Restricting topics to username ?

[Deadman69]

Hello,

I would like to limit my usergroup "user" to access only their specific topic using dynamic-security.json
I have tried something like this

{
  "rolename": "user",
  "acls": [
    {
      "acltype": "publishClientSend",
      "topic": "agents/${username}",
      "priority": 0,
      "allow": true
    },
    {
      "acltype": "publishClientReceive",
      "topic": "agents/${username}",
      "priority": 0,
      "allow": true
    },
    {
      "acltype": "subscribePattern",
      "topic": "agents/${username}",
      "priority": 0,
      "allow": true
    },
    {
      "acltype": "unsubscribePattern",
      "topic": "agents/${username}",
      "priority": 0,
      "allow": true
    }
  ]
}

But it seems this is not possible. I have tried to search for documentation on this subject but i couldn't find anything.

I could create a group for each user restricting to agents/xxxxxxxx but I don't think it would be a good strategy since I will need (at least) a few thousands clients.
Having a group being able to restrict users to their username would be better than creating a lot of groups for me.

Is it possible or should I just allow all my users to read everything and encrypt my messages ? (I am on a semi-public infrastructure).

Thanks

[ckrey]

This is a feature which is already added in the upcoming major release 2.1 see #2222 and #3191

[Daredevll]

I'm facing the same issue (need to dynamically create temp users and in the same time limit thousands of users to their own dedicated topics only). What I'm affraid is as per this comment from the issue @ckrey linked above, the code for that feature is in develop for 4 years already and there's still no 2.1 release rolled out.

Any security or stability concerns regarding what's currently in develop or what's the reason blocking the 2.1 release?

[ralight]

@Daredevll I want to have all the features in place to remove the need for the per_listener_settings option for 2.1, and just haven't had the time to work on it. The code in develop is fine, we use it as the base of the enterprise version of mosquitto provided by Cedalo.