Skip to content

Commit a74dcad

Browse files
xiazhveraxiazhvera
committed
add custom auth signed ample
1 parent bdf98bc commit a74dcad

7 files changed

Lines changed: 577 additions & 5 deletions

File tree

‎samples/mqtt/mqtt5_aws_websocket/main.cpp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -233,7 +233,7 @@ int main(int argc, char *argv[])
233233
});
234234

235235
/* Create Mqtt5Client from the builder */
236-
fprintf(stdout, "Failed to init Mqtt5Client with error code %d: %s\n", LastError(), ErrorDebugString(LastError()));
236+
fprintf(stdout, "==== Starting client ====\n");
237237
std::shared_ptr<Aws::Crt::Mqtt5::Mqtt5Client> client = builder->Build();
238238

239239
if (client == nullptr)

‎samples/mqtt/mqtt5_custom_auth_signed/CMakeLists.txt‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
cmake_minimum_required(VERSION 3.9...3.31)
2+
# note: cxx-17 requires cmake 3.8, cxx-20 requires cmake 3.12
3+
project(mqtt5_custom_auth_signed CXX)
4+
5+
file(GLOB SRC_FILES
6+
"*.cpp"
7+
)
8+
9+
add_executable(${PROJECT_NAME} ${SRC_FILES})
10+
11+
set_target_properties(${PROJECT_NAME} PROPERTIES
12+
CXX_STANDARD 14)
13+
14+
#set warnings
15+
if (MSVC)
16+
target_compile_options(${PROJECT_NAME} PRIVATE /W4 /WX /wd4068)
17+
else ()
18+
target_compile_options(${PROJECT_NAME} PRIVATE -Wall -Wno-long-long -pedantic -Werror)
19+
endif ()
20+
21+
find_package(aws-crt-cpp REQUIRED)
22+
23+
include(AwsSanitizers)
24+
enable_language(C)
25+
aws_add_sanitizers(${PROJECT_NAME})
26+
27+
target_link_libraries(${PROJECT_NAME} PRIVATE AWS::aws-crt-cpp)

‎samples/mqtt/mqtt5_custom_auth_signed/README.md‎

Lines changed: 125 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,125 @@
1+
# MQTT5 Custom Authorizer Signed PubSub
2+
3+
[**Return to main sample list**](../../README.md)
4+
5+
*__Jump To:__*
6+
* [Introduction](#introduction)
7+
* [Requirements](#requirements)
8+
* [How To Build](#how-to-build)
9+
* [How To Run](#how-to-run)
10+
* [Additional Information](#additional-information)
11+
12+
## Introduction
13+
The Custom Authorizer Signed sample illustrate how to connect to the [AWS IoT Message Broker](https://docs.aws.amazon.com/iot/latest/developerguide/iot-message-broker.html) with the MQTT5 Client by authenticating with a signed [Custom Authorizer Lambda Function](https://docs.aws.amazon.com/iot/latest/developerguide/custom-auth-tutorial.html)
14+
15+
You can read more about MQTT5 for the CPP IoT Device SDK V2 in the [MQTT5 user guide](../../../documents/MQTT5_Userguide.md).
16+
17+
## Requirements
18+
19+
You will need to setup your Custom Authorizer so the Lambda function returns a policy document. See [this page on the documentation](https://docs.aws.amazon.com/iot/latest/developerguide/config-custom-auth.html) for more details and example return result. You can customize this lambda function as needed for your application to provide your own security measures based on the needs of your application.
20+
21+
The policy [Policy](https://docs.aws.amazon.com/iot/latest/developerguide/iot-policies.html) provided by your Custom Authorizer Lambda must provide iot connect, subscribe, publish, and receive privileges for this sample to run successfully.
22+
23+
Below is a sample policy that provides the necessary privileges.
24+
25+
<details>
26+
<summary>(see sample policy)</summary>
27+
<pre>
28+
{
29+
"Version": "2012-10-17",
30+
"Statement": [
31+
{
32+
"Effect": "Allow",
33+
"Action": [
34+
"iot:Publish",
35+
"iot:Receive"
36+
],
37+
"Resource": [
38+
"arn:aws:iot:<b>region</b>:<b>account</b>:topic/test/topic"
39+
]
40+
},
41+
{
42+
"Effect": "Allow",
43+
"Action": [
44+
"iot:Subscribe"
45+
],
46+
"Resource": [
47+
"arn:aws:iot:<b>region</b>:<b>account</b>:topicfilter/test/topic"
48+
]
49+
},
50+
{
51+
"Effect": "Allow",
52+
"Action": [
53+
"iot:Connect"
54+
],
55+
"Resource": [
56+
"arn:aws:iot:<b>region</b>:<b>account</b>:client/mqtt5-sample-*"
57+
]
58+
}
59+
]
60+
}
61+
</pre>
62+
63+
Replace with the following with the data from your AWS account:
64+
* `<region>`: The AWS IoT Core region where you created your AWS IoT Core thing you wish to use with this sample. For example `us-east-1`.
65+
* `<account>`: Your AWS IoT Core account ID. This is the set of numbers in the top right next to your AWS account name when using the AWS IoT Core website.
66+
67+
Note that in a real application, you may want to avoid the use of wildcards in your ClientID or use them selectively. Please follow best practices when working with AWS on production applications using the SDK. Also, for the purposes of this sample, please make sure your policy allows a client ID of `mqtt5-sample-*` to connect or use `--client_id <client ID here>` to send the client ID your policy supports.
68+
69+
</details>
70+
71+
## How to build
72+
73+
To build the sample, change directory into the samples, and run the cmake commands
74+
```sh
75+
cd samples/mqtt/mqtt5_custom_auth_signed/
76+
# If you followed the SDK build instruction, you would use the path to `sdk-workspace` folder for `CMAKE_PREFIX_PATH` here
77+
cmake -B build -S . -DCMAKE_PREFIX_PATH="<absolute path sdk-workspace dir>" -DCMAKE_BUILD_TYPE="Debug" .
78+
cmake --build build --config "Debug"
79+
```
80+
81+
## How to run
82+
83+
To Run this sample from the `samples\mqtt\mqtt5_custom_auth_signed` folder, use the following command:
84+
85+
```sh
86+
# For a signed custom authorizer
87+
./mqtt5_custom_auth_signed \
88+
--endpoint <AWS IoT endpoint> \
89+
--authorizer_name <The name of the custom authorizer to connect to invoke> \
90+
--auth_token_key_name <Authorizer token key name> \
91+
--auth_token_key_value <Authorizer token key value> \
92+
--auth_signature <Custom authorizer signature> \
93+
--auth_username <The name to send when connecting through the custom authorizer> \
94+
--auth_password <The password to send when connecting through a custom authorizer>
95+
96+
```
97+
98+
If you would like to see what optional arguments are available, use the `--help` argument:
99+
```sh
100+
./mqtt5_custom_auth_signed --help
101+
```
102+
103+
will result in the following output:
104+
```
105+
MQTT5 Signed Custom Authorizer Sample
106+
options:
107+
--help show this help message and exit
108+
required arguments:
109+
--endpoint IoT endpoint hostname
110+
--authorizer_name The name of the custom authorizer to connect to invoke
111+
--auth_signature Custom authorizer signature
112+
--auth_token_key_name Authorizer token key name
113+
--auth_token_key_value Authorizer token key value
114+
--auth_username The name to send when connecting through the custom authorizer
115+
--auth_password The password to send when connecting through a custom authorizer
116+
optional arguments:
117+
--client_id Client ID (default: mqtt5-sample-<uuid>)
118+
--topic Topic (default: test/topic)
119+
--message Message payload (default: Hello from mqtt5 sample)
120+
--count Messages to publish (0 = infinite) (default: 5)
121+
```
122+
The sample will not run without the required arguments and will notify you of missing arguments.
123+
124+
## Additional Information
125+
Additional help with the MQTT5 Client can be found in the [MQTT5 Userguide](../../../documents/MQTT5_Userguide.md). This guide will provide more details on MQTT5 [operations](../../../documents/MQTT5_Userguide.md#client-operations), [lifecycle events](../../documents/MQTT5_Userguide.md#client-lifecycle-management), [connection methods](../../../documents/MQTT5_Userguide.md#connecting-to-aws-iot-core), and other useful information.

0 commit comments

Comments
 (0)