7.4 Authorization by the MQTT Server

This procedure describes how an MQTT Server authorizes topics to which an MQTT Client may subscribe. The M2M Service Provider is responsible for configuring the MQTT Server with the relevant information used in these authorization decisions:

1. In the case that the MQTT Server determines that the MQTT Client represents a CSE, and if the CSE has been assigned a CSE's SP-Relative-CSE-ID (which is denoted by <my-SP-Relative-CSE-ID>), then:
   • a) the MQTT Server authorizes the MQTT Client to subscribe to the topic /oneM2M/req/+/<my-SP-Relative-CSE-ID>/<type> and
   • b) for the set of <Registree ID Stem> values corresponding to SP-Relative CSE-ID or AE-ID Stem values of zero or more CSE(s) and/or AE(s) currently registered to this CSE (and known to the MQTT Server), the MQTT Server authorizes the MQTT Client to subscribe to the topics /oneM2M/resp/<Registree ID Stem>/<my-SP-Relative-CSE-ID>/<type> and

   • c) if this CSE is registered to a CSE and the SP-Relative-CSE-ID of this CSE is <Registrar-SP-Relative-CSE-ID > then the MQTT Server authorizes the MQTT Client to perform the following:

     • i) to subscribe to:

       /oneM2M/resp/<my-SP-Relative-CSE-ID>/<Registrar-SP-Relative-CSE-ID>/<type> and - ii) to publish to:

       /oneM2M/resp/<my-SP-Relative-CSE-ID>/<Registrar-SP-Relative-CSE-ID>/<type>. 2. In the case that the MQTT Server determines that the MQTT Client represents an AE which has been assigned an S-Type AE-ID Stem equal to < AE-ID-Stem>, then: - a) If the MQTT Server determines that the AE is currently registered, and the AE's Registrar CSE has SP-Relative-CSE-ID equal to <Registrar-SP-Relative-CSE-ID> then the MQTT Server authorizes the MQTT Client to perform the following: - i) to subscribe to /oneM2M/resp/<AE-ID-Stem>/<Registrar-SP-Relative-CSE-ID>/<type> - ii) to publish to /oneM2M/req/<AE-ID-Stem>/<Registrar-SP-Relative-CSE-ID>/<type> - iii) to subscribe to /oneM2M/req/<Registrar-SP-Relative-CSE-ID>/<AE-ID-Stem>/<type> and - iv) to publish to /oneM2M/resp/<Registrar-SP-Relative-CSE-ID>/<AE-ID-Stem>/<type>. - b) Otherwise, the MQTT Server authorizes the MQTT Client to perform the following: - i) to subscribe to /oneM2M/reg_resp/<AE-ID-Stem-Credential-ID>/+/<type> and - ii) to publish to /oneM2M/reg_req/<AE-ID-Stem-Credential-ID>/+/<type>

     where <AE-ID-Stem-Credential-ID> is generated from <AE-ID-Stem> as per TS-0003 [7]. 3. In the case that the MQTT Server determines that the MQTT Client represents a AE with C-Type AE-ID-Stem equal to <AE-ID-Stem> (which implies that the AE is registered), and the AE's Registrar CSE has SP-Relative-CSE-ID equal to <Registrar-SP-Relative-CSE-ID> then the MQTT Server authorizes the MQTT Client to perform the following: - a) to subscribe to /oneM2M/resp/<AE-ID-Stem>/<Registrar-SP-Relative-CSE-ID>/<type> - b) to publish to /oneM2M/req/<AE-ID-Stem>/<Registrar-SP-Relative-CSE-ID>/<type> - c) to subscribe to /oneM2M/req/<Registrar-SP-Relative-CSE-ID>/<AE-ID-Stem>/<type> and - d) to publish to /oneM2M/resp/<Registrar-SP-Relative-CSE-ID>/<AE-ID-Stem>/<type>. 4. In all other cases, the MQTT Server authorizes the MQTT Client to perform the following: - a) to subscribe to /oneM2M/reg_resp/<Credential-ID>/+/<type> and - b) to publish to /oneM2M/reg_req/<Credential-ID>/+/<type>

where <Credential-ID> is obtained from the Security Association Establishment procedure as described in TS-0003 [7].