<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><span style="font-size: 14px;" class="">Hello,</span><div class=""><br class=""></div><div class=""><span style="color: rgb(36, 41, 46); font-family: -apple-system, system-ui, 'Segoe UI', Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 14px; font-variant-ligatures: normal; orphans: 2; widows: 2; background-color: rgb(255, 255, 255);" class="">I am using PSKs to connect to my VMQTT/EMQTT instance, and need to modify the source code or write a plugin to set my clientid or username = psk-identity, thus creating a “TLS-PSK based authentication”. To be clear, my connection using PSKs works, and I can connect and send encrypted messages using an incredibly basic user_lookup_fun like so:</span></div><div class=""><span style="font-family: -apple-system, system-ui, 'Segoe UI', Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 14px; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(255, 255, 255);" class=""><br class=""></span></div><div class=""><span style="font-family: -apple-system, system-ui, 'Segoe UI', Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 14px; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(255, 255, 255);" class="">user_lookup(psk, _Username, UserState) -></span></div><div class=""><span style="color: rgb(36, 41, 46); font-family: -apple-system, system-ui, 'Segoe UI', Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 14px; font-variant-ligatures: normal; orphans: 2; widows: 2; background-color: rgb(255, 255, 255);" class=""><pre style="white-space: pre-wrap; color: rgb(0, 0, 0); font-variant-ligatures: normal;" class=""> {ok, UserState}.</pre><div class=""><br class=""></div><div class="">The problem here is that I have no reference to the calling process, and can’t modify the ClientID or username, so I cannot authenticate users without sending an additional username and password. If someone gained access to my private key, they would be able to publish and subscribe to any topic because the psk_identity is not currently used in authentication.</div><div class=""><br class=""></div><div class="">The way I see it, there are two options:</div><div class="">1) Set the ClientID in user lookup -> this is impossible because I have no reference to the calling process</div><div class="">2) Find where the ClientID is set, use a function to get the psk-identity from the listening process, and then set the ClientID = psk-identity</div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">For option 2, my first goal is to just get the psk_identity from somewhere in the code. I tried to use the erlang library function <b class="">ssl_connection:connection_information(Client#mqtt_client.client_pid)]) </b>on the client.connected hook,</div><div class="">But this process hangs and does not return any value.</div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">Can anyone point me in the right direction for getting the TLS information from within the code? </div><div class="">Otherwise, is there any way that I could go about option 1) without knowing anything about the calling process?</div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">Thank you in advance!</div><div class=""><br class=""></div></span></div></body></html>