How to configure emqx-auth-username plugin correctly (RELEASE 3.1)

mbenitod commented 5 years ago

Hello: I have upgraded from version 2.3 to release 3.1. In version 2.3 the plugin worked fine, and now in release 3.1 it doesn't work or I don't know how to configure it.

In version 2.3 I configured the plugin like this:

In emqx.conf: allow_anonymous = false
In emqx_auth_username.conf: auth.user.1.username = peter auth.user.1.password = pass1 auth.user.2.username = sophie auth.user.2.password = pass2
Loaded the plugin, restart and worked well

BUT:

In release 3.1 I configured the plugin like this:

In emqx.conf: allow_anonymous = false
In emqx_auth_username.conf:

## Password hash. ## ## Value: plain | md5 | sha | sha256 auth.user.password_hash = plain auth.user.1.username = peter auth.user.1.password = pass1 auth.user.2.username = sophie auth.user.2.password = pass2
Loaded the plugin, restart and doesn't work.

The error is: [error] You've tried to set auth.user.1.username, but there is no setting with that name. [error] Did you mean one of these? [error] auth.mysql.username [error] auth.pgsql.username [error] mqtt.sn.username [error] You've tried to set auth.user.1.password, but there is no setting with that name. [error] Did you mean one of these? ...

Please, how is the plugin configured correctly? I can't find information on how to do it.

Thanks for your support.

HJianBo commented 5 years ago

Hi, @mbenitod Sorry about that. We have removed the feature of configuring default username in the emqx_auth_username.conf file after v3.1-rc.2 version.

Now, you can manage the username items by CLI or REST API after loaded emqx_auth_username plugin:

i.e:

$ ./bin/emqx_ctl users

users list                                      # List users
users add <Username> <Password>                 # Add User
users update <Username> <NewPassword>           # Update User
users del <Username>                            # Delete User

mbenitod commented 5 years ago

Thank you so much for your attention. Your reply has helped me a lot. I tried the plugin and it works perfectly. Thank you. Good job!

brunocpadua commented 5 years ago

Hello,

I'm using EMQ inside a Docker container, and after you have removed the feature of configuring default username in the emqx_auth_username.conf, how to migrate the username/password set by CLI or REST API from an old container to a new container or a new Docker image version? Is there any file where this information is being saved?

Thanks!

HJianBo commented 5 years ago

Sorry, it gets trouble to you.

Maybe you can modify the start.sh of docker to call the CLI to add usernames after the emqx_auth_username started successfully.

aisven commented 5 years ago

I do not understand why one would remove this feature. I am not in favor of creating my own Docker Image just to add these users. They were so nicely add-able via mapped Docker Volume.

As in a docker-compose.yml it could have looked like this, a perfectly valid solution: - ./local/users/emqx_auth_username.conf:/opt/emqx/etc/plugins/emqx_auth_username.conf

AaronAutomation commented 5 years ago

Did anyone find a solution for this with Docker? I wasted hours before finding this thread... surely someone has come up with a solution for running EMQX in Docker and set anonymous connections to false. I'm pretty green unfortunately, will keep working on this in the meantime though.

emqplus commented 5 years ago

@AaronAutomation I reopened the issue first.

rasaffie commented 4 years ago

@AaronAutomation You need to create users by console:

docker-compose exec emqx /opt/emqx/bin/emqx_ctl users add $username $password

with your username and password (assuming that your docker service is called emqx).

Also, you may need to wait for EMQX to start before executing it.

rasaffie commented 4 years ago

My previous answer works for v3.2.2, but not for v3.2.5. In v3.2.5 the configuration with environment variable EMQX_ALLOW_ANONYMUS=false is not working: the server allows all connections. Is this change on purpose? I think it's a breaking change that should not be at a patch level.

Also, could you add a CHANGELOG.md to this repo? It's tedious to keep bumping on these changes.

AaronAutomation commented 4 years ago

Thanks rasaffie - I added the username/passwords to my start.sh file and rebuilt my own image. I was looking to test a scalable solution which wouldn't require creating username and passwords after emqx was running. You mentioned EMQX_ALLOW_ANONYMUS=false wasn't working in v3.2.5, I just wanted to note that there was a typo there and hopefully that wasn't the cause of your issue.

rasaffie commented 4 years ago

@AaronAutomation You are right, there is a typo in my configurations, my bad.

However it still does not work as expected: when I try to create users in v3.2.5 I get the message Node '[...]' not responding to pings instead of ok like when using v3.2.2. The server is running because in the output it prints the refused connections for the users. Also, it is strange that even with the typo in v3.2.2 connections without authentication are refused (maybe the default value for this configuration changed).

For creating users in a scalable way you can use something like wait-for-it or sleep before executing the commands. I think it's a messy solution and I would prefer to create users as it was before with the emqx_auth_username.conf file, but it's a work around.

HJianBo commented 4 years ago

Hi, guys. Thanks for your contributions! After our team discussion, we have restored this feature at v3.2.7. we have released it today

So, the feature is unavailable between v3.1.0-rc.2 - v3.2.6. I'm very sorry it gets trouble for you :(