Skip to content

Adding new means for brigde authentication.#3436

Open
ThorstenWendt-TP wants to merge 1 commit intoeclipse-mosquitto:developfrom
ThorstenWendt-TP:develop
Open

Adding new means for brigde authentication.#3436
ThorstenWendt-TP wants to merge 1 commit intoeclipse-mosquitto:developfrom
ThorstenWendt-TP:develop

Conversation

@ThorstenWendt-TP
Copy link

This patch introduces a new way to provide credentials for bridge authentication.

Currently the only way to provide bridge authentication credentials is to set remote_username and remote_password in the configuration file. There was no other way to provide these credentials.

But for example on some platforms these credentials are stored in a TPM. There is no direct way to pull these credentials from TPM and use it for bridge authentication.

With this patch these credentials can be provided by a plugin that yields username/password on bridge setup and will be used for broker authentication. Customers can provide this plugin without publishing their source code.

For more details see: doc/brigde-authentication-by-plugin.md

Thank you for contributing your time to the Mosquitto project!

Before you go any further, please note that we cannot accept contributions if
you haven't signed the Eclipse Contributor Agreement.
If you aren't able to do that, or just don't want to, please describe your bug
fix/feature change in an issue. For simple bug fixes it is can be just as easy
for us to be told about the problem and then go fix it directly.

Then please check the following list of things we ask for in your pull request:

  • Have you signed the Eclipse Contributor Agreement, using the same email address as you used in your commits?
  • Do each of your commits have a "Signed-off-by" line, with the correct email address? Use "git commit -s" to generate this line for you.
  • If you are contributing a new feature, is your work based off the develop branch?
  • If you are contributing a bugfix, is your work based off the fixes branch?
  • Have you added an explanation of what your changes do and why you'd like us to include them?
  • Have you successfully run make test with your changes locally?

@ralight
Copy link
Contributor

ralight commented Jan 7, 2026

@ThorstenWendt-TP I like the ldea of this! Thank you for including tests and documentation as well, that's very refreshing.

Could you please check that you used the same email address to sign the Eclipse ECA as you used in the commit? It's currently saying you aren't covered and I can't accept a change like this without that.

@ThorstenWendt-TP
Copy link
Author

ThorstenWendt-TP commented Jan 7, 2026

I'm happy you like the idea. Thank you very much.

The email address is the same but I had to choose different user names (eclipse don't accept capital letters and special character ;).
I provide a link between my eclipse foundation account and my github accout. Does it work right now? Can you check that, please.

@ralight
Copy link
Contributor

ralight commented Jan 7, 2026

When I try and manually do a check it's returning an error, so perhaps the check service isn't working properly at the moment. I'll report it to Eclipse

@ralight
Copy link
Contributor

ralight commented Jan 7, 2026

Ok, I've checked by creating a fresh account that hasn't signed the ECA and it generates the same error. I also guessed your eclipse account username and it gives the same error - so could you please recheck that the ECA is showing as signed in your account?

@codecov
Copy link

codecov bot commented Jan 7, 2026

Codecov Report

❌ Patch coverage is 16.66667% with 25 lines in your changes missing coverage. Please review.

Files with missing lines Patch % Lines
src/bridge.c 19.23% 21 Missing ⚠️
src/plugin_callbacks.c 0.00% 4 Missing ⚠️
Files with missing lines Coverage Δ
src/plugin_callbacks.c 86.56% <0.00%> (-1.76%) ⬇️
src/bridge.c 70.48% <19.23%> (-3.06%) ⬇️

... and 1 file with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@ThorstenWendt-TP
Copy link
Author

You are right. I forgot to submit my Eclipse Contributor Agreement. Sorry for that

This patch introduces a new way to provide credentials for bridge
authentication.

Currently the only way to provide bridge authentication credentials
is to set remote_username and remote_password in the configuration
file. There was no other way to provide these credentials.

But for example on some platforms these credentials are stored in
a TPM. There is no direct way to pull these credentials from TPM and
use it for bridge authentication.

With this patch these credentials can be provided by a plugin that
yields username/password on bridge setup and will be used for
broker authentication. Customers can provide this plugin
without publishing their source code.

For more details see: doc/brigde-authentication-by-plugin.md

Signed-off-by: Thorsten Wendt <thorsten.wendt@ebblo.com>
@ThorstenWendt-TP
Copy link
Author

Our company changed it's name from Trapezegroup to ebblo, hence I updated copyrights, emails, ...

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants