EMQX ACL Rules Not Enforced

In this tutorial, you'll learn about EMQX ACL Rules Not Enforced. We cover key concepts, practical examples, and best practices.

The Problem

MQTT clients can publish or subscribe to topics despite ACL rules denying access.

Quick Fix

Wrong

# ACL file not loaded — no authorization configured

All clients can access all topics (permissive default).

Right

# 1. Enable authorization via Dashboard
curl -u admin:public -X POST http://localhost:18083/api/v5/authorization/sources \
  -H 'Content-Type: application/json' \
  -d '{'type':'built_in_database'}'

# 2. Add ACL rule: deny user myuser from publishing to /admin/#
curl -u admin:public -X POST http://localhost:18083/api/v5/authorization/sources/built_in_database/rules \
  -d '{'rules':[{'who':'username','username':'myuser','topics':['/admin/#'],'action':'publish','effect':'deny'}]}'

# 3. Verify
mqttx pub -t /admin/secret -m leak -u myuser -P pass

Publish fails with 'Not Authorized' or connection dropped.

Prevention

ACL rules can be based on: username, client ID, IP address, or all clients. Rule order: first match wins. Cache ACL rules for performance. Use MQTT 5.0 enhanced auth for real-time permission updates. Test ACLs with the emqx_ctl acl check command.

DodaTech engineers apply these same patterns across Doda Browser, DodaZIP, and Durga Antivirus Pro for production IoT reliability.

FAQ