# Cirrus link MQTT user ACLs **URL:** \ **Category:** 3rd Party Modules\ **Tags:** ignition81\ **Created:** [May 13, 2025, 11:36am UTC](https://forum.inductiveautomation.com/t/cirrus-link-mqtt-user-acls/106181 "2025-05-13T11:36:54Z")\ **Posts on this page:** 19\ **Page:** 1
**Author:** ![Ahmed\_badawi1](https://avatars.discourse-cdn.com/v4/letter/a/58f4c7/32.png) [@Ahmed\_badawi1](https://forum.inductiveautomation.com/u/Ahmed_badawi1)\ **Post date:** [May 13, 2025, 11:36am UTC](https://forum.inductiveautomation.com/t/cirrus-link-mqtt-user-acls/106181/1 "2025-05-13T11:36:54Z")
I have a problem in configuring mqtt engine, when i create an admin user with 'RW #' , it's working fine, but when i try to give him limited access like 'RW spBv1.0/GroupID1/#' with another user, engine is disconnected and blinking between connected and disconnected. the mqtt publisher is working properly with the ACL rules, i tested it with external client and it is ok. ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/5/4/54d98cc0745a3f26f74b9a3e0e923ae38385b199.png) ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/b/5/b5e35bcbac21118e4b4d36590f8015b123abae57.png) ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/9/a/9a5fd9f0dbd99464ec9e8c25913fee5b5faf2bfd.png) ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/f/e/fe0f4bdc8a184422d565b5a4daa74e7f1fb4c601.png) ---
**Author:** ![TChenier](https://avatars.discourse-cdn.com/v4/letter/t/d6d6ee/32.png) [@TChenier](https://forum.inductiveautomation.com/u/TChenier)\ **Post date:** [May 13, 2025, 2:50pm UTC](https://forum.inductiveautomation.com/t/cirrus-link-mqtt-user-acls/106181/2 "2025-05-13T14:50:19Z")
Did you check the Ignition logs? They're usually pretty good to giving an indication of the problem. Also, do you have the Primary Host configured in Engine? That would result in Engine publishing on a topic not allowed by the new ACL. ---
**Author:** ![Ahmed\_badawi1](https://avatars.discourse-cdn.com/v4/letter/a/58f4c7/32.png) [@Ahmed\_badawi1](https://forum.inductiveautomation.com/u/Ahmed_badawi1)\ **Post date:** [May 13, 2025, 3:21pm UTC](https://forum.inductiveautomation.com/t/cirrus-link-mqtt-user-acls/106181/3 "2025-05-13T15:21:20Z")
The log says that engine server failed to subscribe to topics, What kind of primary host configuration should i check?, i am using default set with enabled primary host id ---
**Author:** ![patrixmith](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/patrixmith/32/75926_2.png) [@patrixmith](https://forum.inductiveautomation.com/u/patrixmith)\ **Post date:** [May 13, 2025, 3:42pm UTC](https://forum.inductiveautomation.com/t/cirrus-link-mqtt-user-acls/106181/4 "2025-05-13T15:42:42Z")
ACLs are case sensitive, so you have to make sure they are perfect. But, can you show a screenshot of your Transmitter configuration (on the Edge side - MQTT Transmission)? Where are you configuring GroupID1, GroupID2, and GroupID3? You aren't showing those in your screenshots. If those Sparkplug IDs don't exist, then it might be why you are getting that error. ---
**Author:** ![TChenier](https://avatars.discourse-cdn.com/v4/letter/t/d6d6ee/32.png) [@TChenier](https://forum.inductiveautomation.com/u/TChenier)\ **Post date:** [May 13, 2025, 3:55pm UTC](https://forum.inductiveautomation.com/t/cirrus-link-mqtt-user-acls/106181/5 "2025-05-13T15:55:01Z")
You may need to add a custom Group Id filter to Engine (under Namespaces tab). Otherwise, it makes a subscription of 'spBv1.0/#', which would fail. ---
**Author:** ![patrixmith](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/patrixmith/32/75926_2.png) [@patrixmith](https://forum.inductiveautomation.com/u/patrixmith)\ **Post date:** [May 13, 2025, 3:58pm UTC](https://forum.inductiveautomation.com/t/cirrus-link-mqtt-user-acls/106181/6 "2025-05-13T15:58:21Z")
Yeah, that was going to be my next suggestion after confirming GroupID1, GroupID2, and GroupID3 actually exist. @Ahmed_badawi1, on the Engine gateway, go to MQTT Engine Settings \> Namespaces tab \> Default tab \> Click Edit on SparkPlug B \> Filtered tab \> Click 'Create new Topic Token Filter...", and then create a filter for GroupID1, GroupID2, and GroupID3 separately. These Namespaces are required for ACLs to access specific Sparkplug IDs. ---
**Author:** ![Ahmed\_badawi1](https://avatars.discourse-cdn.com/v4/letter/a/58f4c7/32.png) [@Ahmed\_badawi1](https://forum.inductiveautomation.com/u/Ahmed_badawi1)\ **Post date:** [May 13, 2025, 4:11pm UTC](https://forum.inductiveautomation.com/t/cirrus-link-mqtt-user-acls/106181/7 "2025-05-13T16:11:28Z")
Yes, i created GroupID,NodeID,DeviceID for each transmitter, unfortunately server is not available now but the sparkplug IDs is GroupID1,2,3/NodeID1,2,3/DeviceID1,2,3 for each transmitter 1,2,3, About filters, i didn't try it but admin user with RW # is working properly without filters! ---
**Author:** ![patrixmith](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/patrixmith/32/75926_2.png) [@patrixmith](https://forum.inductiveautomation.com/u/patrixmith)\ **Post date:** [May 13, 2025, 4:13pm UTC](https://forum.inductiveautomation.com/t/cirrus-link-mqtt-user-acls/106181/8 "2025-05-13T16:13:11Z")
Yes, admin user will work without filters because it is a wildcard subscription to everything. I'm pretty sure the issue is the Namespace Filter for GroupID1/2/3. ---
**Author:** ![Ahmed\_badawi1](https://avatars.discourse-cdn.com/v4/letter/a/58f4c7/32.png) [@Ahmed\_badawi1](https://forum.inductiveautomation.com/u/Ahmed_badawi1)\ **Post date:** [May 13, 2025, 4:15pm UTC](https://forum.inductiveautomation.com/t/cirrus-link-mqtt-user-acls/106181/9 "2025-05-13T16:15:21Z")
![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/c/e/ced350dd3e1dee7abcfd0e97b5ecac50ecaafa69.png) this is transmitter configurations ---
**Author:** ![patrixmith](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/patrixmith/32/75926_2.png) [@patrixmith](https://forum.inductiveautomation.com/u/patrixmith)\ **Post date:** [May 13, 2025, 4:16pm UTC](https://forum.inductiveautomation.com/t/cirrus-link-mqtt-user-acls/106181/10 "2025-05-13T16:16:25Z")
Yep, that looks good. Thanks. Try configuring those Namespace Filters on the Engine side and let us know if that solves your problem. ---
**Author:** ![patrixmith](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/patrixmith/32/75926_2.png) [@patrixmith](https://forum.inductiveautomation.com/u/patrixmith)\ **Post date:** [May 13, 2025, 4:19pm UTC](https://forum.inductiveautomation.com/t/cirrus-link-mqtt-user-acls/106181/11 "2025-05-13T16:19:26Z")
Also, here is Cirrus-Link's documentation: ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/0/d/0dcd3542f9102ce09b9600cb820411c72bd873b1.png) > **[MQTT Distributor Access Control Lists - MQTT Modules for Ignition 8.x -...](https://docs.chariot.io/display/CLD80/MQTT+Distributor+Access+Control+Lists#MQTTDistributorAccessControlLists-ConnectusingaLWTnotallowedbytheACL)** > **[ME: Configuration - MQTT Modules for Ignition 8.x - Confluence](https://docs.chariot.io/display/CLD80/ME%3A+Configuration#ME:Configuration-NamespacesDefaultFilters)** ---
**Author:** ![Ahmed\_badawi1](https://avatars.discourse-cdn.com/v4/letter/a/58f4c7/32.png) [@Ahmed\_badawi1](https://forum.inductiveautomation.com/u/Ahmed_badawi1)\ **Post date:** [May 13, 2025, 4:35pm UTC](https://forum.inductiveautomation.com/t/cirrus-link-mqtt-user-acls/106181/12 "2025-05-13T16:35:50Z")
![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/b/1/b1b4febfc01df17f9a8ed4955cc420f986dd5b8d.png) this is the filters, but the problem is still existed, ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/e/0/e00ab87eabf4a2c613a61587ef03507e25bc159d.png) this is the logs, the details of the message is "org.eclipse.paho.client.mqttv3.MqttSecurityException: Not authorized to connect at org.eclipse.paho.client.mqttv3.internal.ExceptionHelper.createMqttException(ExceptionHelper.java:28) at org.eclipse.paho.client.mqttv3.internal.ClientState.notifyReceivedAck(ClientState.java:1053) at org.eclipse.paho.client.mqttv3.internal.CommsReceiver.run(CommsReceiver.java:151) at java.base/java.lang.Thread.run(Unknown Source)" ---
**Author:** ![patrixmith](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/patrixmith/32/75926_2.png) [@patrixmith](https://forum.inductiveautomation.com/u/patrixmith)\ **Post date:** [May 13, 2025, 4:53pm UTC](https://forum.inductiveautomation.com/t/cirrus-link-mqtt-user-acls/106181/13 "2025-05-13T16:53:41Z")
That's failing on topic: `spBv1.0/STATE/Default_Set_Primary_Host_ID_user1`. It's not failing on GroupID1, so I think we are getting closer. Try changing your ACL to this: `R #, W spBv1.0/GroupID1/#`. This would allow user1 to read all, but only write to GroupID1. ---
**Author:** ![TChenier](https://avatars.discourse-cdn.com/v4/letter/t/d6d6ee/32.png) [@TChenier](https://forum.inductiveautomation.com/u/TChenier)\ **Post date:** [May 13, 2025, 5:24pm UTC](https://forum.inductiveautomation.com/t/cirrus-link-mqtt-user-acls/106181/14 "2025-05-13T17:24:55Z")
You'll also need to add `W spBv1.0/STATE/#` to the ACL. Or disable Primary Host in Engine. ---
**Author:** ![Ahmed\_badawi1](https://avatars.discourse-cdn.com/v4/letter/a/58f4c7/32.png) [@Ahmed\_badawi1](https://forum.inductiveautomation.com/u/Ahmed_badawi1)\ **Post date:** [May 13, 2025, 5:41pm UTC](https://forum.inductiveautomation.com/t/cirrus-link-mqtt-user-acls/106181/15 "2025-05-13T17:41:06Z")
now there is an error in log ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/c/b/cb5e67c649bdc342283c9045d5fcb8603973e0ef.png) ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/1/b/1b0cbd9b16d51d2aa830513cadd80c6c852703e8.png) i also disabled primary host id for engine and transmission sets ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/b/0/b0f5ebb1387a78058a9499636a77cc865b354670.png) ---
**Author:** ![patrixmith](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/patrixmith/32/75926_2.png) [@patrixmith](https://forum.inductiveautomation.com/u/patrixmith)\ **Post date:** [May 13, 2025, 6:49pm UTC](https://forum.inductiveautomation.com/t/cirrus-link-mqtt-user-acls/106181/16 "2025-05-13T18:49:35Z")
It looks like user1 is trying to write to GroupID3. You may want to open a support ticket with Cirrus-Link at this point. They respond quickly and can walk you through all of this and explain when to turn on or off certain things better than us volunteers. > **[Contact Support - Cirrus Link Solutions - Worldwide - United States](https://cirrus-link.com/contact-support/)** > > Do you have questions, comments, concerns or feedback? Please reach out to us. ---
**Author:** ![Ahmed\_badawi1](https://avatars.discourse-cdn.com/v4/letter/a/58f4c7/32.png) [@Ahmed\_badawi1](https://forum.inductiveautomation.com/u/Ahmed_badawi1)\ **Post date:** [May 13, 2025, 7:16pm UTC](https://forum.inductiveautomation.com/t/cirrus-link-mqtt-user-acls/106181/17 "2025-05-13T19:16:33Z")
Ok, thanks, i will post the solution when it's solved inshallah ---
**Author:** ![Ahmed\_badawi1](https://avatars.discourse-cdn.com/v4/letter/a/58f4c7/32.png) [@Ahmed\_badawi1](https://forum.inductiveautomation.com/u/Ahmed_badawi1)\ **Post date:** [May 15, 2025, 7:42am UTC](https://forum.inductiveautomation.com/t/cirrus-link-mqtt-user-acls/106181/18 "2025-05-15T07:42:39Z")
Hi,the problem is finally solved, 1- i had to modify the ACL and add all topics, even custom namespaces ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/4/5/453a5dd9fb3cd7b8657d23d39989680f3e034d17.png) 2- i had to remove unused namespace filters(ex: only GroupID1 for user 1) ---
**Author:** ![patrixmith](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/patrixmith/32/75926_2.png) [@patrixmith](https://forum.inductiveautomation.com/u/patrixmith)\ **Post date:** [May 15, 2025, 3:29pm UTC](https://forum.inductiveautomation.com/t/cirrus-link-mqtt-user-acls/106181/19 "2025-05-15T15:29:41Z")
Excellent. Glad you got it working and thanks for reporting back. Hope you had a good experience with Cirrus-Link support. Those guys are pretty cool...