Guidance on what authorization means for MQTT in NMOS Systems #6
Description
IS-05 defines Sender/Receiver transport parameters for MQTT, including broker_authorization, but the definition of that parameter is fairly minimal:
Indication of whether authorization is used for communication with the broker. If the parameter is set to auto the Sender or Receiver should establish for itself whether authorization should be used, based on a discovery mechanism or its own internal configuration.
On the other hand, the MQTT spec, Authentication of Clients by the Server, is also very noncommittal, mentioning multiple possible authorization mechanisms (OAuth 2.0 tokens, client TLS certificates, etc.) as well as the basic username/password option in the CONNECT Packet.
Broker implementations support for these different techniques is variable.
Some guidance in BCP-003-02 would be good... or failing that, at least a statement that it's out of scope, must be configured out-of-band, perhaps with the link to the spec above?