"Not authorized" Errors and Empty Permissions in Enterprise Security Extension Configuration

You may encounter the following issues when using HiveMQ with the Enterprise Security Extension (ESE):

1. "Not authorized" error when a client attempts to publish or subscribe.

2. The HiveMQ access.log show successful authorisation but no permissions assigned:

These symptoms indicate that while the client is authenticated correctly, it is not authorized due to incorrect or missing permission configuration.

This behavior can occur if:

1. The ESE configuration uses role-based permissions, but user-specific permissions were intended or vice versa

2. Incorrect roles or permissions are assigned to the user in the SQL database or File-realm. Check the SQL backend to verify the user has the correct permissions set.

3. The ESE is misconfigured to retrieve permissions via roles when it should use direct user permissions.

Misconfigured example:

This will cause ESE to fetch permissions based on roles, and if none are found or mapped incorrectly, it returns permissions [], causing "Not authorized" errors on publish or subscribe.

If you are using user-specific permissions (not roles), update your ESE configuration as follows:

This ensures that the broker uses the user’s explicit permissions instead of attempting to derive them from roles.