-
Notifications
You must be signed in to change notification settings - Fork 4
/
Copy pathdesc.en.hocon
10630 lines (10630 loc) · 481 KB
/
desc.en.hocon
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
{
"emqx_audit_api": {
"audit_get": {
"desc": "Get audit logs with filtering parameters. This feature enables users to efficiently\naccess the desired audit trail data and facilitates auditing, compliance,\ntroubleshooting, and security analysis.",
"label": "List audit logs"
},
"filter_from": {
"desc": "Filter logs by source type. Possible values are:\n\n- `dashboard`: Dashboard request logs.\n- `rest_api`: API KEY request logs.\n- `cli`: The emqx command line logs.\n- `erlang_console`: The emqx remote_console run function logs."
},
"filter_gte_created_at": {
"desc": "Filter logs by creation time, selecting logs created no earlier than the given timestamp.\nThe timestamp can be provided either in rfc3339 string format or as a millisecond epoch timestamp."
},
"filter_gte_duration_ms": {
"desc": "Filter logs by age duration, selecting those created no earlier than then given duration time ago."
},
"filter_http_method": {
"desc": "Filter The HTTP API logs by method, applicable for logs generated from Dashboard or REST API operations."
},
"filter_http_status_code": {
"desc": "Filter The HTTP API logs by response code, applicable for logs generated from Dashboard or REST API operations."
},
"filter_lte_created_at": {
"desc": "Filter logs by creation time, selecting logs created no later than the given timestamp.\nThe timestamp can be provided either in rfc3339 string format or as a millisecond epoch timestamp."
},
"filter_lte_duration_ms": {
"desc": "Filter logs by age duration, selecting those created no later than then given duration time ago."
},
"filter_node": {
"desc": "Filter logs by the node name where the logs were generated."
},
"filter_operation_id": {
"desc": "Filter logs by swagger's operation_id, applicable for logs generated from Dashboard or REST API operations."
},
"filter_operation_result": {
"desc": "Filter logs by operation result."
},
"filter_operation_type": {
"desc": "Filter logs by operation type."
},
"filter_source": {
"desc": "Filter logs by source. Possible values are:\n\n- The login username to filter logs generated from Dashboard for this specific user.\n- The API Key to filter logs generated from the REST API for this specific API key.\n- An empty string to filter logs generated from CLI or Erlang console."
},
"filter_source_ip": {
"desc": "Filter logs by source IP when logs, applicable for logs generated from Dashboard or REST API operations."
}
},
"emqx_auth_ext_schema": {
"common_ssl_opts_schema_partial_chain": {
"desc": "Enable or disable peer verification with partial_chain.\nWhen local verifies a peer certificate during the x509 path validation\nprocess, it constructs a certificate chain that starts with the peer\ncertificate and ends with a trust anchor.\nBy default, if it is set to `false`, the trust anchor is the\nRoot CA, and the certificate chain must be complete.\nHowever, if the setting is set to `true` or `cacert_from_cacertfile`,\nthe last certificate in `cacertfile` will be used as the trust anchor\ncertificate (intermediate CA). This creates a partial chain\nin the path validation.\nAlternatively, if it is configured with `two_cacerts_from_cacertfile`,\none of the last two certificates in `cacertfile` will be used as the\ntrust anchor certificate, forming a partial chain. This option is\nparticularly useful for intermediate CA certificate rotation.\nHowever, please note that it incurs some additional overhead, so it\nshould only be used for certificate rotation purposes.",
"label": "Partial chain"
},
"common_ssl_opts_verify_peer_ext_key_usage": {
"desc": "Verify extended key usage in peer's certificate\nFor additional peer certificate validation, the value defined here must present in the\n'Extended Key Usage' of peer certificate defined in\n[rfc5280](https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.12).\n\nAllowed values are\n- `clientAuth`\n- `serverAuth`\n- `codeSigning`\n- `emailProtection`\n- `timeStamping`\n- `ocspSigning`\n- raw OID, for example: \"OID:1.3.6.1.5.5.7.3.2\" means `id-pk 2` which is equivalent to `clientAuth`\n\nComma-separated string is also supported for validating more than one key usages.\n\nFor example, `\"serverAuth,OID:1.3.6.1.5.5.7.3.2\"`",
"label": "Verify KeyUsage in cert"
}
},
"emqx_authn_api": {
"authentication_get": {
"desc": "List authenticators for global authentication.",
"label": "List authenticators"
},
"authentication_id_delete": {
"desc": "Delete authenticator from global authentication chain.",
"label": "Delete authenticator"
},
"authentication_id_get": {
"desc": "Get authenticator from global authentication chain.",
"label": "Get authenticator"
},
"authentication_id_position_put": {
"desc": "Move authenticator in global authentication chain.",
"label": "Move authenticator"
},
"authentication_id_put": {
"desc": "Update authenticator from global authentication chain.",
"label": "Update authenticator"
},
"authentication_id_status_get": {
"desc": "Get authenticator status from global authentication chain.",
"label": "Get authenticator status"
},
"authentication_id_users_get": {
"desc": "List users in authenticator in global authentication chain.",
"label": "List users in authenticator"
},
"authentication_id_users_post": {
"desc": "Create users for authenticator in global authentication chain.",
"label": "Create users for authenticator"
},
"authentication_id_users_user_id_delete": {
"desc": "Delete user in authenticator in global authentication chain.",
"label": "Delete user in authenticator"
},
"authentication_id_users_user_id_get": {
"desc": "Get user from authenticator in global authentication chain.",
"label": "Get user from authenticator"
},
"authentication_id_users_user_id_put": {
"desc": "Update user in authenticator in global authentication chain.",
"label": "Update user in authenticator"
},
"authentication_order_put": {
"desc": "Reorder all authenticators in global authentication chain.",
"label": "Reorder Authenticators"
},
"authentication_post": {
"desc": "Create authenticator for global authentication.",
"label": "Create authenticator"
},
"is_superuser": {
"desc": "Is superuser",
"label": "Is superuser"
},
"like_user_id": {
"desc": "Fuzzy search user_id (username or clientid).",
"label": "like_user_id"
},
"listeners_listener_id_authentication_get": {
"desc": "List authenticators for listener authentication.",
"label": "List authenticators for listener"
},
"listeners_listener_id_authentication_id_delete": {
"desc": "Delete authenticator from listener authentication chain.",
"label": "Delete authenticator from listener"
},
"listeners_listener_id_authentication_id_get": {
"desc": "Get authenticator from listener authentication chain.",
"label": "Get authenticator from listener"
},
"listeners_listener_id_authentication_id_position_put": {
"desc": "Move authenticator in listener authentication chain.",
"label": "Move authenticator in listener"
},
"listeners_listener_id_authentication_id_put": {
"desc": "Update authenticator from listener authentication chain.",
"label": "Update authenticator from listener"
},
"listeners_listener_id_authentication_id_status_get": {
"desc": "Get authenticator status from listener authentication chain.",
"label": "Get authenticator status from listener"
},
"listeners_listener_id_authentication_id_users_get": {
"desc": "List users in authenticator in listener authentication chain.",
"label": "List users in authenticator in listener"
},
"listeners_listener_id_authentication_id_users_post": {
"desc": "Create users for authenticator in listener authentication chain.",
"label": "Create users for authenticator in listener"
},
"listeners_listener_id_authentication_id_users_user_id_delete": {
"desc": "Delete user in authenticator in listener authentication chain.",
"label": "Delete user in authenticator in listener"
},
"listeners_listener_id_authentication_id_users_user_id_get": {
"desc": "Get user from authenticator in listener authentication chain.",
"label": "Get user from authenticator in listener"
},
"listeners_listener_id_authentication_id_users_user_id_put": {
"desc": "Update user in authenticator in listener authentication chain.",
"label": "Update user in authenticator in listener"
},
"listeners_listener_id_authentication_post": {
"desc": "Create authenticator for listener authentication.",
"label": "Create authenticator for listener"
},
"param_auth_id": {
"desc": "Authenticator ID.",
"label": "Authenticator ID"
},
"param_listener_id": {
"desc": "Listener ID.",
"label": "Listener ID"
},
"param_position": {
"desc": "Position of authenticator in chain. Possible values are 'front', 'rear', 'before:{other_authenticator}', 'after:{other_authenticator}'.",
"label": "Position of authenticator"
},
"param_user_id": {
"desc": "User ID.",
"label": "User ID"
}
},
"emqx_authn_cinfo_schema": {
"check": {
"desc": "A check to perform on the client information.\nIt defines a match-condition and a result to return if the condition is `true`.\nIf all checks are skipped, the default result `ignore` is returned.",
"label": "Client Information Check"
},
"checks": {
"desc": "A list of checks to perform on the client information.\nIf all checks are skipped, the default result `ignore` is returned.\nThe `ignore` result means to defer the authentication to the next authenticator in the chain.",
"label": "Client Information Checks"
},
"cinfo": {
"desc": "Authenticate clients based on the client information such as username, client ID,\nclient attributes, and data extracted from TLS certificate.",
"label": "Client Information Authentication"
},
"is_match": {
"desc": "One Variform expression or an array of expressions to evaluate with a set of pre-bound variables derived from the client information.\nSupported variables:\n- `username`: the username of the client.\n- `password`: the password of the client.\n- `clientid`: the client ID of the client.\n- `client_attrs.*`: the client attributes of the client.\n- `peerhost`: the IP address of the client.\n- `cert_subject`: the subject of the TLS certificate.\n- `cert_common_name`: the issuer of the TLS certificate.\n- `zone`: the config zone associated with the listener from which the client is accepted.\nIf the expression(s) all yields the string value `'true'`, then the associated `result` is returned from this authenticator.\nIf any expression yields the other than `'true'`, then the current check is skipped.",
"label": "Match Conditions"
},
"result": {
"desc": "The result to return if the match condition is `true`.\nSupported results:\n- `ignore`: defer the authentication to the next authenticator in the chain.\n- `allow`: allow the client to connect.\n- `deny`: deny the client to connect.",
"label": "Result"
}
},
"emqx_authn_http_schema": {
"body": {
"desc": "HTTP request body.",
"label": "Request Body"
},
"get": {
"desc": "Configuration of authenticator using HTTP Server as authentication service (Using GET request)."
},
"headers": {
"desc": "List of HTTP Headers.",
"label": "Headers"
},
"headers_no_content_type": {
"desc": "List of HTTP headers (without <code>content-type</code>).",
"label": "headers_no_content_type"
},
"method": {
"desc": "HTTP request method.",
"label": "Request Method"
},
"post": {
"desc": "Configuration of authenticator using HTTP Server as authentication service (Using POST request)."
},
"request_timeout": {
"desc": "HTTP request timeout.",
"label": "Request Timeout"
},
"url": {
"desc": "URL of the HTTP server.",
"label": "URL"
}
},
"emqx_authn_jwt_schema": {
"acl_claim_name": {
"desc": "The JWT claim designated for accessing ACL (Access Control List) rules can be specified,\nsuch as using the `acl` claim. A typical decoded JWT with this claim might appear as:\n`{\"username\": \"user1\", \"acl\": ...}`.\n\nSupported ACL Rule Formats:\n\n- Object Format:\n Utilizes action types pub (publish), sub (subscribe), or all (both publish and subscribe).\n The value is a list of topic filters.\n Example: `{\"pub\": [\"topic1\"], \"sub\": [], \"all\": [\"${username}/#\"]}`.\n This example signifies that the token owner can publish to topic1 and perform both publish and subscribe\n actions on topics starting with their username.\n Note: In this format, if no topic matches, the action is denied, and the authorization process terminates.\n\n- Array Format (resembles File-Based ACL Rules):\n Example: `[{\"permission\": \"allow\", \"action\": \"all\", \"topic\": \"${username}/#\"}]`.\n Additionally, the `pub` or `publish` action rules can be extended with `qos` and `retain` field,\n and `sub` or `subscribe` action rules can be extended with a `qos` field.\n Note: Here, if no rule matches, the action is not immediately denied.\n The process continues to other configured authorization sources,\n and ultimately falls back to the default permission in config `authorization.no_match`.\n\nThe ACL claim utilizes MQTT topic wildcard matching rules for publishing or subscribing.\nA special syntax for the 'subscribe' action allows the use of `eq` for an exact match.\nFor instance, `eq t/#` permits or denies subscription to `t/#`, but not to `t/1`.",
"label": "ACL claim name"
},
"algorithm": {
"desc": "JWT signing algorithm, Supports HMAC (configured as <code>hmac-based</code>) and RSA, ECDSA (configured as <code>public-key</code>).",
"label": "JWT Signing Algorithm"
},
"cacertfile": {
"desc": "Path to a file containing PEM-encoded CA certificates.",
"label": "CA Certificate File"
},
"certfile": {
"desc": "Path to a file containing the user certificate.",
"label": "Certificate File"
},
"disconnect_after_expire": {
"desc": "Disconnect the client after the token expires.",
"label": "Disconnect After Expire"
},
"enable": {
"desc": "Enable/disable SSL.",
"label": "Enable/disable SSL"
},
"endpoint": {
"desc": "JWKS endpoint, it's a read-only endpoint that returns the server's public key set in the JWKS format.",
"label": "JWKS Endpoint"
},
"from": {
"desc": "Field to take JWT from.",
"label": "From Field"
},
"jwks_headers": {
"desc": "List of HTTP headers to send with the JWKS request.",
"label": "HTTP Headers"
},
"jwt_hmac": {
"desc": "Configuration when the JWT for authentication is issued using the HMAC algorithm."
},
"jwt_jwks": {
"desc": "Configuration when JWTs used for authentication need to be fetched from the JWKS endpoint."
},
"jwt_public_key": {
"desc": "Configuration when the JWT for authentication is issued using RSA or ECDSA algorithm."
},
"keyfile": {
"desc": "Path to a file containing the user's private PEM-encoded key.",
"label": "Key File"
},
"public_key": {
"desc": "The public key used to verify the JWT.",
"label": "Public Key"
},
"refresh_interval": {
"desc": "JWKS refresh interval.",
"label": "JWKS Refresh Interval"
},
"secret": {
"desc": "The key to verify the JWT using HMAC algorithm.",
"label": "Secret"
},
"secret_base64_encoded": {
"desc": "Whether secret is base64 encoded.",
"label": "Whether Secret is Base64 Encoded"
},
"server_name_indication": {
"desc": "Server Name Indication (SNI).",
"label": "Server Name Indication"
},
"ssl": {
"desc": "SSL options.",
"label": "SSL Options"
},
"use_jwks": {
"desc": "Whether to use JWKS.",
"label": "Whether to Use JWKS"
},
"verify": {
"desc": "Enable or disable SSL peer verification.",
"label": "Verify"
},
"verify_claims": {
"desc": "A list of custom claims to validate. The allowed formats are the following:\nA map where claim names are map keys and expected values are map values:\n <code>{ claim_name = \"${username}\", ...}</code>.\n\nA list of maps with <code>name</code> (claim name) and <code>value</code> (expected claim value) keys:\n <code>[{name = \"claim_name\", value = \"${username}\"}, ...]</code>.\n\nValues can use the following placeholders:\n- <code>${username}</code>: Will be replaced at runtime with <code>Username</code> used by the client when connecting\n- <code>${clientid}</code>: Will be replaced at runtime with <code>Client ID</code> used by the client when connecting\n\nAuthentication will verify that the value of claims in the JWT (taken from the Password field) matches what is required in <code>verify_claims</code>.",
"label": "Verify Claims"
}
},
"emqx_authn_kerberos_schema": {
"principal": {
"desc": "Server Kerberos principal.\nFor example <code>mqtt/emqx-cluster-1.example.com@MY_REALM.EXAMPLE.COM</code>.\nNOTE: The realm in use has to be configured in /etc/krb5.conf in EMQX nodes.",
"label": "Kerberos Principal"
}
},
"emqx_authn_ldap_schema": {
"bind_method": {
"desc": "Authenticate by the LDAP bind operation."
},
"hash_method": {
"desc": "Authenticate by comparing the hashed password which was provided by the `password attribute`."
},
"is_superuser_attribute": {
"desc": "Indicates which attribute is used to represent whether the user is a superuser.",
"label": "IsSuperuser Attribute"
},
"ldap": {
"desc": "Configuration of authenticator using LDAP as authentication data source."
},
"ldap_deprecated": {
"desc": "This is a deprecated form, and you should avoid using it."
},
"method": {
"desc": "Authentication method."
},
"method_type": {
"desc": "Authentication method type."
},
"password_attribute": {
"desc": "Indicates which attribute is used to represent the user's password.",
"label": "Password Attribute"
},
"query_timeout": {
"desc": "Timeout for the LDAP query.",
"label": "Query Timeout"
}
},
"emqx_authn_mnesia_schema": {
"bootstrap_file": {
"desc": "The bootstrap file imports users into the built-in database.\nIt will not import a user ID that already exists in the database.\nThe file content format is determined by `bootstrap_type`.",
"label": "Bootstrap File Path"
},
"bootstrap_type": {
"desc": "Specify which type of content the bootstrap file has.\n\n- **`plain`**:\n - Expected data fields: `user_id`, `password`, `is_superuser`\n - `user_id`: Can be Client ID or username, depending on built-in database authentication's `user_id_type` config.\n - `password`: User's plaintext password.\n - `is_superuser`: Boolean, user's administrative status.\n\n- **`hash`**:\n - Expected data fields: `user_id`,`password_hash`,`salt`,`is_superuser`\n - Definitions similar to `plain` type, with `password_hash` and `salt` added for security.\n\nThe content can be either in CSV, or JSON format.\n\nHere is a CSV example: `user_id,password_hash,salt,is_superuser\\nmy_user,b6c743545a7817ae8c8f624371d5f5f0373234bb0ff36b8ffbf19bce0e06ab75,de1024f462fb83910fd13151bd4bd235,true`\n\nAnd JSON content should be decoded into an array of objects, for example: `[{\"user_id\": \"my_user\",\"password\": \"s3cr3tp@ssw0rd\",\"is_superuser\": true}]`.\n\nThe hash string for `password_hash` depends on how `password_hash_algorithm` is configured for the built-in database authentication mechanism. For example, if it's configured as `password_hash_algorithm {name = sha256, salt_position = suffix}`, then the salt is appended to the password before hashed. Here is the equivalent Python expression: `hashlib.sha256(password + salt).hexdigest()`."
},
"builtin_db": {
"desc": "Configuration of authenticator using built-in database as data source."
},
"user_id_type": {
"desc": "Specify whether to use `clientid` or `username` for authentication.",
"label": "Authentication ID Type"
}
},
"emqx_authn_mongodb_schema": {
"collection": {
"desc": "Collection used to store authentication data.",
"label": "Collection"
},
"filter": {
"desc": "Conditional expression that defines the filter condition in the query.\nFilter supports the following placeholders:\n- <code>${username}</code>: Will be replaced at runtime with <code>Username</code> used by the client when connecting\n- <code>${clientid}</code>: Will be replaced at runtime with <code>Client ID</code> used by the client when connecting",
"label": "Filter"
},
"is_superuser_field": {
"desc": "Document field that defines if the user has superuser privileges.",
"label": "Is Superuser Field"
},
"password_hash_field": {
"desc": "Document field that contains password hash.",
"label": "Password Hash Field"
},
"replica-set": {
"desc": "Configuration of authenticator using MongoDB (Replica Set) as authentication data source."
},
"salt_field": {
"desc": "Document field that contains the password salt.",
"label": "Salt Field"
},
"sharded-cluster": {
"desc": "Configuration of authenticator using MongoDB (Sharded Cluster) as authentication data source."
},
"single": {
"desc": "Configuration of authenticator using MongoDB (Standalone) as authentication data source."
}
},
"emqx_authn_mysql_schema": {
"mysql": {
"desc": "Configuration of authenticator using MySQL as authentication data source."
},
"query": {
"desc": "SQL used to query data for authentication, such as password hash.",
"label": "Query"
},
"query_timeout": {
"desc": "Timeout for the SQL query.",
"label": "Query Timeout"
}
},
"emqx_authn_postgresql_schema": {
"postgresql": {
"desc": "Configuration of authenticator using PostgreSQL as authentication data source."
},
"query": {
"desc": "SQL used to query data for authentication, such as password hash.",
"label": "Query"
}
},
"emqx_authn_redis_schema": {
"cluster": {
"desc": "Configuration of authenticator using Redis (Cluster) as authentication data source."
},
"cmd": {
"desc": "The Redis Command used to query data for authentication such as password hash, currently only supports <code>HGET</code> and <code>HMGET</code>.",
"label": "Command"
},
"sentinel": {
"desc": "Configuration of authenticator using Redis (Sentinel) as authentication data source."
},
"single": {
"desc": "Configuration of authenticator using Redis (Standalone) as authentication data source."
}
},
"emqx_authn_schema": {
"backend": {
"desc": "Backend type.",
"label": "Backend Type"
},
"enable": {
"desc": "Set to <code>true</code> or <code>false</code> to disable this auth provider.",
"label": "Enable"
},
"failed": {
"desc": "Count of query failed.",
"label": "Failed"
},
"global_authentication": {
"desc": "Default authentication configs for all MQTT listeners.\n\nFor per-listener overrides see <code>authentication</code> in listener configs\n\nThis option can be configured with:\n<ul>\n <li><code>[]</code>: The default value, it allows *ALL* logins</li>\n <li>one: For example <code>{enable:true,backend:\"built_in_database\",mechanism=\"password_based\"}</code></li>\n <li>chain: An array of structs.</li>\n</ul>\n\nWhen a chain is configured, the login credentials are checked against the backends per the configured order, until an 'allow' or 'deny' decision can be made.\n\nIf there is no decision after a full chain exhaustion, the login is rejected.",
"label": "Global authentication"
},
"listener_authentication": {
"desc": "Per-listener authentication override.\nAuthentication can be one single authenticator instance or a chain of authenticators as an array.\nWhen authenticating a login (username, client ID, etc.) the authenticators are checked in the configured order.",
"label": "Per-listener authentication override"
},
"matched": {
"desc": "Count of this resource is queried.",
"label": "Matched"
},
"mechanism": {
"desc": "Authentication mechanism.",
"label": "Authentication Mechanism"
},
"metrics": {
"desc": "The metrics of the resource.",
"label": "Metrics"
},
"metrics_failed": {
"desc": "The required authentication information is found in the current instance, and the instance returns authentication failure.",
"label": "Authentication Failed Times"
},
"metrics_nomatch": {
"desc": "The number of times the instance was ignored when the required authentication information was not found in the current instance.",
"label": "Nomatch Times"
},
"metrics_rate": {
"desc": "The total rate at which instances are triggered, times/second.",
"label": "Total Triggered Rate"
},
"metrics_rate_last5m": {
"desc": "The average trigger rate of the instance within 5 minutes, times/second.",
"label": "Average Triggered Rate in Last 5min"
},
"metrics_rate_max": {
"desc": "The highest trigger rate the instance has ever reached, times/second.",
"label": "Highest Triggered Rate"
},
"metrics_success": {
"desc": "The required authentication information is found in the current instance, and the instance returns authentication success.",
"label": "Authentication Success Times"
},
"metrics_total": {
"desc": "The total number of times the current instance was triggered.",
"label": "Total Triggered Times"
},
"node": {
"desc": "Node name.",
"label": "Node Name."
},
"node_error": {
"desc": "The error of node.",
"label": "Error in Node"
},
"node_metrics": {
"desc": "The metrics of the resource for each node.",
"label": "Resource Metrics in Node"
},
"node_status": {
"desc": "The status of the resource for each node.",
"label": "Resource Status in Node"
},
"rate": {
"desc": "The rate of matched, times/second.",
"label": "Rate"
},
"rate_last5m": {
"desc": "The average rate of matched in the last 5 minutes, times/second.",
"label": "Rate in Last 5min"
},
"rate_max": {
"desc": "The max rate of matched, times/second.",
"label": "Max Rate"
},
"status": {
"desc": "The status of the resource.",
"label": "Status"
},
"success": {
"desc": "Count of query success.",
"label": "Success"
}
},
"emqx_authn_user_import_api": {
"authentication_id_import_users_post": {
"desc": "Import users into authenticator in global authentication chain.",
"label": "Global import users into authenticator"
},
"import_result_failed": {
"desc": "Total number of users whose import failed.",
"label": "Failed"
},
"import_result_override": {
"desc": "Total number of users successfully imported as overrides.",
"label": "Override"
},
"import_result_skipped": {
"desc": "Total number of users skipped because imported users are identical to existing users.",
"label": "Skipped"
},
"import_result_succ": {
"desc": "Total number of users successfully imported with new records.",
"label": "Success"
},
"import_result_total": {
"desc": "Total number of users contained in the file.",
"label": "Total"
},
"listeners_listener_id_authentication_id_import_users_post": {
"desc": "Import users into authenticator in listener authentication chain.",
"label": "Import users into authenticator in listener"
}
},
"emqx_authz_api_cache": {
"authorization_cache_delete": {
"desc": "Clean all authorization cache in the cluster.",
"label": "Clean authorization cache in cluster"
}
},
"emqx_authz_api_mnesia": {
"action": {
"desc": "Authorized action (publish/subscribe/all)",
"label": "action"
},
"clientid": {
"desc": "ClientID",
"label": "clientid"
},
"fuzzy_clientid": {
"desc": "Fuzzy search `clientid` as substring",
"label": "fuzzy_clientid"
},
"fuzzy_username": {
"desc": "Fuzzy search `username` as substring",
"label": "fuzzy_username"
},
"permission": {
"desc": "Permission",
"label": "permission"
},
"qos": {
"desc": "QoS of authorized action",
"label": "QoS"
},
"retain": {
"desc": "Retain flag of authorized action",
"label": "retain"
},
"rules_all_delete": {
"desc": "Delete rules for 'all'",
"label": "Delete rules for 'all'"
},
"rules_all_get": {
"desc": "Show the list of rules for 'all'",
"label": "Show rules for 'all'"
},
"rules_all_post": {
"desc": "Create/Update the list of rules for 'all'.",
"label": "Update rules for 'all'"
},
"rules_delete": {
"desc": "Delete all rules for all 'users', 'clients' and 'all'",
"label": "Delete all rules"
},
"topic": {
"desc": "Rule on specific topic",
"label": "topic"
},
"user_clientid_delete": {
"desc": "Delete rule for 'clientid'",
"label": "Delete rule for 'clientid'"
},
"user_clientid_get": {
"desc": "Get rule for 'clientid'",
"label": "Get rule for 'clientid'"
},
"user_clientid_put": {
"desc": "Set rule for 'clientid'",
"label": "Set rule for 'clientid'"
},
"user_username_delete": {
"desc": "Delete rule for 'username'",
"label": "Delete rule for 'username'"
},
"user_username_get": {
"desc": "Get rule for 'username'",
"label": "Get rule for 'username'"
},
"user_username_put": {
"desc": "Set rule for 'username'",
"label": "Set rule for 'username'"
},
"username": {
"desc": "Username",
"label": "username"
},
"users_clientid_get": {
"desc": "Show the list of rules for clients",
"label": "Show rules for clients"
},
"users_clientid_post": {
"desc": "Add new rule for 'clientid'",
"label": "Add rule for 'clientid'"
},
"users_username_get": {
"desc": "Show the list of rules for users",
"label": "Show rules for users"
},
"users_username_post": {
"desc": "Add new rule for 'username'",
"label": "Add rule for 'username'"
}
},
"emqx_authz_api_settings": {
"authorization_settings_get": {
"desc": "Get authorization settings"
},
"authorization_settings_put": {
"desc": "Update authorization settings"
}
},
"emqx_authz_api_sources": {
"authorization_sources_get": {
"desc": "List all authorization sources",
"label": "List all authorization sources"
},
"authorization_sources_order_put": {
"desc": "Reorder all authorization sources.",
"label": "Reorder Authorization Sources"
},
"authorization_sources_post": {
"desc": "Add a new source",
"label": "Add a new source"
},
"authorization_sources_type_delete": {
"desc": "Delete source",
"label": "Delete source"
},
"authorization_sources_type_get": {
"desc": "Get a authorization source",
"label": "Get a authorization source"
},
"authorization_sources_type_move_post": {
"desc": "Change the exection order of sources",
"label": "Change order of sources"
},
"authorization_sources_type_put": {
"desc": "Update source",
"label": "Update source"
},
"authorization_sources_type_status_get": {
"desc": "Get a authorization source",
"label": "Get a authorization source"
},
"source": {
"desc": "Authorization source",
"label": "source"
},
"source_config": {
"desc": "Source config",
"label": "source_config"
},
"source_type": {
"desc": "Authorization type",
"label": "source_type"
},
"sources": {
"desc": "Authorization sources",
"label": "sources"
}
},
"emqx_authz_file_schema": {
"file": {
"desc": "Authorization using a static file.",
"label": "file"
},
"path": {
"desc": "Path to the file which contains the ACL rules.\nIf the file provisioned before starting EMQX node,\nit can be placed anywhere as long as EMQX has read access to it.\nThat is, EMQX will treat it as read only.\n\nIn case the rule-set is created or updated from EMQX Dashboard or HTTP API,\na new file will be created and placed in `authz` subdirectory inside EMQX's `data_dir`,\nand the old file will not be used anymore.",
"label": "path"
}
},
"emqx_authz_http_schema": {
"body": {
"desc": "HTTP request body.",
"label": "Request Body"
},
"headers": {
"desc": "List of HTTP Headers.",
"label": "Headers"
},
"headers_no_content_type": {
"desc": "List of HTTP headers (without <code>content-type</code>).",
"label": "headers_no_content_type"
},
"http_get": {
"desc": "Authorization using an external HTTP server (via GET requests).",
"label": "http_get"
},
"http_post": {
"desc": "Authorization using an external HTTP server (via POST requests).",
"label": "http_post"
},
"method": {
"desc": "HTTP method.",
"label": "method"
},
"request_timeout": {
"desc": "HTTP request timeout.",
"label": "Request Timeout"
},
"url": {
"desc": "URL of the auth server.",
"label": "URL"
}
},
"emqx_authz_ldap_schema": {
"all_attribute": {
"desc": "Indicates which attribute is used to represent the both allowed topics list of `publish` and `subscribe`.",
"label": "All Attribute"
},
"ldap_struct": {
"desc": "LDAP Authorization settings",
"label": "LDAP authorization"
},
"publish_attribute": {
"desc": "Indicates which attribute is used to represent the allowed topics list of the `publish`.",
"label": "Publish Attribute"
},
"query_timeout": {
"desc": "Timeout for the LDAP query.",
"label": "Query Timeout"
},
"subscribe_attribute": {
"desc": "Indicates which attribute is used to represent the allowed topics list of the `subscribe`.",
"label": "Subscribe Attribute"
}
},
"emqx_authz_mnesia_schema": {
"builtin_db": {
"desc": "Authorization using a built-in database (mnesia).",
"label": "Builtin Database"
},
"max_rules": {
"desc": "Maximum number of rules per client/user. Note that performance may decrease as number of rules increases."
}
},
"emqx_authz_mongodb_schema": {
"collection": {
"desc": "`MongoDB` collection containing the authorization data.",
"label": "collection"
},
"filter": {
"desc": "Conditional expression that defines the filter condition in the query.\nFilter supports the following placeholders<br/>\n - <code>${username}</code>: Will be replaced at runtime with <code>Username</code> used by the client when connecting<br/>\n - <code>${clientid}</code>: Will be replaced at runtime with <code>Client ID</code> used by the client when connecting",
"label": "Filter"
},
"limit": {
"desc": "Limit the number of records to fetch.",
"label": "Authorization record limit"
},
"mongo_rs": {
"desc": "Authorization using a MongoDB replica set.",
"label": "mongo_rs"
},
"mongo_sharded": {
"desc": "Authorization using a sharded MongoDB cluster.",
"label": "mongo_sharded"
},
"mongo_single": {
"desc": "Authorization using a single MongoDB instance.",
"label": "mongo_single"
},
"skip": {
"desc": "Number of authorization records to skip.",
"label": "Authorization record skip number"
}
},
"emqx_authz_mysql_schema": {
"mysql": {
"desc": "Authorization using a MySQL database.",
"label": "mysql"
},
"query": {
"desc": "Database query used to retrieve authorization data.",
"label": "query"
}
},
"emqx_authz_postgresql_schema": {
"postgresql": {
"desc": "Authorization using a PostgreSQL database.",
"label": "postgresql"
},
"query": {
"desc": "Database query used to retrieve authorization data.",
"label": "query"
}
},
"emqx_authz_redis_schema": {
"cmd": {
"desc": "Database query used to retrieve authorization data.",
"label": "cmd"
},
"redis_cluster": {
"desc": "Authorization using a Redis cluster.",
"label": "redis_cluster"
},
"redis_sentinel": {
"desc": "Authorization using a Redis Sentinel.",
"label": "redis_sentinel"
},
"redis_single": {
"desc": "Authorization using a single Redis instance.",
"label": "redis_single"
}
},
"emqx_authz_schema": {
"allow": {
"desc": "The number of times the authentication was successful.",
"label": "The Number of Times the Authentication was Successful"
},
"authorization": {
"desc": "Configuration related to the client authorization.",
"label": "authorization"
},
"deny": {
"desc": "The number of authentication failures.",
"label": "The Number of Authentication Failures"
},
"enable": {
"desc": "Set to <code>true</code> or <code>false</code> to disable this ACL provider",
"label": "enable"
},
"failed": {
"desc": "Count of query failed.",
"label": "Failed"
},
"ignore": {
"desc": "Count of query ignored. This counter is increased whenever the authorization source attempts to authorize a request, but either it's not applicable, or an error was encountered and the result is undecidable",
"label": "Ignored"
},
"matched": {
"desc": "Count of this resource is queried.",
"label": "Matched"
},
"metrics": {
"desc": "The metrics of the resource.",
"label": "Metrics"
},
"metrics_total": {
"desc": "The total number of times the authorization rule was triggered.",
"label": "The Total Number of Times the Authorization Rule was Triggered"
},
"node": {
"desc": "Node name.",
"label": "Node Name."
},
"node_error": {
"desc": "The error of node.",
"label": "Error in Node"
},
"node_metrics": {
"desc": "The metrics of the resource for each node.",
"label": "Resource Metrics in Node"
},
"node_status": {
"desc": "The status of the resource for each node.",
"label": "Resource Status in Node"
},
"nomatch": {
"desc": "The number of times that no authorization rules were matched.",
"label": "The Number of Times that no Authorization Rules were Matched"
},
"rate": {
"desc": "The rate of matched, times/second.",
"label": "Rate"
},
"rate_last5m": {
"desc": "The average rate of matched in the last 5 minutes, times/second.",
"label": "Rate in Last 5min"
},
"rate_max": {
"desc": "The max rate of matched, times/second.",
"label": "Max Rate"
},
"sources": {
"desc": "Authorization data sources.<br/>\nAn array of authorization (ACL) data providers.\nIt is designed as an array, not a hash-map, so the sources can be\nordered to form a chain of access controls.<br/>\n\nWhen authorizing a 'publish' or 'subscribe' action, the configured\nsources are checked in order. When checking an ACL source,\nin case the client (identified by username or client ID) is not found,\nit moves on to the next source. And it stops immediately\nonce an 'allow' or 'deny' decision is returned.<br/>\n\nIf the client is not found in any of the sources,\nthe default action configured in 'authorization.no_match' is applied.<br/>\n\nNOTE:\nThe source elements are identified by their 'type'.\nIt is NOT allowed to configure two or more sources of the same type.",
"label": "sources"
},
"status": {
"desc": "The status of the resource.",
"label": "Status"
},
"success": {
"desc": "Count of query success.",
"label": "Success"
},
"type": {
"desc": "Backend type.",
"label": "type"
}
},
"emqx_auto_subscribe_api": {
"list_auto_subscribe_api": {
"desc": "Get auto subscribe topic list",
"label": "Get auto subscribe topics"
},
"update_auto_subscribe_api": {
"desc": "Update auto subscribe topic list",
"label": "Update auto subscribe topics"
},
"update_auto_subscribe_api_response409": {
"desc": "Auto Subscribe topics max limit",
"label": "Auto Subscribe topics max limit"
}
},
"emqx_auto_subscribe_schema": {
"auto_subscribe": {
"desc": "After the device logs in successfully, the subscription is automatically completed for the device through the pre-defined subscription representation. Supports the use of placeholders.",
"label": "Auto Subscribe"
},
"nl": {
"desc": "Default value 0.\nMQTT v3.1.1: if you subscribe to the topic published by yourself, you will receive all messages that you published.\nMQTT v5: if you set this option as 1 when subscribing, the server will not forward the message you published to you.",
"label": "No Local"
},
"qos": {
"desc": "Default value 0. Quality of service.\nAt most once (0)\nAt least once (1)\nExactly once (2)",
"label": "Quality of Service"
},
"rap": {
"desc": "Default value 0. This option is used to specify whether the server retains the RETAIN mark when forwarding messages to the client, and this option does not affect the RETAIN mark in the retained message. Therefore, when the option Retain As Publish is set to 0, the client will directly distinguish whether this is a normal forwarded message or a retained message according to the RETAIN mark in the message, instead of judging whether this message is the first received after subscribing(the forwarded message may be sent before the retained message, which depends on the specific implementation of different brokers).",
"label": "Retain As Publish"
},
"rh": {
"desc": "Default value 0. This option is used to specify whether the server forwards the retained message to the client when establishing a subscription.\nRetain Handling is equal to 0, as long as the client successfully subscribes, the server will send the retained message.\nRetain Handling is equal to 1, if the client successfully subscribes and this subscription does not exist previously, the server sends the retained message. After all, sometimes the client re-initiate the subscription just to change the QoS, but it does not mean that it wants to receive the reserved messages again.\nRetain Handling is equal to 2, even if the client successfully subscribes, the server does not send the retained message.",
"label": "Retain Handling"
},
"topic": {
"desc": "Topic name, placeholders are supported. For example: client/${clientid}/username/${username}/host/${host}/port/${port}\nRequired field, and cannot be empty string",
"label": "Topic"
}
},