EMQX重启后设置的客户端认证失效

emqx版本:5.3.1-alpha.1
现象:在Dashboard中设置了客户端认证,使用mysql,设置后认证是正常。但是如果重启emqx后,发现客户端认证失效,任何用户名密码都可以连接,在Dashboard中查看数据源状态连接正常,启用状态也是打开的,但是如果把设置删除重新创建一下又正常了,试了很多遍都是这样,找不到问题所在,请帮忙研究一下。(PS:同样使用mysql+ACL设置的客户端授权的配置,重启后是正常的。)

其中emqx.conf的内容如下:

NOTE:

This config file overrides data/configs/cluster.hocon,

and is merged with environment variables which start with ‘EMQX_’ prefix.

Config changes made from EMQX dashboard UI, management HTTP API, or CLI

are stored in data/configs/cluster.hocon.

To avoid confusion, please do not store the same configs in both files.

See Configuration Files | EMQX 5.0 Documentation for more details.

Configuration full example can be found in etc/examples

node {
name = “emqx@127.0.0.1
cookie = “emqxsecretcookie”
data_dir = “/var/lib/emqx”
}

cluster {
name = emqxcl
discovery_strategy = manual
}

dashboard {
listeners.http {
bind = 18083
}
}

另一个文件cluster.hocon的内容如下:
authentication = [
{
backend = mysql
database = iotdb
mechanism = password_based
password = “1212”
password_hash_algorithm {name = sha256, salt_position = suffix}
pool_size = 8
query = “SELECT password_hash, salt FROM mqtt_user where username = ${username} LIMIT 1”
query_timeout = 5s
server = “127.0.0.1:3306”
ssl {enable = false, verify = verify_peer}
username = root
}
]
authorization {
cache {
enable = true
max_size = 32
ttl = 1m
}
deny_action = ignore
no_match = allow
sources = [
{
database = iotdb
password = “1212”
pool_size = 8
query = “SELECT action, permission, topic FROM mqtt_acl where username = ${username}”
server = “127.0.0.1:3306”
ssl {enable = false, verify = verify_peer}
type = mysql
username = root
},
{
enable = true
path = “/var/lib/emqx/authz/acl.conf”
type = file
}
]
}
flapping_detect {
ban_time = 5m
enable = true
max_count = 15
window_time = 1m
}

是否是使用 docker 进行部署的?
使用 docker 进行部署的话,需要映射 etc data 这两个目录

未使用,直接在centos上

麻烦将EMQX的日志等级设置为 debug, 然后生成一份设置和重启后,分别进行验证的日志,感谢

好的,晚上我搞下发出来

刚设置好客户端验证,使用数据库不存在的用户名abcd,成功的拒绝了连接日志如下:

2023-11-01T20:08:57.990295+08:00 [debug] msg: raw_bin_received, mfa: emqx_connection:when_bytes_in/3(778), peername: 117.175.140.167:7066, bin: 102600044D5154540582003C051100000000000E6D717474785F6564333535356533000461626364, size: 40, type: hex

2023-11-01T20:08:57.990713+08:00 [debug] msg: mqtt_packet_received, mfa: emqx_channel:handle_in/2(331), peername: 117.175.140.167:7066, clientid: mqttx_ed3555e3, packet: CONNECT(Q0, R0, D0, ClientId=mqttx_ed3555e3, ProtoName=MQTT, ProtoVsn=5, CleanStart=true, KeepAlive=60, Username=abcd, Password=), tag: MQTT

2023-11-01T20:08:57.990952+08:00 [debug] msg: authenticator_result, mfa: emqx_authn_chains:authenticate_with_provider/2(684), peername: 117.175.140.167:7066, clientid: mqttx_ed3555e3, authenticator: <<“password_based:mysql”>>, result: {error,bad_username_or_password}, tag: AUTHN

2023-11-01T20:08:57.991125+08:00 [debug] msg: authentication_result, mfa: emqx_authn_chains:authenticate/2(165), peername: 117.175.140.167:7066, clientid: mqttx_ed3555e3, reason: chain_result, result: {stop,{error,bad_username_or_password}}, tag: AUTHN

2023-11-01T20:08:57.991316+08:00 [debug] msg: mqtt_packet_sent, mfa: emqx_connection:serialize_and_inc_stats_fun/1(877), peername: 117.175.140.167:7066, clientid: mqttx_ed3555e3, packet: CONNACK(Q0, R0, D0, AckFlags=0, ReasonCode=134), tag: MQTT

2023-11-01T20:08:57.991549+08:00 [debug] msg: emqx_connection_terminated, mfa: emqx_connection:terminate/2(668), peername: 117.175.140.167:7066, clientid: mqttx_ed3555e3, reason: {shutdown,bad_username_or_password}, tag: SOCKET

2023-11-01T20:08:57.991686+08:00 [info] msg: terminate, mfa: emqx_connection:terminate/2(673), peername: 117.175.140.167:7066, clientid: mqttx_ed3555e3, reason: {shutdown,bad_username_or_password}

随后马上用emqx stop ,emqx start重启了一下,再次使用数据库不存在的用户名abcd连接,成功连接上了,说明客户端验证没有生效,日志如下:
2023-11-01T20:10:34.904101+08:00 [debug] msg: raw_bin_received, mfa: emqx_connection:when_bytes_in/3(778), peername: 117.175.140.167:7108, bin: 102600044D5154540582003C051100000000000E6D717474785F6564333535356533000461626364, size: 40, type: hex

2023-11-01T20:10:34.904533+08:00 [debug] msg: mqtt_packet_received, mfa: emqx_channel:handle_in/2(331), peername: 117.175.140.167:7108, clientid: mqttx_ed3555e3, packet: CONNECT(Q0, R0, D0, ClientId=mqttx_ed3555e3, ProtoName=MQTT, ProtoVsn=5, CleanStart=true, KeepAlive=60, Username=abcd, Password=), tag: MQTT

2023-11-01T20:10:34.905080+08:00 [debug] msg: insert_channel_info, mfa: emqx_cm:insert_channel_info/3(159), peername: 117.175.140.167:7108, clientid: mqttx_ed3555e3

2023-11-01T20:10:34.905261+08:00 [debug] msg: mqtt_packet_sent, mfa: emqx_connection:serialize_and_inc_stats_fun/1(877), peername: 117.175.140.167:7108, clientid: mqttx_ed3555e3, packet: CONNACK(Q0, R0, D0, AckFlags=0, ReasonCode=0), tag: MQTT

附件为本次测试的完整日志(我把之前的日志都清空了),麻烦查看一下问题出在哪里
emqx.log.zip (8.2 KB)

收到,看起来你的认证器在重启后并没有启动,我们这边先验证下

好的,谢谢

版本降低为5.3.0就没有上述问题。

感谢反馈,这个确定是 5.3.1-alpha.1 的 bug,alpha 版本不建议使用,你可以先使用 5.3.0