Device authentication

ngz_iot_auth extracts a principal and fails closed before broker admission. nginz-iotd applies the authoritative topic ACL and rate policy.

File policy

stream {
  server {
    iot_auth on;
    iot_auth_default deny;
    iot_auth_method file;
    iot_auth_policy file:/etc/nginz-iot/auth.policy;
    iot_auth_principal $mqtt_preread_username;
  }
}

The policy reference must use an approved scheme and remain bounded. Policy reload uses last-good rollback when parsing or reading a replacement fails.

JWT and JWKS

iot_auth_method jwt;
iot_auth_jwks_uri https://identity.example/.well-known/jwks.json;
iot_auth_jwks_ca file:/etc/ssl/certs/identity-ca.pem;
iot_auth_jwt_issuer https://identity.example/;
iot_auth_jwt_audience citusio-devices;

Pin the issuer and audience, verify TLS for the JWKS endpoint, and keep the last valid key set during a bounded refresh failure. Do not turn an unavailable identity provider into an implicit allow.

mTLS

Terminate and verify client TLS in nginx, then map a verified certificate identity into iot_auth_principal. Never trust a client-supplied identity header or variable unless the listener’s TLS and proxy boundary makes it authoritative.