MQTT GUIDE
2 min readMQTT Authorization and ACLs
Authorization decides what an authenticated MQTT client is allowed to do — which topics it may publish to and which it may subscribe to. Brokers enforce this with access-control rules (ACLs) attached to each client’s credentials, so being connected doesn’t mean a client can touch every topic.
Authenticating a client answers who are you. Authorization answers what are you allowed to do — which topics a client may publish to or subscribe from. It’s the third layer of MQTT security, and the one that contains the blast radius if a device is compromised.
How authorization works
Each client (or credential) has a set of access-control rules — an ACL. When the client tries to publish or subscribe, the broker checks the topic against those rules and allows or refuses the operation. Publish and subscribe are usually controlled separately, and rules are commonly written as topic patterns so one rule can cover a whole subtree.
Authorization in TBMQ
TBMQ authorizes publish and subscribe separately, per client credentials, using regular-expression topic
patterns. The default rule allows all topics (.*), so hardening a deployment means tightening those
patterns to scope each client to exactly the topics it needs — for example letting a device publish only under its
own branch of the topic tree. See Authorization in the security overview
for the rule model, and MQTT client credentials for where you
configure the publish/subscribe patterns per client.
Frequently asked questions
What is MQTT authorization?
The broker’s enforcement of what an authenticated client may do — specifically which topics it may publish to and which it may subscribe from. It runs after authentication: being connected does not mean a client can use every topic.
What is an ACL in MQTT?
An access-control list: the set of rules that say which topics a client (or credential) is allowed to publish to or subscribe from. Brokers usually let you define publish rules and subscribe rules separately, often as topic patterns.
What is the difference between authentication and authorization?
Authentication verifies identity at connect. Authorization limits what that identity may do afterward, per topic. A client can authenticate successfully and still be denied a specific publish or subscribe.
What happens when a client violates an authorization rule?
The broker refuses that specific operation. A disallowed subscribe is rejected in the SUBACK; a disallowed publish is dropped and, in MQTT 5.0, acknowledged with a Not authorized reason code. The connection itself can stay open.
Can I use wildcards in authorization rules?
Yes. Rules are usually expressed as topic patterns, so one rule can cover a whole subtree — for example allowing a device to publish only under its own branch of the topic tree.
Run it yourself
TBMQ is a free, open-source MQTT broker built to scale. Spin it up in minutes or try the live demo — no install required.