix is effective or that my feature works
I have added necessary documentation (if appropriate)

Further comments

codecov · 2025-10-17T16:26:12Z

Codecov Report

❌ Patch coverage is 29.71014% with 97 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
crates/common/mqtt_channel/src/config.rs	18.98%	60 Missing and 4 partials ⚠️
..._config/src/tedge_toml/tedge_config/mqtt_config.rs	44.18%	20 Missing and 4 partials ⚠️
crates/extensions/tedge_mqtt_bridge/src/lib.rs	50.00%	3 Missing and 3 partials ⚠️
crates/core/tedge/src/cli/mqtt/cli.rs	50.00%	1 Missing ⚠️
crates/core/tedge/src/cli/mqtt/publish.rs	0.00%	0 Missing and 1 partial ⚠️
crates/core/tedge/src/cli/mqtt/subscribe.rs	0.00%	1 Missing ⚠️

📢 Thoughts on this report? Let us know!

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

rina23q · 2025-10-21T15:04:52Z

crates/common/mqtt_channel/src/config.rs

+        None => Err(CertificateError::IoError {
+            path: path.as_ref().to_owned(),
+            error: std::io::Error::other("File content is empty"),
+        }),


This error has to be removed as the MQTT specification states that you can send a username without password. However, both username and password are required for MqttOptions::set_credentials() in rumqttc, so I'm not sure how empty password is addressed in rumqttc.

I checked how MqttOptions::set_cedentials() behaves in the packet level.

In the MQTT specs level, there are username flag and password flag. So, "empty password" and "password not set" are different. The former, the password flag is set but password is empty string. The latter, the password flag itself isn't set.

"Empty password" exmaple:

mosquitto_pub -h 127.0.0.1 -u testuser -P "" -t test -p 1883 -m message

"Password not set" example:

mosquitto_pub -h 127.0.0.1 -u testuser -t test -p 1883 -m message

Back to rumqttc. Their API offers only set_credentials(username, password). I provided the empty string to the second argument as below.

mqttoptions.set_credentials("username", "");

Then, I ran the rumqttc client and confirmed the password flag was not set in the CONNECT packet. This means, rumqttc treats "empty password" equals to "password not set".

crates/common/mqtt_channel/src/config.rs

crates/common/tedge_config/src/tedge_toml/tedge_config/mqtt_config.rs

crates/extensions/tedge_mqtt_bridge/src/lib.rs

crates/core/tedge/src/cli/mqtt/subscribe.rs

github-actions · 2025-10-22T16:22:29Z

Robot Results

✅ Passed	❌ Failed	⏭️ Skipped	Total	Pass %	⏱️ Duration
729	0	3	729	100	2h12m5.466814s

docs/src/operate/security/mqtt-tls-configuration.md

tests/RobotFramework/tests/mqtt/local_broker_authentication/local_broker_authentication.robot

crates/common/mqtt_channel/src/config.rs

crates/core/tedge/src/cli/mqtt/publish.rs

crates/extensions/tedge_mqtt_bridge/src/lib.rs

crates/common/mqtt_channel/src/config.rs

crates/common/mqtt_channel/src/lib.rs

didier-wenzek · 2025-10-28T09:55:00Z

crates/core/tedge/src/cli/mqtt/publish.rs

-    if let Some(client_auth) = cmd.client_auth_config.as_ref() {
-        config.with_client_auth(&client_auth.cert_file, &client_auth.key_file)?;
-    }
+    config.with_client_auth(cmd.auth_config.clone().try_into()?)?;


This is a nice improvement.

docs/src/operate/security/mqtt-tls-configuration.md

Signed-off-by: Rina Fujino <rina.fujino.23@gmail.com>

Since thin-edge#3823, an inappropriate warning is printed when a non-TLS connection is established to the local broker: $ tedge mqtt sub te/# 2025-11-18T14:47:04.179834205Z WARN MQTT: Connecting on port 1883 for insecure MQTT using a TLS connection This warning is inappropriate because the connection is *not* established over TLS: neither a client certificate nor root certificates have been configured. Signed-off-by: Didier Wenzek <didier.wenzek@free.fr>

rina23q had a problem deploying to Test Pull Request October 17, 2025 16:13 — with GitHub Actions Failure

rina23q had a problem deploying to Test Pull Request October 20, 2025 18:29 — with GitHub Actions Failure

rina23q had a problem deploying to Test Pull Request October 20, 2025 19:25 — with GitHub Actions Failure

rina23q commented Oct 21, 2025

View reviewed changes

didier-wenzek reviewed Oct 22, 2025

View reviewed changes

rina23q force-pushed the feature/3807/support-local-client-username-password-authentication branch from 4a67eee to f3adf15 Compare October 22, 2025 15:44

rina23q temporarily deployed to Test Pull Request October 22, 2025 15:44 — with GitHub Actions Inactive

rina23q temporarily deployed to Test Auto October 22, 2025 16:02 — with GitHub Actions Inactive

rina23q had a problem deploying to Test Pull Request October 23, 2025 12:31 — with GitHub Actions Failure

rina23q marked this pull request as ready for review October 23, 2025 12:33

rina23q requested review from a team, albinsuresh, jarhodes314 and reubenmiller as code owners October 23, 2025 12:33

rina23q force-pushed the feature/3807/support-local-client-username-password-authentication branch from 0f9b7df to 34b2eab Compare October 23, 2025 13:16

rina23q had a problem deploying to Test Pull Request October 23, 2025 13:16 — with GitHub Actions Failure

rina23q temporarily deployed to Test Pull Request October 23, 2025 19:55 — with GitHub Actions Inactive

rina23q temporarily deployed to Test Auto October 24, 2025 07:10 — with GitHub Actions Inactive

albinsuresh reviewed Oct 24, 2025

View reviewed changes

rina23q temporarily deployed to Test Pull Request October 27, 2025 14:56 — with GitHub Actions Inactive

rina23q temporarily deployed to Test Auto October 27, 2025 15:11 — with GitHub Actions Inactive

rina23q commented Oct 27, 2025

View reviewed changes

crates/extensions/tedge_mqtt_bridge/src/lib.rs Outdated Show resolved Hide resolved

rina23q had a problem deploying to Test Pull Request October 27, 2025 16:12 — with GitHub Actions Failure

rina23q had a problem deploying to Test Pull Request October 27, 2025 16:25 — with GitHub Actions Failure

rina23q temporarily deployed to Test Pull Request October 27, 2025 16:58 — with GitHub Actions Inactive

rina23q temporarily deployed to Test Auto October 27, 2025 17:08 — with GitHub Actions Inactive

albinsuresh approved these changes Oct 28, 2025

View reviewed changes

crates/common/mqtt_channel/src/config.rs Outdated Show resolved Hide resolved

didier-wenzek reviewed Oct 28, 2025

View reviewed changes

rina23q mentioned this pull request Oct 28, 2025

Add an option to tedge connect to prevent listener creation #3837

Closed

rina23q force-pushed the feature/3807/support-local-client-username-password-authentication branch from 3fa0c0d to 306da78 Compare October 29, 2025 09:18

rina23q temporarily deployed to Test Pull Request October 29, 2025 09:18 — with GitHub Actions Inactive

rina23q temporarily deployed to Test Auto October 29, 2025 09:29 — with GitHub Actions Inactive

rina23q had a problem deploying to Test Pull Request October 29, 2025 11:10 — with GitHub Actions Failure

didier-wenzek reviewed Oct 29, 2025

View reviewed changes

docs/src/operate/security/mqtt-tls-configuration.md Outdated Show resolved Hide resolved

rina23q force-pushed the feature/3807/support-local-client-username-password-authentication branch from 27d1ab5 to cb4c337 Compare October 29, 2025 14:20

rina23q temporarily deployed to Test Pull Request October 29, 2025 14:20 — with GitHub Actions Inactive

rina23q had a problem deploying to Test Auto October 29, 2025 14:31 — with GitHub Actions Failure

rina23q enabled auto-merge October 29, 2025 14:38

rina23q temporarily deployed to Test Auto October 29, 2025 15:03 — with GitHub Actions Inactive

rina23q added this pull request to the merge queue Oct 29, 2025

github-merge-queue bot removed this pull request from the merge queue due to no response for status checks Oct 29, 2025

rina23q added this pull request to the merge queue Oct 30, 2025

github-merge-queue bot removed this pull request from the merge queue due to no response for status checks Oct 30, 2025

rina23q added this pull request to the merge queue Oct 30, 2025

github-merge-queue bot removed this pull request from the merge queue due to no response for status checks Oct 30, 2025

rina23q added 3 commits October 30, 2025 12:55

feat: Support username/password local broker authentication

f1ffcc6

Signed-off-by: Rina Fujino <rina.fujino.23@gmail.com>

test: Add local broker username/password auth system test

fcf3dc3

Signed-off-by: Rina Fujino <rina.fujino.23@gmail.com>

doc: describe username/password authentication in the user guide

eb289af

Signed-off-by: Rina Fujino <rina.fujino.23@gmail.com>

rina23q force-pushed the feature/3807/support-local-client-username-password-authentication branch from cb4c337 to eb289af Compare October 30, 2025 12:55

rina23q temporarily deployed to Test Pull Request October 30, 2025 12:55 — with GitHub Actions Inactive

rina23q temporarily deployed to Test Auto October 30, 2025 13:05 — with GitHub Actions Inactive

rina23q added this pull request to the merge queue Oct 30, 2025

Merged via the queue into thin-edge:main with commit 05dafb6 Oct 30, 2025
34 checks passed

rina23q deleted the feature/3807/support-local-client-username-password-authentication branch October 30, 2025 14:07

rina23q mentioned this pull request Oct 31, 2025

fix: rephrase the debug message of client username authentication #3845

Merged

11 tasks

didier-wenzek mentioned this pull request Nov 18, 2025

fix: remove inappropriate warning on MQTT connect #3867

Merged

11 tasks

Conversation

rina23q commented Oct 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Proposed changes

Types of changes

Paste Link to the issue

Checklist

Further comments

Uh oh!

codecov bot commented Oct 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

rina23q Oct 21, 2025

Choose a reason for hiding this comment

Uh oh!

rina23q Oct 24, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions bot commented Oct 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Robot Results

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

didier-wenzek Oct 28, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

rina23q commented Oct 17, 2025 •

edited

Loading

codecov bot commented Oct 17, 2025 •

edited

Loading

rina23q Oct 24, 2025 •

edited

Loading

github-actions bot commented Oct 22, 2025 •

edited

Loading