Messaging
Introduction
The ClearBlade Platform supports MQTT, a lightweight IoT messaging protocol. ClearBlade has built an OAuth 2 security model into the MQTT broker to provide out-of-the-box messaging security.
Click here to learn about sending messages.
Purpose
Lightweight messaging is key to moving data around an IoT system at scale.
Workflows
Workflow 1: Upon publishing, a message is processed with code services, which publishes the output.
Workflow 2: Code service is invoked, computation is performed, and output is published.
MQTT
The ClearBlade Platform implements the full specification of MQTT 3.1.1 to allow for multiple quality of service (QoS) settings that best fit a developer's use case.
QoS
Quality of service | Definition | Description |
---|---|---|
0 | At most once | The message is only sent once whether it makes it to the subscriber or not. |
1 | At least once | The message will be sent one or more times to the subscriber until it is received. |
2 | Exactly once | The message will be received by the subscriber exactly once. |
MQTT ports and their use
Port | TLS | Information | Requirements |
---|---|---|---|
1883 | False | MQTT Pub/Sub | user-token |
1884 | True | MQTT Pub/Sub | user-token |
8903 | False | WebSockets, usually used by browsers/applications (cannot communicate directly over MQTT) | dev-token |
8904 | True | WebSockets | dev-token |
8905 | False | Auth over MQTT | SystemKey, Secret, Username, Password, ClientId |
8906 | True | Auth over MQTT |
|
8907 | False | Auth over MQTT via WebSockets | TODO |
8908 | True | Auth over MQTT via WebSockets | TODO |
Working with MQTT
These steps are involved with MQTT:
Prerequisites
You must have a user or device with valid permissions to publish messages.
Please follow the instructions to do so:
1. Log in or create a developer account on a ClearBlade Platform instance.
2. View or create a system.
3. View or create a user.
4. View or assign a role to the user.
5. View the Roles page.
6. Add a topic to the message topics list enabled for that role (for example, mytopic).
Broker connection
The MQTT protocol allows for the connect action to provide a username and password. We will modify the use of those fields to accommodate our OAuth-styled token model.
Key | Value | Example |
---|---|---|
URL | URL_OF_BROKER | |
PORT | PORT | 1883 |
Username | USER_TOKEN | abcdefabcdef01234567890 |
Password | SYSTEM_KEY | f0cbf0cbf0cbf0cbf0cbf0cbf0cb |
ClientID | UNIQUE_CLIENT_ID | sjdbfkasdbf |
Duplicate client ID behavior
If two clients connect to a broker with the same client ID, the broker behavior can be configured to be one of the following:
1. The new client can connect, and the existing client is kicked off. Depending on the client firmware, this could result in the two clients alternately connecting and disconnecting repeatedly.
2. The existing client connection is maintained, and the new client is rejected.
The chosen configuration is set when an environment is deployed and applies to all systems (brokers) in the given environment. Configuration #1 conforms to the MQTT specification.
MQTT authentication
A ClearBlade user token is required to communicate with a broker. A token can be obtained via a REST endpoint call or MQTT.
Connect
Required keys | Description | Example values |
---|---|---|
URL | <PLATFORM_IP> | |
Port | <PORT_NUMBER> | 8905 |
Username | <SYSTEM_KEY> | bacb8fb60bb4d7c2c2c0e4bb9701 |
Password | <SYSTEM_SECRET> | BACB8FB60BFDDB7DB97D7A8BF01 |
ClientId | <USER_EMAIL>:<PASSWORD> for User, <DEVICE_NAME>:<ACTIVE_KEY> for devices | cbman@clearblade.com:cl34r8l4d3 or temperature-sensor:faqb8fb60bc2c2b1c0e4bb9701 |
TLS (optional) | <ALLOW_TLS> | true |
Subscribe
To receive the new JWT token, subscribe to the auth topic (recommended).
To receive the legacy token, subscribe to the v/1/auth topic.
Extract token
ClearBlade publishes the user token on the auth message topic with bit-level encoding.
The payload is in this format:
The length block is a 2-byte unsigned 16-bit integer.
The data block is UTF-8 encoded bytes.
Block mapping in the above packet structure:
Block-Num | Description |
---|---|
1 | Token length |
2 | Token |
3 | User ID or device name length |
4 | User ID or device name |
5 | Messaging URL length |
6 | Messaging URL |
Once the client is authenticated, the token can be extracted, and the connection can be established.
Error codes
Referring to MQTT 3.1.1 spec
Value | Return code response | Description |
---|---|---|
0 | 0x00 Connection Accepted | Connection accepted |
1 | 0x01 Connection Refused, unacceptable protocol version | The server does not support the MQTT protocol level requested by the client |
2 | 0x02 Connection Refused, identifier rejected | The client identifier is correct (UTF-8) but unallowed by the server. A duplicate |
3 | 0x03 Connection Refused, Server unavailable | The network connection has been made, but the MQTT service is unavailable |
4 | 0x04 Connection Refused, bad user name or password | The data in the user name or password is malformed |
5 | 0x05 Connection Refused, not authorized | The client is not authorized to connect. For example, entering the incorrect password |
6-255 |
| Reserved for future use |
Message topics
Topics are used to separate messages and keep them organized based on what they are about.
There are three topic types:
Regular topics
Topics comprised of string literals: /devices
Wildcard topics
Wildcard subscription means they are subscribed to multiple topics simultaneously. There are two types:
Single level (+)
The single level wildcard (+) allows a subscription to match the topic path’s entire level.
/device/+/temp
Topic | Matches |
---|---|
/device/a/temp | ✓ |
/device/b/temp | ✓ |
/device/123/temp | ✗ |
/device/temp | ✗ |
/device/temp/a | ✗ |
Multi-level (#)
The multi-level # wildcard matches with all values following the #.
The following subscribes to every topic:
#
See this example:
/device/#