[
{
	"uri": "https://www.eclipse.org/hono/docs/",
	"title": "Documentation",
	"tags": [],
	"description": "",
	"content": " Documentation Learn about Hono\u0026trade; and look-up details.\n"
},
{
	"uri": "https://www.eclipse.org/hono/docs/concepts/",
	"title": "Concepts",
	"tags": [],
	"description": "",
	"content": " Concepts Understand the concepts behind Hono\u0026trade;.\n"
},
{
	"uri": "https://www.eclipse.org/hono/docs/concepts/device-identity/",
	"title": "Device Identity",
	"tags": [],
	"description": "",
	"content": "This page describes how devices are represented and identified throughout Hono and its APIs.\nThe main purpose of Hono is to provide a uniform API for applications to interact with devices, regardless of the particular communication protocol the devices natively use. In order to do so, Hono uses a unique logical identifier to refer to each device individually.\nHono does not make any assumptions about the format of a device identifier (or device-id for short). It basically is a string which is defined at the time a device is registered. Once registered, the device can be referred to by this identifier when using Hono\u0026rsquo;s APIs until the device is unregistered.\nTenant Hono supports the logical partitioning of devices into groups called tenants. Each tenant has a unique identifier, a string called the tenant-id, and can be used to provide a logical grouping of devices belonging e.g. to the same application scope or organizational unit. Each device can thus be uniquely identified by the tuple (tenant-id, device-id). This tuple is broadly used throughout Hono\u0026rsquo;s APIs when addressing a particular device.\nDevice Registration Hono components use the Device Registration API to access device registration information. The API defines the mandatory to implement assert Registration operation for verifying a device\u0026rsquo;s registration status. In addition to that, it defines optional CRUD operations to register, update and remove device registration information. These operations are optional because Hono components do not require them during runtime. From a Hono perspective, it is not important how devices have been registered or how they are managed.\nIn many real world scenarios there will already be a component in place which keeps track of devices and which supports the particular provisioning process being used to bring devices into life. In such cases it makes sense to simply implement the mandatory operation of Hono\u0026rsquo;s Device Registration API as a facade on top of the existing component.\nFor demonstration purposes, Hono comes with a simple default implementation of the Device Registration API which keeps all data in memory only. This component implements all mandatory and optional operations but is not supposed to be used in production scenarios.\nDevice Authentication Devices connect to protocol adapters in order to publish telemetry data or events. Downstream applications consuming this data often take particular actions based on the content of the messages. Such actions may include simply updating some statistics, e.g. tracking the average room temperature, but may also trigger more serious activities like shutting down a power plant. It is therefore important that applications can rely on the fact that the messages they process have in fact been produced by the device indicated by a message\u0026rsquo;s source address.\nHono relies on protocol adapters to establish a device\u0026rsquo;s identity before it is allowed to publish telemetry data or send events. Conceptually, Hono distinguishes between two identities\n an identity associated with the authentication credentials (termed the authentication identity or auth-id), and an identity to act as (the device identity or device-id).  A device therefore presents an auth-id as part of its credentials during the authentication process which is then resolved to a device identity by the protocol adapter on successful verification of the credentials.\nIn order to support the protocol adapters in the process of verifying credentials presented by a device, the Credentials API provides means to look up secrets on record for the device and use this information to verify the credentials.\nThe Credentials API supports registration of multiple sets of credentials for each device. A set of credentials consists of an auth-id and some sort of secret information. The particular type of secret determines the kind of information kept. Please refer to the Standard Credential Types defined in the Credentials API for details. Based on this approach, a device may be authenticated using different types of secrets, e.g. a hashed password or a pre-shared key, depending on the capabilities of the device and/or protocol adapter.\nOnce the protocol adapter has resolved the device-id for a device, it uses this identity when referring to the device in all subsequent API invocations, e.g. when forwarding telemetry messages downstream to the AMQP Messaging Network.\n"
},
{
	"uri": "https://www.eclipse.org/hono/docs/concepts/tenancy/",
	"title": "Multi-Tenancy",
	"tags": [],
	"description": "",
	"content": " Hono is designed to structure the set of all internally managed data and data streams into strictly isolated subsets. This includes the registration data and credentials of devices, internal users that are used for authentication, and the Business Applications that are part of such subsets as well.\nThis way of strict isolation is generally known as multi-tenancy, where a tenant is the term for such a subset. Such an isolation is essential for enabling a scalable distributed architecture to handle independent subsets as if each subset had its own installation (which would be much harder to maintain and would not benefit from runtime cost sharing).\nHono\u0026rsquo;s multi-tenancy concept is based on handling tenants as own entities. All functionality of Hono is provided in the context of a previously created tenant - except the creation of a tenant itself.\nIn the following the different aspects of multi-tenancy in Hono are addressed and a full overview of the concept is given.\nThe Tenant API By means of the Tenant API Hono handles tenants as own entities.\nThe API defines how to retrieve the details of a specific tenant. This offers the possibility to handle arbitrary properties on the level of a tenant (see e.g. Protocol adapter configuration).\nFor convenience, there are CRUD operations for the handling of tenants, which can be found in the Device Registry.\nProtocol Adapters respect the Tenant API When a device connects to one of Hono\u0026rsquo;s protocol adapters, the adapter determines the tenant this device belongs to. How this is done is described in the User Guide.\nAfter the tenant is determined, the adapter retrieves the details of the determined tenant by means of the Tenant API. Only if the tenant exists and is enabled the adapter further processes the data of the device that is connecting. Otherwise the connection will be closed.\nProtocol Adapter Configuration Protocol adapters retrieve parts of their configuration on a tenant level by using the details of the determined tenant.\nThis includes e.g. if a specific protocol adapter is enabled at all for this tenant, allowing to define tenants with only a subset of Hono\u0026rsquo;s functionality. This feature is foreseen to be especially important for production setups.\nExample: a tenant that\n can use the MQTT protocol adapter but is not allowed to use the HTTP protocol adapter  Please refer to the Tenant API to find out which protocol adapter properties are configurable on a tenant level. The number of such properties may grow during further development of Hono.\nAMQP 1.0 Endpoints The AMQP 1.0 endpoints for all APIs of Hono are scoped to a tenant, by using the scheme \u0026lt;api-name\u0026gt;/TENANT/....\nExamples:\n telemetry/TENANT registration/TENANT  etc.\nThis separates the AMQP endpoints from each other on a tenant level.\nThe only exception to this is the Tenant API, which does not follow this scheme since it is addressing the tenants themselves.\nDevices and Tenants All devices of Hono belong to exactly one tenant, so any data is sent in the context of the tenant a device belongs to.\nIt is important here to focus on Hono\u0026rsquo;s view of a device: it is on a logical level, meaning a device is created in the context of a tenant purely by using Hono\u0026rsquo;s Credentials and Device Registration API.\nUsually a physical device will be created in Hono as exactly one logical device, and thus belongs to exactly one tenant.\nThe following diagram shows the relation between tenants, devices and their credentials:\n  Tenants, Devices and Credentials   Tenant based Flow Control An important detail in Hono\u0026rsquo;s architecture is that data sent downstream is transported via the tenant scoped AMQP 1.0 links from the protocol adapters to the AMQP 1.0 network.\nEach tenant has its own pair of AMQP 1.0 links and is treated independently from other tenants regarding the back pressure mechanism that AMQP 1.0 offers.\nThis enables a Business application to limit the rate at which it consumes AMQP 1.0 messages per tenant.\nAuthorization at Tenant Level Hono\u0026rsquo;s components authenticate each other by means of the Authentication API.\nThe returned token for a successful authentication contains authorization information that is addressing the AMQP 1.0 endpoints. Since the endpoints (as outlined above) are scoped to a tenant, this enables to configure tenants that are authorized to only a subset of Hono\u0026rsquo;s full functionality.\nExample: a tenant (defined by means of authorization configuration) that\n is allowed to send telemetry data downstream but is not allowed to send event data  This is done by not including the event endpoint in the authorization token for these tenants.\nBusiness Applications and Tenants The northbound Business applications are always connecting to the AMQP 1.0 endpoints of Hono.\nBy means of the authentication and authorization setup and the fact that the endpoints are scoped to a tenant, the Business application is only acting in the context of one tenant.\nSeparation of Tenants Tenants are separated from each other in all of Hono\u0026rsquo;s components.\nHere is a summary of how this is implemented:\n the registration of devices are strictly scoped to a tenant the credentials of devices are strictly scoped to a tenant protocol adapters can be enabled/disabled for a tenant the downstream data flow is isolated for every tenant Business applications need to authenticate to the AMQP 1.0 network and are by that mechanism scoped to their tenant  Hints for Production To be flexible for the different needs of production setups, Hono tries to make as few assumptions about the combination of the different APIs as possible. This means e.g. that the Device Registry does not enforce referential integrity of the APIs:\n devices can be created for a tenant that is not existing (yet) credentials can be created for a tenant and/or a device that is not existing (yet) tenants can be deleted and leave their scoped devices and credentials still in the configuration (which may not be usable anymore, since the tenant is missing)  These are points that production setups may want to implement differently.\n"
},
{
	"uri": "https://www.eclipse.org/hono/docs/concepts/device-notifications/",
	"title": "Device Notifications",
	"tags": [],
	"description": "",
	"content": "Business Applications need to know when an attempt to send a command to device is feasible, e.g. because the device is then known to be connected to a protocol adapter. Devices and Protocol Adapters can indicate to Business Applications a device\u0026rsquo;s intent to e.g. receive commands using specific notifications.\nTime until Disconnect Notification Devices and Protocol Adapters can notify an application about the fact that a device is connected and ready to receive one or more commands by means of including a time \u0026lsquo;til disconnect (ttd) property in downstream AMQP 1.0 messages containing data originating from a connected device.\nThe ttd property value indicates the time that the device will stay connected to the protocol adapter. Using this value together with the creation-time of the message, an application can determine whether an attempt to send a command to the device has a reasonable chance of succeeding.\nThe ttd property can be included in any regular telemetry or event message. However, if a device does not have any telemetry data or event to upload to the adapter, it can also use an empty notification instead.\nHono includes utility classes that application developers can use to register a callback to be notified when a device sends a ttd notification. See Hono\u0026rsquo;s example module for details where such a notification callback is used.\nPlease refer to the Telemetry API and the Event API for further details.\nThe following table defines the possible values of the ttd property and their semantics:\n   TTD Description     \u0026gt; 0 The value indicates the number of seconds that the device will stay connected. Devices using a stateless protocol like HTTP will be able to receive a single command only before disconnecting.   -1 The device is now connected (i.e. available to receive upstream messages) until further notice.   0 The device is now disconnected (i.e. not available anymore to receive upstream messages).    Determining a Device\u0026rsquo;s Connection Status An application receiving a downstream message containing a ttd property can check if the device is currently connected (and thus ready to receive a command) by\n adding the ttd value to the creation-time to determine the expiration time, and then comparing the current time with the expiration time  If the current time is after the expiration time, the device should be assumed to already have disconnected again.\nSource of the ttd Value While it seems to be natural that a device itself indicates when it is ready to receive a command, it may not always be possible or desirable to do so.\nA device could e.g. be not capable to specify the value for ttd in it\u0026rsquo;s message, or all devices of a particular setup would always use the same value for ttd, so it would not make much sense to provide this value always again.\nAdditionally different protocols may or may not let a sender set specific values for a message, so a device using a specific protocol may not be able to provide a value for the ttd property at all.\nFor these reasons there are (resp. may be) additional ways of setting the value of ttd:\n Hono\u0026rsquo;s Tenant and Device Registration APIs support the inclusion of default values for application-properties in the AMQP 1.0 message. By these means a device can be configured to always have a specific value for ttd. In a future extension there may be a configuration value per tenant and protocol adapter that sets the value of ttd if it was not provided by other means already (like provided to the protocol adapter or by setting a default value).   Hono\u0026rsquo;s HTTP protocol adapter Hono\u0026rsquo;s HTTP protocol adapter supports the setting of the ttd value in requests explicitly - please refer to the HTTP Adapter for details.\nAlternatively the default property values for devices from the Device Registry can be used (described above).\nHono\u0026rsquo;s MQTT protocol adapter The MQTT protocol adapter automatically sends a Time until disconnect notification with a ttd value of -1 for a device that subscribes to the appropriate command topic (refer to the MQTT Adapter user guide for details).\nWhen a device unsubscribes again, the adapter automatically sends a Time until disconnect notification with a ttd value of 0.\nExamples The following sequence diagram shows a Time until disconnect notification while sending a telemetry message downstream via the HTTP protocol adapter:\n  Device command readiness with telemetry data   The following sequence diagram shows a Time until disconnect notification by sending an empty event message downstream via the HTTP protocol adapter:\n  Device command readiness with explicit event  "
},
{
	"uri": "https://www.eclipse.org/hono/docs/concepts/command-and-control/",
	"title": "Command &amp; Control",
	"tags": [],
	"description": "",
	"content": "Business applications can send commands to devices following the Command \u0026amp; Control API. This concept page describes how this API is used by applications to send commands to devices that connected to one of Hono\u0026rsquo;s protocol adapters.\nCommands can be sent following a request/response or a one-way pattern. For Request/Response commands, there is always a response expected from the device.\nCommand \u0026amp; Control over HTTP Adapter The following sequence diagrams give an overview of a device connecting via HTTP, which gets a command from the business application in the response to a downstream message - being an arbitrary event in this example. The application and the adapter connect to the AMQP Network, which forwards the transfer - for clarity this is not shown in the diagram.\n(Request/Response) command over HTTP:\n  Command \u0026amp; Control over HTTP Adapter   One-way command over HTTP:\n  One-way Command \u0026amp; Control over HTTP Adapter   With the hono-ttd request parameter in (1) the device indicates it will stay connected for max. 30 seconds. In the shown example this means that it can handle the response to the HTTP request for up to 30 seconds before considering the request being expired.\nInternally the application is notified that there is a time interval of 30 seconds to send a command (see Device notifications for details). This notification will be consumed by the application (2) and it now tries to send a command (3) to the device at the given address command/TENANT/4711. If the device is not connected or the time interval is expired already, there is no such link open and the application would get no credits so send the command.\nThe HTTP Adapter gets the command and writes it in the response of the devices send event (4), if the request was successful (status 2xx). The HTTP Adapter sets the following response headers and optionally a payload.\n   Response Header Description     hono-cmd The name of the command to execute. Any input data required will be contained in the response body.   hono-cmd-req-id Only set for Request/Response commands : The unique identifier of the command. This identifier is used to correlate the device\u0026rsquo;s response to the command with the request.    The hono-cmd is the command that should be executed by the device. Typically this command needs to be known by the device and the payload may contain additional details of the command.\nFor Request/Response commands:\nThe hono-cmd-req-id response header is needed for the command response to correlate it. It has to be sent back from the device to the adapter in a following operation (5).\nThe device needs to respond to the command (5), to inform the business application about the outcome of executing the command. For this purpose specific URIs are defined in HTTP Adapter.\nThe URI contains the hono-cmd-req-id and a status code indicating the outcome of executing the command.\nThe HTTP Adapter will send the payload of the response back to the Business Application (6) by using the receiver link that was opened by the application. If the response reached the application, the response request will be replied with 202 Accepted.\nCommand \u0026amp; Control over MQTT Adapter When the device is connected to the MQTT Adapter it receives Request/Response commands on the topic:\n command/[${tenant}]/[${device-id}]/req/${req-id}/${command}  and one-way commands on the topic:\n command/[${tenant}]/[${device-id}]/req//${command}  Authenticated devices typically subscribe to\n command/+/+/req/#  while unauthenticated devices have to fully specify their ${tenant} and ${device-id} during the subscription.\nThe response of the command will be sent by the device to\n command/[${tenant}]/[${device-id}]/res/${req-id}/${status}  If the device is authenticated, the ${tenant} and ${device-id} are left empty (resulting in 3 subsequent /s).\nThe following diagrams show the message flow for commands over the MQTT adapter:\nRequest/Response commands :\n  Request/Response Command over MQTT Adapter   one-way commands :\n  One-way Command over MQTT Adapter   Command \u0026amp; Control over AMQP Adapter When a device connected to the AMQP adapter wants to receive commands from the adapter, it opens a receiver link specifying the following source address:\n command for authenticated devices command/${tenant}/${device-id} for unauthenticated devices  Once the receiver link is opened, the AMQP adapter sends command messages to devices through the link. The subject property of the request message contains the actual command to be executed on the device.\nIf the command request is a one-way command, then the device need not publish a command response message. However, if the application expects a response, then devices should publish a response back to the application. If an anonymous sender link is already opened by the device (e.g for publishing telemetry or events), then the device can reuse that link to publish the command response message. Otherwise, the device should publish the response by opening an anonymous sender link. The device should set the message address, status and correlation-id properties of the response accordingly. Consult the table below for a list of properties that a device must set on a command response message.\nCommand Request Message Properties\nThe following properties are set by the AMQP adapter on a command message sent to devices.\n   Name Mandatory Location Type Description     subject yes properties string Contains the name of the command to be executed on a device.   reply-to yes properties string Contains the address to which the command response should be published to. This value is empty for one-way commands.   correlation-id yes properties string Contains the identifier used to correlate the response with the command request. If the command sent by the application contains a correlation-id, then that value is used as the correlation-id of the command request sent to the device. Otherwise, the value of the message-id property is used instead.    Command Response Message Properties\nIf the application expects a response (i.e the reply-to property is set), then the device should set the following properties on a command response message.\n   Name Mandatory Location Type Description     to yes properties string MUST contain the address to which the command response should be published to, which is the value of the reply-to property of the command request message.   correlation-id yes properties string MUST contain the identifier used to correlate the response with the original request, which is the value of the correlation-id of the original request.   status yes application-properties string The status code indicating the outcome of processing the command by the device. MUST be set by the device after executing the command.      Command \u0026amp; Control over AMQP Adapter  "
},
{
	"uri": "https://www.eclipse.org/hono/docs/concepts/resource-limits/",
	"title": "Resource limits",
	"tags": [],
	"description": "",
	"content": " Resource limits such as the maximum number of device connections allowed per tenant or the allowed data volume of the messages over a period of time per tenant can be set in Hono.\nHono specifies an API ResourceLimitChecks that is used by the protocol adapters for the verification of the configured resource limits. A default implementation of this API is shipped with Hono. This default implementation uses the live metrics data retrieved from a Prometheus server to verify the resource-limits, if configured. To enable and use this default implementation, please refer to the protocol adapter admin guides. Based on the requirements, a custom version of the above API can be implemented and used. The resource-limits for a tenant can be set using the tenant configuration. Please refer to the Tenant API for more details.\nConnections Limit Before accepting a new connection request from a device, the number of existing connections is checked against the configured limit by the protocol adapters. The connection request is declined if the limit is exceeded.\nThe MQTT and AMQP protocol adapters keep the connections longer opened than their counterparts such as HTTP. Thereby the MQTT and AMQP adapters are enabled to check the connection limits before accepting any new connection to a device.\nMessages Limit Hono supports limiting the number of messages that devices and north bound applications of a tenant can publish to Hono during a given time interval. Before accepting any telemetry or event or command messages from devices or north bound applications, it is checked by the protocol adapters that if the message limit is exceeded or not. The incoming message is discarded if the limit is exceeded.\nThe default prometheus based implementation uses data volume as the factor to limit the messages. The data volume already consumed by a tenant over the given time interval is compared with the configured message limit before accepting any messages.\n"
},
{
	"uri": "https://www.eclipse.org/hono/docs/concepts/connection-events/",
	"title": "Connection Events",
	"tags": [],
	"description": "",
	"content": "Hono\u0026rsquo;s protocol adapters can use connection events to indicate the connection status of a device. In particular, an adapter can notify downstream components about a newly established connection with a device or about a device having disconnected. The connection status of devices using stateful protocols like MQTT and AMQP can usually be determined quite easily because these protocols often require peers to explicitly open or close a connection and often also support a kind of heart beat which can be used to determine if a connection is still alive. However, for stateless protocols like HTTP or CoAP, there is no clear definition of what it actually means that a device is connected. It is obvious that a device is connected when it is sending an HTTP request. However, the adapter has no way of knowing if the device has gone to sleep after it has received the adapter\u0026rsquo;s response to its request.\nThat said, connection events indicating an established connection with a device can usually be taken as face value. However, connection events indicating the disconnection of a device may only represent the protocol adapters view of the device\u0026rsquo;s connection status. For example, the HTTP adapter might consider a device disconnected because it hasn\u0026rsquo;t received any requests from the device for some time. However, the device itself might as well be up and running (i.e. not sleeping) and simply have no data worth publishing.\nThe mechanism of firing connection events is pluggable with the default implementation simply forwarding connection status information to the logging framework. Hono also comes with an alternative implementation which forwards connection status information by means of Connection Events via the Events API.\n"
},
{
	"uri": "https://www.eclipse.org/hono/docs/user-guide/",
	"title": "User Guide",
	"tags": [],
	"description": "",
	"content": " User Guide Learn how to quickly send data with Hono\u0026trade; from devices to business applications \u0026ndash; as well as commands the other way round.\n"
},
{
	"uri": "https://www.eclipse.org/hono/docs/user-guide/device-registry/",
	"title": "Device Registry",
	"tags": [],
	"description": "",
	"content": "The Device Registry component provides exemplary implementations of Hono\u0026rsquo;s Tenant API, Device Registration API and Credentials API.\nAs such it exposes AMQP 1.0 based endpoints for retrieving the relevant information and persists data in the local filesystem.\nIn addition, the Device Registry also exposes HTTP resources for managing the contents of the registry according to the Device Registry HTTP API.\n Warning The Device Registry is not intended to be used in production environments. In particular, access to the HTTP resources described below is not restricted to authorized clients only.\nThe resources have been designed to provide convenient access to the registry\u0026rsquo;s content using command line tools like curl or HTTPie.\n  Managing Tenants The following sections describe the resources representing the operations of the Tenant API and how they can be used to manage tenants. Please refer to the Device Registry HTTP API for the specific elements that are explained in detail there.\nAdd a Tenant  URI: /v1/tenants/${tenantId} Method: POST Request Headers:  (required) Content-Type: application/json (no other type supported)  Request Body:  (required) A JSON object as specified by Tenant schema of the HTTP API specification.  Status Codes:  201 (Created): Tenant has been added successfully under the resource indicated by Location header. 400 (Bad Request): The tenant has not been created because the request was malformed, e .g. because the payload was malformed. The response body may contain hints regarding the cause of the problem. 409 (Conflict): A tenant with the given tenantId already exists. The request has not been processed.  Response Headers:  Location: The URI under which the newly created resource can be accessed. ETag: Version of the resource   Example\nThe following commands add some tenants with different adapter configurations:\nAdd a tenant that has all adapters set to enabled:\ncurl -i -X POST -H 'Content-Type: application/json' http://localhost:28080/v1/tenants/tenantAllAdapters HTTP/1.1 201 Created ETag: becc93d7-ab0f-48ec-ad26-debdf339cbf4 Location: /v1/tenants/tenantAllAdapters Content-Type: application/json; charset=utf-8 {\u0026quot;id\u0026quot;: \u0026quot;tenantAllAdapters\u0026quot;}  Add a tenant that can only use the MQTT adapter:\ncurl -i -X POST -H 'Content-Type: application/json' --data-binary '{ \u0026quot;adapters\u0026quot; : [ { \u0026quot;type\u0026quot; : \u0026quot;hono-mqtt\u0026quot;, \u0026quot;enabled\u0026quot; : true } ] }' http://localhost:28080/v1/tenants/tenantMqttAdapter HTTP/1.1 201 Created ETag: becc93d7-ab0f-48ec-ad26-debdf339cbf4 Location: /v1/tenants/tenantMqttAdapter Content-Type: application/json; charset=utf-8 {\u0026quot;id\u0026quot;: \u0026quot;tenantMqttAdapter\u0026quot;}  Get configuration details of a Tenant  URI: /v1/tenants/${tenantId} Method: GET Status Codes:  200 (OK): A tenant with the given identifier has been found. The response body contains the tenant data as specified by Tenant schema of the HTTP API specification. 404 (Not Found): No tenant with the given identifier is registered.   Example\nThe following command retrieves the details for the tenant tenantMqttAdapter:\ncurl -i http://localhost:28080/v1/tenants/tenantMqttAdapter HTTP/1.1 200 OK ETag: becc93d7-ab0f-48ec-ad26-debdf339cbf4 Content-Type: application/json; charset=utf-8 { \u0026quot;enabled\u0026quot; : true, \u0026quot;adapters\u0026quot; : [ { \u0026quot;type\u0026quot; : \u0026quot;hono-mqtt\u0026quot;, \u0026quot;enabled\u0026quot; : true } ] }  Update Tenant  URI: /v1/tenants/${tenantId} Method: PUT Request Headers:  (required) Content-Type: application/json (no other type supported)  Request Body:  (required) A JSON object as specified by Tenant schema of the HTTP API specification.  Status Codes:  204 (No Content): The tenant has been updated successfully. 400 (Bad Request): The tenant has not been updated because the request was malformed, e .g. because the payload was malformed. The response body may contain hints regarding the cause of the problem. 404 (Not Found): The request could not be processed because no tenant with the given identifier exists.   This resource can be used to change the configuration of a particular tenant.\nExample\nThe following command disables the MQTT adapter for devices that belong to the tenant tenantMqttAdapter:\ncurl -i -X PUT -H 'Content-Type: application/json' --data-binary '{ \u0026quot;adapters\u0026quot; : [ { \u0026quot;type\u0026quot; : \u0026quot;hono-mqtt\u0026quot;, \u0026quot;enabled\u0026quot; : true } ] }' http://localhost:28080/v1/tenants/tenantMqttAdapter HTTP/1.1 204 No Content ETag: 8919c736-30aa-40ce-a45a-830b90c4cd42 Content-Length: 0  Delete Tenant  URI: /v1/tenants/${tenantId} Method: DELETE Status Codes:  204 (No Content): The tenant with the given identifier has been deleted. 404 (Not Found): The request could not be processed because no tenant with the given identifier exists.   Example\ncurl -i -X DELETE http://localhost:28080/v1/tenants/tenantMqttAdapter HTTP/1.1 204 No Content Content-Length: 0  Managing Device Registration Information The following sections describe the resources representing the operations of the Device Registration API and how they can be used to manage device registration information. Please refer to the Device Registry HTTP API for the specific elements that are explained in detail there.\nRegister Device  URI: /v1/devices/${tenantId}/${deviceId} Method: POST Headers:  (required) Content-Type: application/json  Request Body:  (required) A JSON object as specified by Device schema of the HTTP API specification.  Status Codes:  201 (Created): Device has been registered successfully under resource indicated by Location header. 400 (Bad Request): Device has not been registered because the request was malformed, e .g. a required header is missing (the body may contain hints regarding the problem). 409 (Conflict): There already exists a device with the given ID. The request has not been processed.   Example\nThe following command registers a device with ID 4711 for tenant DEFAULT_TENANT\ncurl -i -X POST -H 'Content-Type: application/json' --data-binary '{ \u0026quot;ext\u0026quot;: { \u0026quot;ep\u0026quot;: \u0026quot;IMEI4711\u0026quot; } }' http://localhost:28080/v1/devices/DEFAULT_TENANT/4711  The response will contain a Location header containing the resource path created for the device. In this example it will look like this:\nHTTP/1.1 201 Created Location: /v1/devices/DEFAULT_TENANT/4711 ETag: becc93d7-ab0f-48ec-ad26-debdf339cbf4 Content-Type: application/json; charset=utf-8 {\u0026quot;id\u0026quot;: \u0026quot;4711\u0026quot;}  Read Device  URI: /v1/devices/${tenantId}/${deviceId} Method: GET Status Codes:  200 (OK): A device with the given identifier has been found. The response body contains the registration information as specified by Device schema of the HTTP API specification. 404 (Not Found): No device with the given identifier is registered for the given tenant.   Example\nThe following command retrieves registration data for device 4711:\ncurl -i http://localhost:28080/v1/devices/DEFAULT_TENANT/4711 HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 { \u0026quot;enabled\u0026quot;: true, \u0026quot;ext\u0026quot;: { \u0026quot;ep\u0026quot;: \u0026quot;IMEI4711\u0026quot; } }  Update Device  URI: /devices/v1/${tenantId}/${deviceId} Method: PUT Headers:  (required) Content-Type: application/json  Parameters (encoded as a JSON object in the request body): Request Body:  (required) A JSON object as specified by Device schema of the HTTP API specification. All existing registration information will be replaced by the data provided in the object.  Status Codes:  204 (No Content): Device registration data has been updated. 400 (Bad Request): Device registration has not been updated because the request was malformed, e .g. a required header is missing (the body may contain hints regarding the problem). 404 (Not Found): No device with the given identifier is registered for the given tenant.   Example\ncurl -i -X PUT -H 'Content-Type: application/json' --data-binary '{ \u0026quot;ext\u0026quot;: { \u0026quot;ep\u0026quot;: \u0026quot;IMEI4711\u0026quot;, \u0026quot;psk-id\u0026quot;: \u0026quot;psk4711\u0026quot; } }' http://localhost:28080/v1/devices/DEFAULT_TENANT/4711 HTTP/1.1 204 No Content Content-Length: 0  Delete Device  URI: /v1/devices/${tenantId}/${deviceId} Method: DELETE Status Codes:  204 (No Content): Device registration has been deleted. 404 (Not Found): No device with the given identifier is registered for the given tenant.   Example\ncurl -i -X DELETE http://localhost:28080/v1/devices/DEFAULT_TENANT/4711 HTTP/1.1 204 No Content Content-Length: 0  Managing Credentials The following sections describe the resources representing the operations of the Credentials API and how they can be used to manage credentials for devices. Please refer to the Device Registry HTTP API for the specific elements that are explained in detail there.\nUpdate Credentials for a Device  URI: /v1/credentials/${tenantId}/${deviceId} Method: PUT Request Headers:  (required) Content-Type: application/json (no other type supported)  Request Body:  (required) A JSON object as specified by Credentials schema of the HTTP API specification.  Status Codes:  204 (No Content): Credentials have been updated successfully. 400 (Bad Request): The credentials have not been added because the request was malformed, e .g. because the payload did not contain required values. The response body may contain hints regarding the cause of the problem.  Response Headers:  ETag: Version of the resource   Example\nThe following command adds some hashed-password credentials from a given plain text password for device 4710 using authentication identifier sensor10:\ncurl -i -X PUT -H 'Content-Type: application/json' --data-binary '[{ \u0026quot;type\u0026quot;: \u0026quot;hashed-password\u0026quot;, \u0026quot;auth-id\u0026quot;: \u0026quot;sensor10\u0026quot;, \u0026quot;secrets\u0026quot;: [{ \u0026quot;pwd-plain\u0026quot;: \u0026quot;mylittlesecret\u0026quot; }] }]' http://localhost:28080/v1/credentials/DEFAULT_TENANT/4710 HTTP/1.1 204 No Content ETag: becc93d7-ab0f-48ec-ad26-debdf339cbf4x  This uses a convenient option which lets the Device Registry do the hashing of the password. The following command retrieves the credentials that are stored by the Device Registry as a result of the command above:\ncurl -i http://localhost:28080/v1/credentials/DEFAULT_TENANT/4710 HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 ETag: becc93d7-ab0f-48ec-ad26-debdf339cbf4x [{ \u0026quot;type\u0026quot;: \u0026quot;hashed-password\u0026quot;, \u0026quot;auth-id\u0026quot;: \u0026quot;sensor10\u0026quot;, \u0026quot;enabled\u0026quot;: true, \u0026quot;secrets\u0026quot;: [ { \u0026quot;pwd-hash\u0026quot;: \u0026quot;$2a$10$uc.qVDwXeDRE1DWa1sM9iOaY9wuevjfALGMtXmHKP.SJDEqg0q7M6\u0026quot;, \u0026quot;hash-function\u0026quot;: \u0026quot;bcrypt\u0026quot; } ] }]  The following commands add some hashed-password credentials for device 4720 using authentication identifier sensor20:\nPWD_HASH=$(echo -n \u0026quot;mylittlesecret\u0026quot; | openssl dgst -binary -sha512 | base64 -w 0) curl -i -X PUT -H 'Content-Type: application/json' --data-binary '[{ \u0026quot;type\u0026quot;: \u0026quot;hashed-password\u0026quot;, \u0026quot;auth-id\u0026quot;: \u0026quot;sensor20\u0026quot;, \u0026quot;secrets\u0026quot;: [{ \u0026quot;hash-function\u0026quot; : \u0026quot;sha-512\u0026quot;, \u0026quot;pwd-hash\u0026quot;: \u0026quot;'$PWD_HASH'\u0026quot; }] }]' http://localhost:28080/v1/credentials/DEFAULT_TENANT/4720 HTTP/1.1 204 No Content ETag: 02c99fb5-af8c-409f-8520-b405e224b27f  The following command adds an expiration date to the hashed-password credentials for authentication identifier sensor20:\nPWD_HASH=$(echo -n \u0026quot;mylittlesecret\u0026quot; | openssl dgst -binary -sha512 | base64 -w 0) curl -i -X PUT -H 'Content-Type: application/json' --data-binary '{ \u0026quot;device-id\u0026quot;: \u0026quot;4720\u0026quot;, \u0026quot;type\u0026quot;: \u0026quot;hashed-password\u0026quot;, \u0026quot;auth-id\u0026quot;: \u0026quot;sensor20\u0026quot;, \u0026quot;secrets\u0026quot;: [{ \u0026quot;hash-function\u0026quot; : \u0026quot;sha-512\u0026quot;, \u0026quot;pwd-hash\u0026quot;: \u0026quot;'$PWD_HASH'\u0026quot;, \u0026quot;not-after\u0026quot;: \u0026quot;2018-01-01T00:00:00+01:00\u0026quot; }] }' http://localhost:28080/v1/credentials/DEFAULT_TENANT/4720 HTTP/1.1 204 No Content ETag: becc93d7-ab0f-48ec-ad26-debdf339cbf4x  Multiple credentials of different type can be registered for the same authentication identifier. The following commands add psk credentials for the same device 4720 using authentication identifier sensor20:\nSHARED_KEY=$(echo -n \u0026quot;TheSharedKey\u0026quot; | base64 -w 0) curl -i -X PUT -H 'Content-Type: application/json' --data-binary '[ { \u0026quot;type\u0026quot;: \u0026quot;hashed-password\u0026quot;, \u0026quot;auth-id\u0026quot;: \u0026quot;sensor20\u0026quot;, \u0026quot;secrets\u0026quot;: [{ \u0026quot;hash-function\u0026quot; : \u0026quot;bcrypt\u0026quot;, \u0026quot;pwd-hash\u0026quot;: \u0026quot;$2a$10$uc.qVDwXeDRE1DWa1sM9iOaY9wuevjfALGMtXmHKP.SJDEqg0q7M6\u0026quot; }] }, { \u0026quot;device-id\u0026quot;: \u0026quot;4720\u0026quot;, \u0026quot;type\u0026quot;: \u0026quot;psk\u0026quot;, \u0026quot;auth-id\u0026quot;: \u0026quot;sensor20\u0026quot;, \u0026quot;secrets\u0026quot;: [{ \u0026quot;key\u0026quot; : \u0026quot;'$SHARED_KEY'\u0026quot; }] }]' http://localhost:28080/v1/credentials/DEFAULT_TENANT/4720 HTTP/1.1 204 No Content ETag: 122c971a-505a-4336-8f7d-640360e909bc  The following command deletes all credentials for device 4710:\ncurl -i -X PUT -H 'Content-Type: application/json' --data-binary '[]' http://localhost:28080/v1/credentials/DEFAULT_TENANT/4710 HTTP/1.1 204 No Content ETag: d383ba4d-1853-4d03-b322-b7ff5af05ae2  Get all Credentials for a Device  URI: /v1/credentials/${tenantId}/${deviceId} Method: GET Status Codes:  200 (OK): Credentials for the device have been found, body contains the credentials. The response body contains the registration information as specified by Credentials schema of the HTTP API specification. 404 (Not Found): No credentials for the device are registered.   Example\nThe following command retrieves credentials for device 4720:\ncurl -i http://localhost:28080/v1/credentials/DEFAULT_TENANT/4720 HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 ETag: f3449b77-2c84-4b09-8d04-2b305876e0cb {[ { \u0026quot;auth-id\u0026quot;: \u0026quot;sensor20\u0026quot;, \u0026quot;enabled\u0026quot;: true, \u0026quot;secrets\u0026quot;: [ { \u0026quot;hash-function\u0026quot;: \u0026quot;sha-512\u0026quot;, \u0026quot;pwd-hash\u0026quot;: \u0026quot;tnxz0zDFs+pJGdCVSuoPE4TnamXsfIjBEOb0rg3e9WFD9KfbCkoRuwVZKgRWInfqp87kCLsoV/HEwdJwgw793Q==\u0026quot; } ], \u0026quot;type\u0026quot;: \u0026quot;hashed-password\u0026quot; }, { \u0026quot;auth-id\u0026quot;: \u0026quot;sensor20\u0026quot;, \u0026quot;enabled\u0026quot;: true, \u0026quot;secrets\u0026quot;: [ { \u0026quot;key\u0026quot;: \u0026quot;VGhlU2hhcmVkS2V5\u0026quot; } ], \u0026quot;type\u0026quot;: \u0026quot;psk\u0026quot; } ]} "
},
{
	"uri": "https://www.eclipse.org/hono/docs/user-guide/http-adapter/",
	"title": "HTTP Adapter",
	"tags": [],
	"description": "",
	"content": "The HTTP protocol adapter exposes HTTP based endpoints for Eclipse Hono\u0026trade;\u0026rsquo;s south bound Telemetry, Event and Command \u0026amp; Control APIs.\nDevice Authentication The HTTP adapter by default requires clients (devices or gateway components) to authenticate during connection establishment. The adapter supports both the Basic HTTP authentication scheme as well as client certificate based authentication as part of a TLS handshake for that purpose.\nThe adapter tries to authenticate the device using these mechanisms in the following order\nClient Certificate When a device uses a client certificate for authentication during the TLS handshake, the adapter tries to determine the tenant that the device belongs to, based on the issuer DN contained in the certificate. In order for the lookup to succeed, the tenant\u0026rsquo;s trust anchor needs to be configured by means of registering the trusted certificate authority. The device\u0026rsquo;s client certificate will then be validated using the registered trust anchor, thus implicitly establishing the tenant that the device belongs to. In a second step, the adapter then uses the Credentials API\u0026rsquo;s get operation with the client certificate\u0026rsquo;s subject DN as the auth-id and x509-cert as the type of secret as query parameters.\nNB: The HTTP adapter needs to be configured for TLS in order to support this mechanism.\nHTTP Basic Auth The username provided in the header must have the form auth-id@tenant, e.g. sensor1@DEFAULT_TENANT. The adapter verifies the credentials provided by the client against the credentials that the configured Credentials service has on record for the client. The adapter uses the Credentials API\u0026rsquo;s get operation to retrieve the credentials on record with the tenant and auth-id provided by the device in the username and hashed-password as the type of secret as query parameters.\nThe examples below refer to devices 4711 and gw-1 of tenant DEFAULT_TENANT using auth-ids sensor1 and gw1 and corresponding passwords. The example deployment as described in the Deployment Guides comes pre-configured with the corresponding entities in its device registry component. Please refer to the Credentials API for details regarding the different types of secrets.\nNB There is a subtle difference between the device identifier (device-id) and the auth-id a device uses for authentication. See Device Identity for a discussion of the concepts.\nMessage Limits Before accepting any telemetry or event or command messages, the HTTP adapter verifies that the configured message limit is not exceeded. If the limit is exceeded then the incoming message is discarded with the status code 429 Too Many Requests.\nPublish Telemetry Data (authenticated Device)  URI: /telemetry Method: POST Request Headers:  (optional) authorization: The device\u0026rsquo;s auth-id and plain text password encoded according to the Basic HTTP authentication scheme. If not set, the adapter expects the device to present a client certificate as part of the TLS handshake during connection establishment. (required) content-type: The type of payload contained in the request body. (optional) hono-ttd: The number of seconds the device will wait for the response. (optional) qos-level: The QoS level for publishing telemetry messages. The adapter supports at most once (0) and at least once (1) QoS levels. The default value of 0 is assumed if this header is omitted.  Request Body:  (required) Arbitrary payload encoded according to the given content type.  Response Headers:  (optional) content-type: A media type describing the semantics and format of payload contained in the response body. This header will only be present if the response contains a command to be executed by the device which requires input data. (optional) hono-command: The name of the command to execute. This header will only be present if the response contains a command to be executed by the device. (optional) hono-cmd-req-id: An identifier that the device must include in its response to a command. This header will only be present if the response contains a command to be executed by the device.  Response Body:  (optional) Arbitrary data serving as input to a command to be executed by the device, if status code is 200. (optional) Error details, if status code is \u0026gt;= 400.  Status Codes:  200 (OK): The telemetry data has been accepted for processing. The response contains a command for the device to execute. 202 (Accepted): The telemetry data has been accepted for processing. Note that if the qos-level request header is omitted (at most once semantics), this status code does not mean that the message has been delivered to any potential consumer. However, if the QoS level header is set to 1 (at least once semantics), then the adapter waits for the message to be delivered and accepted by a downstream consumer before responding with this status code. 400 (Bad Request): The request cannot be processed. Possible reasons for this include:  The content type header is missing. The request body is empty. The QoS header value is invalid.  401 (Unauthorized): The request cannot be processed because the request does not contain valid credentials. 403 (Forbidden): The request cannot be processed because the device\u0026rsquo;s registration status cannot be asserted. Possible reasons for this include:  The given tenant is not allowed to use this protocol adapter.  404 (Not Found): The request cannot be processed because the device is disabled or does not exist. 429 (Too Many Requests): The request cannot be processed because the tenant\u0026rsquo;s message limit for the current period is exceeded. 503 (Service Unavailable): The request cannot be processed because there is no consumer of telemetry data for the given tenant connected to Hono.   This is the preferred way for devices to publish telemetry data. It is available only if the protocol adapter is configured to require devices to authenticate (which is the default).\nExamples\nPublish some JSON data for device 4711:\ncurl -i -u sensor1@DEFAULT_TENANT:hono-secret -H 'content-type: application/json' --data-binary '{\u0026quot;temp\u0026quot;: 5}' http://127.0.0.1:8080/telemetry HTTP/1.1 202 Accepted content-length: 0  Publish some JSON data for device 4711 using at least once QoS:\ncurl -i -u sensor1@DEFAULT_TENANT:hono-secret -H 'content-type: application/json' -H 'QoS-Level: 1' --data-binary '{\u0026quot;temp\u0026quot;: 5}' http://localhost:8080/telemetry HTTP/1.1 202 Accepted content-length: 0  Publish some JSON data for device 4711, indicating that the device will wait for 10 seconds to receive the response:\ncurl -i -u sensor1@DEFAULT_TENANT:hono-secret -H 'content-type: application/json' -H 'hono-ttd: 10' --data-binary '{\u0026quot;temp\u0026quot;: 5}' http://localhost:8080/telemetry HTTP/1.1 200 OK hono-command: set hono-cmd-req-id: 1010a7249aa5-f742-4376-8458-bbfc88c72d92 content-length: 23 { \u0026quot;brightness\u0026quot; : 87 }  Publish some JSON data for device 4711 using a client certificate for authentication:\n# in base directory of Hono repository: curl -i --cert demo-certs/certs/device-4711-cert.pem --key demo-certs/certs/device-4711-key.pem --cacert demo-certs/certs/trusted-certs.pem -H 'content-type: application/json' --data-binary '{\u0026quot;temp\u0026quot;: 5}' https://localhost:8443/telemetry HTTP/1.1 202 Accepted content-length: 0  NB: The example above assumes that the HTTP adapter is configured for TLS and the secure port is used.\nPublish Telemetry Data (unauthenticated Device)  URI: /telemetry/${tenantId}/${deviceId} Method: PUT Request Headers:  (required) content-type: The type of payload contained in the body. (optional) hono-ttd: The number of seconds the device will wait for the response. (optional) qos-level: The QoS level for publishing telemetry messages. The adapter supports at most once (0) and at least once (1) QoS levels. The default value of 0 is assumed if this header is omitted.  Request Body:  (required) Arbitrary payload encoded according to the given content type.  Response Headers:  (optional) content-type: A media type describing the semantics and format of payload contained in the response body. This header will only be present if the response contains a command to be executed by the device which requires input data. (optional) hono-command: The name of the command to execute. This header will only be present if the response contains a command to be executed by the device. (optional) hono-cmd-req-id: An identifier that the device must include in its response to a command. This header will only be present if the response contains a command to be executed by the device.  Response Body:  (optional) Arbitrary data serving as input to a command to be executed by the device, if status code is 200. (optional) Error details, if status code is \u0026gt;= 400.  Status Codes:  200 (OK): The telemetry data has been accepted for processing. The response contains a command for the device to execute. 202 (Accepted): The telemetry data has been accepted for processing. Note that if the qos-level request header is omitted (at most once semantics), this status code does not mean that the message has been delivered to any potential consumer. However, if the QoS level header is set to 1 (at least once semantics), then the adapter waits for the message to be delivered and accepted by a downstream consumer before responding with this status code. 400 (Bad Request): The request cannot be processed. Possible reasons for this include:  The content type header is missing. The request body is empty. The QoS header value is invalid.  403 (Forbidden): The request cannot be processed because the device\u0026rsquo;s registration status cannot be asserted. Possible reasons for this include:  The given tenant is not allowed to use this protocol adapter. The given device does not belong to the given tenant.  404 (Not Found): The request cannot be processed because the device is disabled or does not exist. 429 (Too Many Requests): The request cannot be processed because the tenant\u0026rsquo;s message limit for the current period is exceeded. 503 (Service Unavailable): The request cannot be processed because there is no consumer of telemetry data for the given tenant connected to Hono.   This resource MUST be used by devices that have not authenticated to the protocol adapter. Note that this requires the HONO_HTTP_AUTHENTICATION_REQUIRED configuration property to be explicitly set to false.\nExamples\nPublish some JSON data for device 4711:\ncurl -i -X PUT -H 'content-type: application/json' --data-binary '{\u0026quot;temp\u0026quot;: 5}' http://127.0.0.1:8080/telemetry/DEFAULT_TENANT/4711 HTTP/1.1 202 Accepted content-length: 0  Publish some JSON data for device 4711 using at least once QoS:\ncurl -i -X PUT -H 'content-type: application/json' -H 'qos-level: 1' --data-binary '{\u0026quot;temp\u0026quot;: 5}' http://127.0.0.1:8080/telemetry/DEFAULT_TENANT/4711 HTTP/1.1 202 Accepted content-length: 0  Publish some JSON data for device 4711, indicating that the device will wait for 10 seconds to receive the response:\ncurl -i -u sensor1@DEFAULT_TENANT:hono-secret -H 'content-type: application/json' -H 'hono-ttd: 10' --data-binary '{\u0026quot;temp\u0026quot;: 5}' http://localhost:8080/telemetry HTTP/1.1 200 OK hono-command: set hono-cmd-req-id: 1010a7249aa5-f742-4376-8458-bbfc88c72d92 content-length: 23 { \u0026quot;brightness\u0026quot; : 87 }  Publish Telemetry Data (authenticated Gateway)  URI: /telemetry/${tenantId}/${deviceId} Method: PUT Request Headers:  (optional) authorization: The gateway\u0026rsquo;s auth-id and plain text password encoded according to the Basic HTTP authentication scheme. If not set, the adapter expects the gateway to present a client certificate as part of the TLS handshake during connection establishment.  Request Headers:  (required) content-type: The type of payload contained in the body. (optional) hono-ttd: The number of seconds the device will wait for the response. (optional) qos-level: The QoS level for publishing telemetry messages. The adapter supports at most once (0) and at least once (1) QoS levels. The default value of 0 is assumed if this header is omitted.  Request Body:  (required) Arbitrary payload encoded according to the given content type.  Response Headers:  (optional) content-type: A media type describing the semantics and format of payload contained in the response body. This header will only be present if the response contains a command to be executed by the device which requires input data. (optional) hono-command: The name of the command to execute. This header will only be present if the response contains a command to be executed by the device. (optional) hono-cmd-req-id: An identifier that the device must include in its response to a command. This header will only be present if the response contains a command to be executed by the device.  Response Body:  (optional) Arbitrary data serving as input to a command to be executed by the device, if status code is 200. (optional) Error details, if status code is \u0026gt;= 400.  Status Codes:  200 (OK): The telemetry data has been accepted for processing. The response contains a command for the device to execute. 202 (Accepted): The telemetry data has been accepted for processing. Note that if the qos-level request header is omitted (at most once semantics), this status code does not mean that the message has been delivered to any potential consumer. However, if the QoS level header is set to 1 (at least once semantics), then the adapter waits for the message to be delivered and accepted by a downstream consumer before responding with this status code. 400 (Bad Request): The request cannot be processed. Possible reasons for this include:  The content type header is missing. The request body is empty. The QoS header value is invalid.  401 (Unauthorized): The request cannot be processed because the request does not contain valid credentials. 403 (Forbidden): The request cannot be processed because the device\u0026rsquo;s registration status cannot be asserted. Possible reasons for this include:  The tenant that the gateway belongs to is not allowed to use this protocol adapter. The device belongs to another tenant than the gateway. The gateway is not authorized to act on behalf of the device. The gateway associated with the device is not registered or disabled.  404 (Not Found): The request cannot be processed because the device is disabled or does not exist. 429 (Too Many Requests): The request cannot be processed because the tenant\u0026rsquo;s message limit for the current period is exceeded. 503 (Service Unavailable): The request cannot be processed because there is no consumer of telemetry data for the given tenant connected to Hono.   This resource can be used by gateway components to publish data on behalf of other devices which do not connect to a protocol adapter directly but instead are connected to the gateway, e.g. using some low-bandwidth radio based technology like SigFox or LoRa. In this case the credentials provided by the gateway during connection establishment with the protocol adapter are used to authenticate the gateway whereas the parameters from the URI are used to identify the device that the gateway publishes data for.\nThe protocol adapter checks the gateway\u0026rsquo;s authority to publish data on behalf of the device implicitly by means of retrieving a registration assertion for the device from the configured Device Registration service.\nExamples\nPublish some JSON data for device 4712:\ncurl -i -X PUT -u gw@DEFAULT_TENANT:gw-secret -H 'content-type: application/json' --data-binary '{\u0026quot;temp\u0026quot;: 5}' http://127.0.0.1:8080/telemetry/DEFAULT_TENANT/4712 HTTP/1.1 202 Accepted content-length: 0  Publish some JSON data for device 4712 using at least once QoS:\ncurl -i -X PUT -u gw@DEFAULT_TENANT:gw-secret -H 'content-type: application/json' -H 'qos-level: 1' --data-binary '{\u0026quot;temp\u0026quot;: 5}' http://127.0.0.1:8080/telemetry/DEFAULT_TENANT/4712 HTTP/1.1 202 Accepted content-length: 0  Publish some JSON data for device 4712, indicating that the gateway will wait for 10 seconds to receive the response:\ncurl -i -X PUT -u gw@DEFAULT_TENANT:gw-secret -H 'content-type: application/json' -H 'hono-ttd: 10' --data-binary '{\u0026quot;temp\u0026quot;: 5}' http://localhost:8080/telemetry/DEFAULT_TENANT/4712 HTTP/1.1 200 OK hono-command: set hono-cmd-req-id: 1010a7249aa5-f742-4376-8458-bbfc88c72d92 content-length: 23 { \u0026quot;brightness\u0026quot; : 87 }  NB: The example above assumes that a gateway device has been registered with hashed-password credentials with auth-id gw and password gw-secret which is authorized to publish data on behalf of device 4712.\nPublish an Event (authenticated Device)  URI: /event Method: POST Request Headers:  (optional) authorization: The device\u0026rsquo;s auth-id and plain text password encoded according to the Basic HTTP authentication scheme. If not set, the adapter expects the device to present a client certificate as part of the TLS handshake during connection establishment. (required) content-type: The type of payload contained in the body. (optional) hono-ttd: The number of seconds the device will wait for the response.  Request Body:  (required) Arbitrary payload encoded according to the given content type.  Response Headers:  (optional) content-type: A media type describing the semantics and format of payload contained in the response body. This header will only be present if the response contains a command to be executed by the device which requires input data. (optional) hono-command: The name of the command to execute. This header will only be present if the response contains a command to be executed by the device. (optional) hono-cmd-req-id: An identifier that the device must include in its response to a command. This header will only be present if the response contains a command to be executed by the device.  Response Body:  (optional) Arbitrary data serving as input to a command to be executed by the device, if status code is 200. (optional) Error details, if status code is \u0026gt;= 400.  Status Codes:  200 (OK): The telemetry data has been accepted for processing. The response contains a command for the device to execute. 202 (Accepted): The event has been accepted for processing. 400 (Bad Request): The request cannot be processed. Possible reasons for this include:  The content type header is missing. The request body is empty but the event is not of type empty-notification.  401 (Unauthorized): The request cannot be processed because the request does not contain valid credentials. 403 (Forbidden): The request cannot be processed because the device\u0026rsquo;s registration status cannot be asserted. Possible reasons for this include:  The given tenant is not allowed to use this protocol adapter.  404 (Not Found): The request cannot be processed because the device is disabled or does not exist. 429 (Too Many Requests): The request cannot be processed because the tenant\u0026rsquo;s message limit for the current period is exceeded. 503 (Service Unavailable): The request cannot be processed because there is no consumer of telemetry data for the given tenant connected to Hono.   This is the preferred way for devices to publish events. It is available only if the protocol adapter is configured to require devices to authenticate (which is the default).\nExample\nPublish some JSON data for device 4711:\ncurl -i -u sensor1@DEFAULT_TENANT:hono-secret -H 'content-type: application/json' --data-binary '{\u0026quot;alarm\u0026quot;: true}' http://127.0.0.1:8080/event HTTP/1.1 202 Accepted content-length: 0  Publish an Event (unauthenticated Device)  URI: /event/${tenantId}/${deviceId} Method: PUT Request Headers:  (required) content-type: The type of payload contained in the body. (optional) hono-ttd: The number of seconds the device will wait for the response.  Request Body:  (required) Arbitrary payload encoded according to the given content type.  Response Headers:  (optional) content-type: A media type describing the semantics and format of payload contained in the response body. This header will only be present if the response contains a command to be executed by the device which requires input data. (optional) hono-command: The name of the command to execute. This header will only be present if the response contains a command to be executed by the device. (optional) hono-cmd-req-id: An identifier that the device must include in its response to a command. This header will only be present if the response contains a command to be executed by the device.  Response Body:  (optional) Arbitrary data serving as input to a command to be executed by the device, if status code is 200. (optional) Error details, if status code is \u0026gt;= 400.  Status Codes:  200 (OK): The event has been accepted and put to a persistent store for delivery to consumers. The response contains a command for the device to execute. 202 (Accepted): The event has been accepted and put to a persistent store for delivery to consumers. 400 (Bad Request): The request cannot be processed. Possible reasons for this include:  The content type header is missing. The request body is empty but the event is not of type empty-notification.  403 (Forbidden): The request cannot be processed because the device\u0026rsquo;s registration status cannot be asserted. Possible reasons for this include:  The given tenant is not allowed to use this protocol adapter. The given device does not belong to the given tenant.  404 (Not Found): The request cannot be processed because the device is disabled or does not exist. 429 (Too Many Requests): The request cannot be processed because the tenant\u0026rsquo;s message limit for the current period is exceeded. 503 (Service Unavailable): The request cannot be processed because there is no consumer of telemetry data for the given tenant connected to Hono.   This resource MUST be used by devices that have not authenticated to the protocol adapter. Note that this requires the HONO_HTTP_AUTHENTICATION_REQUIRED configuration property to be explicitly set to false.\nExamples\nPublish some JSON data for device 4711:\ncurl -i -X PUT -H 'content-type: application/json' --data-binary '{\u0026quot;alarm\u0026quot;: true}' http://127.0.0.1:8080/event/DEFAULT_TENANT/4711 HTTP/1.1 202 Accepted content-length: 0  Publish an Event (authenticated Gateway)  URI: /event/${tenantId}/${deviceId} Method: PUT Request Headers:  (optional) authorization: The gateway\u0026rsquo;s auth-id and plain text password encoded according to the Basic HTTP authentication scheme. If not set, the adapter expects the gateway to present a client certificate as part of the TLS handshake during connection establishment. (required) content-type: The type of payload contained in the body. (optional) hono-ttd: The number of seconds the device will wait for the response.  Request Body:  (required) Arbitrary payload encoded according to the given content type.  Response Headers:  (optional) content-type: A media type describing the semantics and format of payload contained in the response body. This header will only be present if the response contains a command to be executed by the device which requires input data. (optional) hono-command: The name of the command to execute. This header will only be present if the response contains a command to be executed by the device. (optional) hono-cmd-req-id: An identifier that the device must include in its response to a command. This header will only be present if the response contains a command to be executed by the device.  Response Body:  (optional) Arbitrary data serving as input to a command to be executed by the device, if status code is 200. (optional) Error details, if status code is \u0026gt;= 400.  Status Codes:  200 (OK): The event has been accepted and put to a persistent store for delivery to consumers. The response contains a command for the device to execute. 202 (Accepted): The event has been accepted and put to a persistent store for delivery to consumers. 400 (Bad Request): The request cannot be processed. Possible reasons for this include:  The content type header is missing. The request body is empty but the event is not of type empty-notification.  401 (Unauthorized): The request cannot be processed because the request does not contain valid credentials. 403 (Forbidden): The request cannot be processed because the device\u0026rsquo;s registration status cannot be asserted. Possible reasons for this include:  The tenant that the gateway belongs to is not allowed to use this protocol adapter. The device belongs to another tenant than the gateway. The gateway is not authorized to act on behalf of the device. The gateway associated with the device is not registered or disabled.  404 (Not Found): The request cannot be processed because the device is disabled or does not exist. 429 (Too Many Requests): The request cannot be processed because the tenant\u0026rsquo;s message limit for the current period is exceeded. 503 (Service Unavailable): The request cannot be processed because there is no consumer of telemetry data for the given tenant connected to Hono.   This resource can be used by gateway components to publish data on behalf of other devices which do not connect to a protocol adapter directly but instead are connected to the gateway, e.g. using some low-bandwidth radio based technology like SigFox or LoRa. In this case the credentials provided by the gateway during connection establishment with the protocol adapter are used to authenticate the gateway whereas the parameters from the URI are used to identify the device that the gateway publishes data for.\nThe protocol adapter checks the gateway\u0026rsquo;s authority to publish data on behalf of the device implicitly by means of retrieving a registration assertion for the device from the configured Device Registration service.\nExamples\nPublish some JSON data for device 4712:\ncurl -i -X PUT -u gw@DEFAULT_TENANT:gw-secret -H 'content-type: application/json' --data-binary '{\u0026quot;temp\u0026quot;: 5}' http://127.0.0.1:8080/event/DEFAULT_TENANT/4712 HTTP/1.1 202 Accepted content-length: 0  NB: The example above assumes that a gateway device has been registered with hashed-password credentials with auth-id gw and password gw-secret which is authorized to publish data on behalf of device 4712.\nSpecifying the Time a Device will wait for a Response The adapter lets devices indicate the number of seconds they will wait for a response by setting a header or a query parameter.\nUsing an HTTP Header The (optional) hono-ttd header can be set in requests for publishing telemetry data or events.\nExample:\ncurl -i -u sensor1@DEFAULT_TENANT:hono-secret -H 'content-type: application/json' -H 'hono-ttd: 60' --data-binary '{\u0026quot;temp\u0026quot;: 5}' http://127.0.0.1:8080/telemetry HTTP/1.1 202 Accepted content-length: 0  Using a Query Parameter Alternatively the hono-ttd query parameter can be used:\ncurl -i -u sensor1@DEFAULT_TENANT:hono-secret -H 'content-type: application/json' --data-binary '{\u0026quot;temp\u0026quot;: 5}' http://127.0.0.1:8080/telemetry?hono-ttd=60 HTTP/1.1 202 Accepted content-length: 0  Sending a Response to a Command (authenticated Device)  Since: 0.7 URI: /command/res/${commandRequestId} or /command/res/${commandRequestId}?hono-cmd-status=${status} Method: POST Request Headers:  (optional) authorization: The device\u0026rsquo;s auth-id and plain text password encoded according to the Basic HTTP authentication scheme. If not set, the adapter expects the device to present a client certificate as part of the TLS handshake during connection establishment. (optional) content-type: A media type describing the semantics and format of the payload contained in the request body. This header may be set if the result of processing the command on the device is non-empty. In this case the result data is contained in the request body. (optional) hono-cmd-status: The status of the command execution. If not set, the adapter expects that the URI contains it as request parameter at the end.  Request Body:  (optional) Arbitrary data representing the result of processing the command on the device.  Status Codes:  202 (Accepted): The response has been successfully delivered to the application that has sent the command. 400 (Bad Request): The request cannot be processed because the command status is missing. 401 (Unauthorized): The request cannot be processed because the request does not contain valid credentials.\n 403 (Forbidden): The request cannot be processed because the device\u0026rsquo;s registration status cannot be asserted. Possible reasons for this include:  The given tenant is not allowed to use this protocol adapter.  404 (Not Found): The request cannot be processed because the device is disabled or does not exist. 429 (Too Many Requests): The request cannot be processed because the tenant\u0026rsquo;s message limit for the current period is exceeded. 503 (Service Unavailable): The request cannot be processed. Possible reasons for this include:  There is no application listening for a reply to the given commandRequestId. The application has already given up on waiting for a response.    This is the preferred way for devices to respond to commands. It is available only if the protocol adapter is configured to require devices to authenticate (which is the default).\n Deprecation Previous versions of Hono used control instead of command as prefix in the command response URI. Using the control prefix is still supported but deprecated.  Example\nSend a response to a previously received command with the command-request-id req-id-uuid for device 4711:\ncurl -i -u sensor1@DEFAULT_TENANT:hono-secret -H 'content-type: application/json' --data-binary '{\u0026quot;brightness-changed\u0026quot;: true}' http://127.0.0.1:8080/command/res/req-id-uuid?hono-cmd-status=200 HTTP/1.1 202 Accepted content-length: 0  Sending a Response to a Command (unauthenticated Device)  Since: 0.7 URI: /command/res/${tenantId}/${deviceId}/${commandRequestId} or /command/res/${tenantId}/${deviceId}/${commandRequestId}?hono-cmd-status=${status} Method: PUT Request Headers:  (optional) content-type: A media type describing the semantics and format of the payload contained in the request body (the outcome of processing the command). (optional) hono-cmd-status: The status of the command execution. If not set, the adapter expects that the URI contains it as request parameter at the end.  Request Body:  (optional) Arbitrary data representing the result of processing the command on the device.  Status Codes:  202 (Accepted): The response has been successfully delivered to the application that has sent the command. 400 (Bad Request): The request cannot be processed because the command status is missing. 403 (Forbidden): The request cannot be processed because the device\u0026rsquo;s registration status cannot be asserted. Possible reasons for this might be:  The given tenant is not allowed to use this protocol adapter. The given device does not belong to the given tenant.  404 (Not Found): The request cannot be processed because the device is disabled or does not exist. 429 (Too Many Requests): The request cannot be processed because the tenant\u0026rsquo;s message limit for the current period is exceeded. 503 (Service Unavailable): The request cannot be processed. Possible reasons for this include:  There is no application listening for a reply to the given commandRequestId. The application has already given up on waiting for a response.    This resource MUST be used by devices that have not authenticated to the protocol adapter. Note that this requires the HONO_HTTP_AUTHENTICATION_REQUIRED configuration property to be explicitly set to false.\n Deprecation Previous versions of Hono used control instead of command as prefix in the command response URI. Using the control prefix is still supported but deprecated.  Examples\nSend a response to a previously received command with the command-request-id req-id-uuid for the unauthenticated device 4711:\ncurl -i -X PUT -H 'content-type: application/json' --data-binary '{\u0026quot;brightness-changed\u0026quot;: true}' http://127.0.0.1:8080/command/res/DEFAULT_TENANT/4711/req-id-uuid?hono-cmd-status=200 HTTP/1.1 202 Accepted content-length: 0  Sending a Response to a Command (authenticated Gateway)  Since: 0.7 URI: /command/res/${tenantId}/${deviceId}/${commandRequestId} or /command/res/${tenantId}/${deviceId}/${commandRequestId}?hono-cmd-status=${status} Method: PUT Request Headers:  (optional) authorization: The gateway\u0026rsquo;s auth-id and plain text password encoded according to the Basic HTTP authentication scheme. If not set, the adapter expects the gateway to present a client certificate as part of the TLS handshake during connection establishment. (optional) content-type: A media type describing the semantics and format of the payload contained in the request body (the outcome of processing the command). (optional) hono-cmd-status: The status of the command execution. If not set, the adapter expects that the URI contains it as request parameter at the end.  Request Body:  (optional) Arbitrary data representing the result of processing the command on the device.  Status Codes:  202 (Accepted): The response has been successfully delivered to the application that has sent the command. 400 (Bad Request): The request cannot be processed because the command status is missing. 403 (Forbidden): The request cannot be processed because the device\u0026rsquo;s registration status cannot be asserted. Possible reasons for this might be:  The given tenant is not allowed to use this protocol adapter. The given device does not belong to the given tenant. The gateway is not authorized to act on behalf of the device. The gateway associated with the device is not registered or disabled.  404 (Not Found): The request cannot be processed because the device is disabled or does not exist. 429 (Too Many Requests): The request cannot be processed because the tenant\u0026rsquo;s message limit for the current period is exceeded. 503 (Service Unavailable): The request cannot be processed. Possible reasons for this include:  There is no application listening for a reply to the given commandRequestId. The application has already given up on waiting for a response.    This resource can be used by gateway components to send the response to a command on behalf of other devices which do not connect to a protocol adapter directly but instead are connected to the gateway, e.g. using some low-bandwidth radio based technology like SigFox or LoRa. In this case the credentials provided by the gateway during connection establishment with the protocol adapter are used to authenticate the gateway whereas the parameters from the URI are used to identify the device that the gateway publishes data for.\nThe protocol adapter checks the gateway\u0026rsquo;s authority to send responses to a command on behalf of the device implicitly by means of retrieving a registration assertion for the device from the configured Device Registration service.\n Deprecation Previous versions of Hono used control instead of command as prefix in the command response URI. Using the control prefix is still supported but deprecated.  Examples\nSend a response to a previously received command with the command-request-id req-id-uuid for device 4712:\ncurl -i -X PUT -u gw@DEFAULT_TENANT:gw-secret -H 'content-type: application/json' --data-binary '{\u0026quot;brightness-changed\u0026quot;: true}' http://127.0.0.1:8080/command/res/DEFAULT_TENANT/4712/req-id-uuid?hono-cmd-status=200 HTTP/1.1 202 Accepted content-length: 0  NB: The example above assumes that a gateway device has been registered with hashed-password credentials with auth-id gw and password gw-secret which is authorized to publish data on behalf of device 4712.\nDownstream Meta Data The adapter includes the following meta data in the application properties of messages being sent downstream:\n   Name Type Description     device_id string The identifier of the device that the message originates from.   orig_adapter string Contains the adapter\u0026rsquo;s type name which can be used by downstream consumers to determine the protocol adapter that the message has been received over. The HTTP adapter\u0026rsquo;s type name is hono-http.   orig_address string Contains the (relative) URI that the device has originally posted the data to.   ttd integer Contains the effective number of seconds that the device will wait for a response. This property is only set if the HTTP request contains the hono-ttd header or request parameter.    The adapter also considers defaults registered for the device at either the tenant or the device level. The values of the default properties are determined as follows:\n If the message already contains a non-empty property of the same name, the value if unchanged. Otherwise, if a default property of the same name is defined in the device\u0026rsquo;s registration information, that value is used. Otherwise, if a default property of the same name is defined for the tenant that the device belongs to, that value is used.  Note that of the standard AMQP 1.0 message properties only the content-type and ttl can be set this way to a default value.\nTenant specific Configuration The adapter uses the Tenant API to retrieve tenant specific configuration for adapter type hono-http. The following properties are (currently) supported:\n   Name Type Default Value Description     enabled boolean true If set to false the adapter will reject all data from devices belonging to the tenant.   max-ttd integer 60 Defines a tenant specific upper limit for the time until disconnect property that devices may include in requests for uploading telemetry data or events. Please refer to the Command \u0026amp; Control concept page for a discussion of this parameter\u0026rsquo;s purpose and usage.\nIf this property is not set for the hono-http adapter type, the adapter will try to read this property from the tenant level configuration.   "
},
{
	"uri": "https://www.eclipse.org/hono/docs/user-guide/mqtt-adapter/",
	"title": "MQTT Adapter",
	"tags": [],
	"description": "",
	"content": "The MQTT protocol adapter exposes an MQTT topic hierarchy for publishing telemetry data and events to downstream consumers and for receiving commands from applications and sending back responses.\nThe MQTT adapter is not a general purpose MQTT broker. In particular the adapter\n supports MQTT 3.1.1 only. does not maintain session state for clients and thus always sets the session present flag in its CONNACK packet to 0, regardless of the value of the clean session flag provided in a client\u0026rsquo;s CONNECT packet. ignores any Will included in a client\u0026rsquo;s CONNECT packet. only supports topic names/filters for devices to publish and subscribe to that are specific to Hono\u0026rsquo;s functionality as described in the following sections. does not support retaining messages. However, if an event or telemetry message\u0026rsquo;s retain flag is set to 1 then the corresponding AMQP 1.0 message being sent downstream by the adapter will contain an x-opt-retain message annotation containing the boolean value true. A downstream consumer may then react according to the presence of this annotation.  Authentication The MQTT adapter by default requires clients (devices or gateway components) to authenticate during connection establishment. The adapter supports both the authentication based on the username/password provided in an MQTT CONNECT packet as well as client certificate based authentication as part of a TLS handshake for that purpose.\nThe adapter tries to authenticate the device using these mechanisms in the following order\nClient Certificate When a device uses a client certificate for authentication during the TLS handshake, the adapter tries to determine the tenant that the device belongs to, based on the issuer DN contained in the certificate. In order for the lookup to succeed, the tenant\u0026rsquo;s trust anchor needs to be configured by means of registering the trusted certificate authority. The device\u0026rsquo;s client certificate will then be validated using the registered trust anchor, thus implicitly establishing the tenant that the device belongs to. In a second step, the adapter then uses the Credentials API\u0026rsquo;s get operation with the client certificate\u0026rsquo;s subject DN as the auth-id and x509-cert as the type of secret as query parameters.\nNB The adapter needs to be configured for TLS in order to support this mechanism.\nUsername/Password When a device wants to authenticate using this mechanism, it needs to provide a username and a password in the MQTT CONNECT packet it sends in order to initiate the connection. The username must have the form auth-id@tenant, e.g. sensor1@DEFAULT_TENANT. The adapter verifies the credentials provided by the client against the credentials the configured Credentials service has on record for the client. The adapter uses the Credentials API\u0026rsquo;s get operation to retrieve the credentials on record with the tenant and auth-id provided by the client in the username and hashed-password as the type of secret as query parameters.\nThe examples below refer to devices 4711 and gw-1 of tenant DEFAULT_TENANT using auth-ids sensor1 and gw1 and corresponding passwords. The example deployment as described in the Deployment Guides comes pre-configured with the corresponding entities in its device registry component.\nNB There is a subtle difference between the device identifier (device-id) and the auth-id a device uses for authentication. See Device Identity for a discussion of the concepts.\nConnection Limits After verifying the credentials, the number of existing connections is checked against the configured resource-limits by the MQTT adapter. If the limit is exceeded then a return code 0x05 indicating Connection Refused: not authorised is sent back.\nMessage Limits Before accepting any telemetry or event or command messages, the MQTT adapter verifies that the configured message limit is not exceeded. The incoming message is discarded if the limit is exceeded.\nPublishing Telemetry Data The MQTT adapter supports the publishing of telemetry data by means of MQTT PUBLISH packets using either QoS 0 or QoS 1. Using QoS 1 will result in the adapter sending an MQTT PUBACK packet to the client once the message has been settled with the accepted outcome by the AMQP 1.0 Messaging Network.\nThis requires that\n the AMQP 1.0 Messaging Network has capacity to process telemetry messages for the client\u0026rsquo;s tenant and the messages published by the client comply with the format defined by the Telemetry API.  The protocol adapter checks the configured message limit before accepting any telemetry messages. If the message limit is exceeded or the incoming telemetry message cannot be processed, the connection to the client is closed.\nPublish Telemetry Data (authenticated Device)  Topic: telemetry or t Authentication: required Payload:  (required) Arbitrary payload   This is the preferred way for devices to publish telemetry data. It is available only if the protocol adapter is configured to require devices to authenticate (which is the default). When using this topic, the MQTT adapter determines the device\u0026rsquo;s tenant and device identity as part of the authentication process.\nExample\nPublish some JSON data for device 4711:\nmosquitto_pub -u 'sensor1@DEFAULT_TENANT' -P hono-secret -t telemetry -m '{\u0026quot;temp\u0026quot;: 5}'  Publish some JSON data for device 4711 using a client certificate for authentication:\n# in base directory of Hono repository: mosquitto_pub -p 8883 -t telemetry -m '{\u0026quot;temp\u0026quot;: 5}' --cert demo-certs/certs/device-4711-cert.pem --key demo-certs/certs/device-4711-key.pem --cafile demo-certs/certs/trusted-certs.pem  NB: The example above assumes that the MQTT adapter is configured for TLS and the secure port is used.\nPublish Telemetry Data (unauthenticated Device)  Topic: telemetry/${tenant-id}/${device-id} or t/${tenant-id}/${device-id} Authentication: none Payload:  (required) Arbitrary payload   This topic can be used by devices that have not authenticated to the protocol adapter. Note that this requires the HONO_MQTT_AUTHENTICATION_REQUIRED configuration property to be explicitly set to false.\nExamples\nPublish some JSON data for device 4711:\nmosquitto_pub -t telemetry/DEFAULT_TENANT/4711 -m '{\u0026quot;temp\u0026quot;: 5}'  Publish Telemetry Data (authenticated Gateway)  Topic: telemetry/${tenant-id}/${device-id} or t/${tenant-id}/${device-id} Authentication: required Payload:  (required) Arbitrary payload   This topic can be used by gateway components to publish data on behalf of other devices which do not connect to a protocol adapter directly but instead are connected to the gateway, e.g. using some low-bandwidth radio based technology like SigFox or LoRa. In this case the credentials provided by the gateway during connection establishment with the protocol adapter are used to authenticate the gateway whereas the parameters from the topic name are used to identify the device that the gateway publishes data for.\nThe protocol adapter checks the gateway\u0026rsquo;s authority to publish data on behalf of the device implicitly by means of retrieving a registration assertion for the device from the configured Device Registration service.\nExamples\nPublish some JSON data for device 4712 via gateway gw-1:\nmosquitto_pub -u 'gw@DEFAULT_TENANT' -P gw-secret -t telemetry/DEFAULT_TENANT/4712 -m '{\u0026quot;temp\u0026quot;: 5}'  NB: The example above assumes that a gateway device with ID gw-1 has been registered with hashed-password credentials with auth-id gw and password gw-secret.\nPublishing Events The MQTT adapter supports the publishing of events by means of MQTT PUBLISH packets using QoS 1 only. The adapter will send an MQTT PUBACK packet to the client once the event has been settled with the accepted outcome by the AMQP 1.0 Messaging Network.\nThis requires that\n the AMQP 1.0 Messaging Network has capacity to process events for the client\u0026rsquo;s tenant and the events published by the client comply with the format defined by the Event API.  The protocol adapter checks the configured message limit before accepting any event messages. If the message limit is exceeded or the incoming event message cannot be processed, the connection to the client is closed.\nPublish an Event (authenticated Device)  Topic: event or e Authentication: required Payload:  (required) Arbitrary payload   This is the preferred way for devices to publish events. It is available only if the protocol adapter has been configured to require devices to authenticate (which is the default).\nExample\nUpload a JSON string for device 4711:\nmosquitto_pub -u 'sensor1@DEFAULT_TENANT' -P hono-secret -t event -q 1 -m '{\u0026quot;alarm\u0026quot;: 1}'  Publish an Event (unauthenticated Device)  Topic: event/${tenant-id}/${device-id} or e/${tenant-id}/${device-id} Authentication: none Payload:  (required) Arbitrary payload   This topic can be used by devices that have not authenticated to the protocol adapter. Note that this requires the HONO_MQTT_AUTHENTICATION_REQUIRED configuration property to be explicitly set to false.\nExamples\nPublish some JSON data for device 4711:\nmosquitto_pub -t event/DEFAULT_TENANT/4711 -q 1 -m '{\u0026quot;alarm\u0026quot;: 1}'  Publish an Event (authenticated Gateway)  Topic: event/${tenant-id}/${device-id} or e/${tenant-id}/${device-id} Authentication: required Payload:  (required) Arbitrary payload   This topic can be used by gateway components to publish data on behalf of other devices which do not connect to a protocol adapter directly but instead are connected to the gateway, e.g. using some low-bandwidth radio based technology like SigFox or LoRa. In this case the credentials provided by the gateway during connection establishment with the protocol adapter are used to authenticate the gateway whereas the parameters from the topic name are used to identify the device that the gateway publishes data for.\nThe protocol adapter checks the gateway\u0026rsquo;s authority to publish data on behalf of the device implicitly by means of retrieving a registration assertion for the device from the configured Device Registration service.\nExamples\nPublish some JSON data for device 4712 via gateway gw-1:\nmosquitto_pub -u 'gw@DEFAULT_TENANT' -P gw-secret -t event/DEFAULT_TENANT/4712 -q 1 -m '{\u0026quot;temp\u0026quot;: 5}'  NB: The example above assumes that a gateway device with ID gw-1 has been registered with hashed-password credentials with auth-id gw and password gw-secret.\nCommand \u0026amp; Control The MQTT adapter supports devices to receive commands that have been sent by business applications by means of sending an MQTT SUBSCRIBE packet containing a device specific topic filter as described below. Devices can subscribe with QoS 1 or QoS 0. The adapter indicates the outcome of the subscription request by sending back a corresponding SUBACK packet. The SUBACK packet will contain Success - QoS 0 (0x00) or Success - QoS 1 (0x01) for a command topic filter indicating QoS 0 or 1 and will contain the Failure (0x80) value for all other filters. When a device no longer wants to receive commands anymore, it can send an MQTT UNSUBSCRIBE packet to the adapter, including the same topic filter that has been used to subscribe.\nWhen a device has successfully subscribed, the adapter sends an empty notification on behalf of the device to the downstream AMQP 1.0 Messaging Network with the ttd header set to -1, indicating that the device will be ready to receive commands until further notice. Analogously, the adapter sends an empty notification with the ttd header set to 0 when a device unsubscribes from commands.\nCommands can be sent following a request/response pattern or being one-way.\nFor Request/Response commands, devices send their responses to commands by means of sending an MQTT PUBLISH message to a topic that is specific to the command that has been executed. The MQTT adapter accepts responses being published using either QoS 0 or QoS 1.\nThe MQTT adapter checks the configured message limit before accepting any command requests and responses. In case of incoming command requests from business applications, if the message limit is exceeded, the Adapter rejects the message with the reason amqp:resource-limit-exceeded. And for the incoming command responses from devices, the Adapter rejects the message and closes the connection to the client.\nThe following sections define the topic filters/names to use for subscribing to and responding to commands. The following shorthand versions of topic path segments are supported:\n c instead of command q instead of req s instead of res   Note Previous versions of Hono used control instead of command as topic prefix. Using the control prefix is still supported but deprecated.  The following variables are used:\n ${command} : is an arbitrary string that indicates the command to execute, e.g. setBrightness. The command is provided by the application that sends the command. ${req-id} (only for Request/Response commands) : denotes the unique identifier of the command execution request and is passed to the device as part of the name of the topic that the command is published to. The device needs to publish its response to the command to a topic which includes this identifier, thus allowing the adapter to correlate the response with the request. ${status} : is the HTTP status code indicating the outcome of executing the command. This status code is passed on to the application in the AMQP message\u0026rsquo;s status header.  The property-bag is an optional collection of properties intended for the receiver of the message. A property bag is only allowed at the very end of a topic. It always starts with a ? character, followed by pairs of URL encoded property names and values that are separated by \u0026amp;. The following example shows a property bag that contains two properties seqNo and importance:\n/topic/name/?seqNo=10034\u0026amp;importance=\u0026quot;high\u0026quot;  The MQTT adapter currently does not require nor use any properties.\nReceiving Commands (authenticated Device) An authenticated device MUST use the following topic filter to subscribe to commands:\n command/+/+/req/#  Example\nmosquitto_sub -v -u 'sensor1@DEFAULT_TENANT' -P hono-secret -t command/+/+/req/#  The adapter will then publish commands for the device to topic:\n for Request/Response commands: command///req/${req-id}/${command}[/*][/property-bag] for one-way commands: command///req//${command}[/*][/property-bag]  Example\nFor example, if the HonoExampleApplication was started, after the ttd event requested by the subscription of mosquitto_sub, it layers a command that arrives as follows:\ncommand///q/1010f8ab0b53-bd96-4d99-9d9c-56b868474a6a/setBrightness { \u0026quot;brightness\u0026quot; : 79 }  If the command is a one-way command, it will arrive as follows:\ncommand///q//setBrightness { \u0026quot;brightness\u0026quot; : 79 }  Receiving Commands (unauthenticated Device) An unauthenticated device MUST use the following topic filter to subscribe to commands:\n command/${tenant-id}/${device-id}/req/#  Example\nmosquitto_sub -v -t command/DEFAULT_TENANT/4711/req/#  The adapter will then publish Request/Response commands for the device to topic:\n command/${tenant-id}/${device-id}/req/${req-id}/${command}[/*][/property-bag]  and one-way commands to the topic:\n command/${tenant-id}/${device-id}/req//${command}[/*][/property-bag]  (For an example of the incoming command see above at authenticated device)\nSending a Response to a Command (authenticated Device) An authenticated device MUST send the response to a previously received command to the following topic:\n command///res/${req-id}/${status}  Example\nAfter a command has arrived as in the above example, you send a response using the arrived ${req-id}:\nmosquitto_pub -u 'sensor1@DEFAULT_TENANT' -P hono-secret -t command///res/1010f8ab0b53-bd96-4d99-9d9c-56b868474a6a/200 -m '{\u0026quot;lumen\u0026quot;: 200}'  Sending a Response to a Command (unauthenticated Device) An unauthenticated device MUST send the response to a previously received command to the following topic:\n command/${tenant-id}/${device-id}/res/${req-id}/${status}  Example\nAfter a command has arrived as in the above example, you send a response using the arrived ${req-id}:\nmosquitto_pub -t command/DEFAULT_TENANT/4711/res/1010f8ab0b53-bd96-4d99-9d9c-56b868474a6a/200 -m '{\u0026quot;lumen\u0026quot;: 200}'  Downstream Meta Data The adapter includes the following meta data in messages being sent downstream:\n   Name Location Type Description     device_id application string The identifier of the device that the message originates from.   orig_adapter application string Contains the adapter\u0026rsquo;s type name which can be used by downstream consumers to determine the protocol adapter that the message has been received over. The MQTT adapter\u0026rsquo;s type name is hono-mqtt.   orig_address application string Contains the name of the MQTT topic that the device has originally published the data to.   x-opt-retain * message-annotations boolean Contains true if the device has published an event or telemetry message with its retain flag set to 1    The adapter also considers defaults registered for the device at either the tenant or the device level. The values of the default properties are determined as follows:\n If the message already contains a non-empty property of the same name, the value if unchanged. Otherwise, if a default property of the same name is defined in the device\u0026rsquo;s registration information, that value is used. Otherwise, if a default property of the same name is defined for the tenant that the device belongs to, that value is used.  Note that of the standard AMQP 1.0 message properties only the content-type and ttl can be set this way to a default value.\nTenant specific Configuration The adapter uses the Tenant API to retrieve tenant specific configuration for adapter type hono-mqtt. The following properties are (currently) supported:\n   Name Type Default Value Description     enabled boolean true If set to false the adapter will reject all data from devices belonging to the tenant.   "
},
{
	"uri": "https://www.eclipse.org/hono/docs/user-guide/amqp-adapter/",
	"title": "AMQP Adapter",
	"tags": [],
	"description": "",
	"content": "The AMQP protocol adapter allows clients (devices or gateway components) supporting the AMQP 1.0 protocol to publish messages to Eclipse Hono\u0026trade;\u0026rsquo;s Telemetry, Event and Command \u0026amp; Control endpoints.\nDevice Authentication By default, all Hono protocol adapters require clients (devices or gateway components) to authenticate during connection establishment. This is the preferred way for devices to publish data via protocol adapters. The AMQP adapter supports both the SASL PLAIN and SASL EXTERNAL authentication mechanisms. The former uses a username and password to authenticate to the adapter while the latter uses a client certificate.\nIn this guide, we will give examples for publishing telemetry and events for authenticated (using SASL PLAIN) and unauthenticated clients.\nNB: The AMQP adapter can be configured to allow unauthenticated devices to connect by setting configuration variable HONO_AMQP_AUTHENTICATION_REQUIRED to false.\nSASL PLAIN Authentication The AMQP adapter supports authenticating clients using a username and password. This means that clients need to provide a username and a password when connecting to the AMQP adapter. If the adapter is configured for multi-tenancy (i.e HONO_AMQP_SINGLE_TENANT is set to false), then the username must match the pattern [auth-id@tenant], e.g. sensor1@DEFAULT_TENANT. Otherwise the DEFAULT_TENANT is assumed and the tenant-id can be omitted from the username.\nThe adapter verifies the credentials provided by the client against the credentials that the Credentials Service has on record for the device. If the credentials match, then authentication is successful and the client device can proceed to publish messages to Hono.\nThe examples below refer to devices 4711 and gw-1 of tenant DEFAULT_TENANT using auth-ids sensor1 and gw1 and corresponding passwords. The example deployment as described in the Deployment Guides comes pre-configured with the corresponding entities in its device registry component.\nNB There is a subtle difference between the device identifier (device-id) and the auth-id a device uses for authentication. See Device Identity for a discussion of the concepts.\nSASL EXTERNAL Authentication When a device uses a client certificate for authentication, the TLS handshake is initiated during TCP connection establishment. If no trust anchor is configured for the AMQP adapter, the TLS handshake will succeed only if the certificate has not yet expired. Once the TLS handshake completes and a secure connection is established, the certificate\u0026rsquo;s signature is checked during the SASL handshake. To complete the SASL handshake and authenticate the client, the adapter performs the following steps:\n Adapter extracts the client certificate\u0026rsquo;s Issuer DN and uses it to us the Tenant service to look up the tenant that the client belongs to. In order for the lookup to succeed, the tenant’s trust anchor needs to be configured by means of registering the trusted certificate authority. If the lookup succeeds, the Tenant service returns the tenant, thus implicitly establishing the tenant that the device belongs to. Adapter validates the device’s client certificate using the registered trust anchor for the tenant. Finally, adapter authenticates the client certificate using Hono\u0026rsquo;s credentials API. In this step, the adapter uses the client certificate’s Subject DN (as authentication identifier) and x509-cert (for the credentials type) in order to determine the device ID.  NB: The AMQP adapter needs to be configured for TLS in order to support this mechanism.\nConnection Limits After verifying the credentials, the number of existing connections is checked against the configured resource-limits by the AMQP adapter. If the limit is exceeded then the connection request is not accepted.\nMessage Limits Before accepting any telemetry or event or command messages, the AMQP adapter verifies that the configured message limit is not exceeded. The incoming message is discarded if the limit is exceeded.\nLink Establishment Clients can publish all types of messages to the AMQP adapter via a single anonymous sender link. Using AT MOST ONCE delivery semantics, the client will not wait for the message to be accepted and settled by the downstream consumer. However, with AT LEAST ONCE, the client sends the message and waits for the message to be delivered to and accepted by the downstream consumer. If the message cannot be delivered due to a failure, the client will be notified.\nThe client indicates its preferred message delivery mode by means of the snd-settle-mode and rcv-settle-mode fields of its attach frame during link establishment. Clients should use mixed as the snd-settle-mode and first as the rcv-settle-mode in order to be able to use the same link for sending all types of messages using different delivery semantics as described in the following sections.\nError Handling The AMQP adapter distinguishes between two types of errors when a message is published using at least once:\n An error caused by the client side, e.g invalid message address, content-type, adapter disabled for tenant etc. An error caused by the server side, e.g no downstream consumers registered, downstream connection loss etc.  For a client side error, the adapter settles the message transfer with the rejected outcome and provides an error description in the corresponding disposition frame. In the case of a server-side error, the adapter settles the message with the released outcome, indicating to the client that the message itself was OK but it cannot be delivered due to a failure beyond the control of the client. In the latter case, a client may attempt to re-send the message unaltered.\nAMQP Command-line Client For purposes of demonstrating the usage of the AMQP adapter, the Hono CLI Module contains an AMQP command-line client for interacting with the AMQP adapter. The client can be used to send telemetry or events and to receive/respond to command request messages.\nThe command-line client supports the following parameters (with default values):\n --spring.profiles.active=amqp-send: Profile for sending telemetry data or events to Hono. --spring.profiles.active=amqp-command: Profile for receiving and responding to command request messages. --message.address: The AMQP 1.0 message address (default: telemetry) --message.payload: The message payload body (default: '{\u0026quot;temp\u0026quot;: 5}') --hono.client.host: The host name that the AMQP adapter is running on (default: localhost) --hono.client.port: The port that the adapter is listening for incoming connections (default: 5672)  To run the client to send a telemetry message to Hono, open a terminal and execute the following:\n# in directory: hono/cli/target/ java -jar hono-cli-*-exec.jar --spring.profiles.active=amqp-send --hono.client.username=sensor1@DEFAULT_TENANT --hono.client.password=hono-secret Accepted{}  The client prints the outcome of the operation to standard out. The outcome above (Accepted) indicates that the request to upload the data has succeeded.\nNB There are two JAR files in the hono/cli/target directory. The JAR to use for the client is the hono-cli-$VERSION-exec.jar and not the hono-cli-$VERSION.jar file. Running the latter will not work and will output the message: no main manifest attribute, in hono-cli-$VERSION.jar\nPublishing Telemetry Data The client indicates the delivery mode to use when uploading telemetry messages by means of the settled and rcv-settle-mode properties of the AMQP transfer frame(s) it uses for uploading the message. The AMQP adapter will accept messages using a delivery mode according to the following table:\n   settled rcv-settle-mode Delivery semantics     false first The adapter will forward the message to the downstream AMQP 1.0 Messaging Network and will forward any AMQP disposition frame received from the AMQP 1.0 Messaging Network to the client as is. It is up to the client\u0026rsquo;s discretion if and how it processes the disposition frame. The adapter will accept any re-delivered message. Sending unsettled messages allows for clients to implement either AT LEAST ONCE or AT MOST ONCE delivery semantics, depending on whether a client actually waits for and considers the disposition frames it receives from the adapter or not. This is the recommended mode for uploading telemetry data.   true first The adapter will acknowledge and settle any received message spontaneously before forwarding it to the downstream AMQP 1.0 Messaging Network. The adapter will ignore any AMQP disposition frames it receives from the AMQP 1.0 Messaging Network. Sending pre-settled messages allows for clients to implement AT MOST ONCE delivery semantics only. This is the fastest mode of delivery but has the drawback of less reliable end-to-end flow control and potential loss of messages without notice.    All other combinations are not supported by the adapter and will result in the message being ignored (pre-settled) or rejected (unsettled).\nPublish Telemetry Data (authenticated Device) The AMQP adapter supports publishing of telemetry data to Hono\u0026rsquo;s Telemetry API. Telemetry messages can be published using either AT LEAS ONCE or *AT MOST ONCE delivery semantics.\n Message Address: telemetry or t  This refers to the to property of the message.  Settlement Mode: presettled (AT MOST ONCE) or unsettled (AT LEAST ONCE) Authentication: SASL PLAIN or SASL EXTERNAL Message Body:  (optional) Arbitrary payload  Message properties:  (optional) Arbitrary properties (content-type, correlation-id, \u0026hellip;)  Disposition Frames:  Accepted: Message successfully processed by the adapter. Released: Message cannot be processed and should be redelivered. Rejected: Adapter rejects the message due to one of the following:  (hono:bad-request): Request rejected due to a bad client request. (amqp:unauthorized-access): Request rejected because the adapter is disabled for tenant. (amqp:precondition-failed): Request does not fulfill certain requirements e.g adapter cannot assert device registration etc. (amqp:resource-limit-exceeded): Request rejected because the message limit for the given tenant is exceeded.    When a device publishes data to the telemetry address, the AMQP adapter automatically determines the device\u0026rsquo;s identity and tenant during the authentication process.\nExample\nPublish some JSON data for device 4711:\n# in directory: hono/cli/target/ java -jar hono-cli-*-exec.jar --spring.profiles.active=amqp-send --hono.client.username=sensor1@DEFAULT_TENANT --hono.client.password=hono-secret  Notice that we only supplied a new value for the message address, leaving the other default values.\nPublish some JSON data for device 4711 using a client certificate for authentication:\n# in directory: hono/cli/target/ java -jar hono-cli-*-exec.jar --spring.profiles.active=amqp-send --hono.client.port=5671 --hono.client.certPath=config/hono-demo-certs-jar/device-4711-cert.pem --hono.client.keyPath=config/hono-demo-certs-jar/device-4711-key.pem --hono.client.trustStorePath=config/hono-demo-certs-jar/trusted-certs.pem --hono.client.hostnameVerificationRequired=false  Publish Telemetry Data (unauthenticated Device)  Message Address: telemetry/${tenant-id}/${device-id} or t/${tenant-id}/${device-id} Settlement Mode: presettled (AT MOST ONCE) or unsettled (AT LEAST ONCE) Authentication: none Message Body:  (optional) Arbitrary payload  Message properties:  (optional) Arbitrary properties (content-type, correlation-id, \u0026hellip;)  Disposition Frames:  Accepted: Message successfully processed by the adapter. Released: Message cannot be processed and should be redelivered. Rejected: Adapter rejects the message due to:  (hono:bad-request): A bad client request (e.g invalid content-type). (amqp:unauthorized-access): The adapter is disabled for tenant. (amqp:precondition-failed): Request not fulfilling certain requirements. (amqp:resource-limit-exceeded): Request rejected because the message limit for the given tenant is exceeded.    Note how verbose the address is for unauthenticated devices. This address can be used by devices that have not authenticated to the protocol adapter. This requires the HONO_AMQP_AUTHENTICATION_REQUIRED configuration property to be explicitly set to false before starting the protocol adapter.\nExamples\nPublish some JSON data for device 4711:\n# in directory: hono/cli/target/ java -jar hono-cli-*-exec.jar --spring.profiles.active=amqp-send --message.address=t/DEFAULT_TENANT/4711  Publish Telemetry Data (authenticated Gateway) A device that publishes data on behalf of another device is called a gateway device. The message address is used by gateway components to publish data on behalf of other devices which do not connect to a protocol adapter directly but instead are connected to the gateway, e.g. using some low-bandwidth radio based technology like SigFox or LoRa. In this case the credentials provided by the gateway during connection establishment with the protocol adapter are used to authenticate the gateway whereas the message address is used to identify the device that the gateway publishes data for.\nExamples\nA Gateway connecting to the adapter using gw@DEFAULT_TENANT as username and gw-secret as password and then publishing some JSON data for device 4711:\n# in directory: hono/cli/target/ java -jar hono-cli-*-exec.jar --spring.profiles.active=amqp-send --hono.client.username=gw@DEFAULT_TENANT --hono.client.password=gw-secret --message.address=t/DEFAULT_TENANT/4711  In this example, we are using message address t/DEFAULT_TENANT/4711 which contains the device that the gateway is publishing the message for.\nPublishing Events The adapter supports AT LEAST ONCE delivery of Event messages only. A client therefore MUST set the settled property to false and the rcv-settle-mode property to first in all transfer frame(s) it uses for uploading events. All other combinations are not supported by the adapter and result in the message being rejected.\nPublish an Event (authenticated Device)  Message Address: event or e Settlement Mode: unsettled (AT LEAST ONCE) Authentication: SASL PLAIN or SASL EXTERNAL Message Body:  (optional) Arbitrary payload  Message properties:  (optional) Arbitrary properties (content-type, correlation-id, \u0026hellip;)  Disposition Frames:  Accepted: Message successfully processed by the adapter. Released: Message cannot be processed and should be redelivered. Rejected: Adapter rejects the message due to:  (hono:bad-request): A bad client request (e.g invalid content-type). (amqp:unauthorized-access): The adapter is disabled for tenant. (amqp:precondition-failed): Request not fulfilling certain requirements. (amqp:resource-limit-exceeded): Request rejected because the message limit for the given tenant is exceeded.    This is the preferred way for devices to publish events. It is available only if the protocol adapter has been configured to require devices to authenticate (which is the default).\nExample\nUpload a JSON string for device 4711:\n# in directory: hono/cli/target/ java -jar hono-cli-*-exec.jar --spring.profiles.active=amqp-send --hono.client.username=sensor1@DEFAULT_TENANT --hono.client.password=hono-secret --message.address=event --message.payload='{\u0026quot;alarm\u0026quot;: 1}'  Publish an Event (unauthenticated Device)  Message Address: event/${tenant-id}/${device-id} or e/${tenant-id}/${device-id} Settlement Mode: unsettled (AT LEAST ONCE) Message Body:  (optional) Arbitrary payload  Message properties:  (optional) Arbitrary properties (content-type, correlation-id, \u0026hellip;)  Disposition Frames:  Accepted: Message successfully processed by the adapter. Released: Message cannot be processed and should be redelivered. Rejected: Adapter rejects the message due to:  (hono:bad-request): A bad client request (e.g invalid content-type). (amqp:unauthorized-access): The adapter is disabled for tenant. (amqp:precondition-failed): Request not fulfilling certain requirements. (amqp:resource-limit-exceeded): Request rejected because the message limit for the given tenant is exceeded.    This address format is used by devices that have not authenticated to the protocol adapter. Note that this requires the HONO_AMQP_AUTHENTICATION_REQUIRED configuration property to be explicitly set to false.\nExamples\nPublish some JSON data for device 4711:\n# in directory: hono/cli/target/ java -jar hono-cli-*-exec.jar --spring.profiles.active=amqp-send --message.address=e/DEFAULT_TENANT/4711 --message.payload='{\u0026quot;alarm\u0026quot;: 1}'  Publish an Event (authenticated Gateway) Examples\nA Gateway connecting to the adapter using gw@DEFAULT_TENANT as username and gw-secret as password and then publishing some JSON data for device 4711:\n# in directory: hono/cli/target/ java -jar hono-cli-*-exec.jar --spring.profiles.active=amqp-send --hono.client.username=gw@DEFAULT_TENANT --hono.client.password=gw-secret --message.address=e/DEFAULT_TENANT/4711  In this example, we are using message address e/DEFAULT_TENANT/4711 which contains the device that the gateway is publishing the message for.\nCommand \u0026amp; Control The AMQP adapter supports devices to receive commands that have been sent by business applications by means of opening a receiver link using a device specific source address as described below. When a device no longer wants to receive commands anymore, it can simply close the link.\nWhen a device has successfully opened a receiver link for commands, the adapter sends an empty notification on behalf of the device to the downstream AMQP 1.0 Messaging Network with the ttd header set to -1, indicating that the device will be ready to receive commands until further notice. Analogously, the adapter sends an empty notification with the ttd header set to 0 when a device closes the link or disconnects.\nDevices send their responses to commands by means of sending an AMQP message with properties specific to the command that has been executed. The AMQP adapter accepts responses being published using either at most once (QoS 0) or at least once (QoS 1) delivery semantics. The device must send the command response messages using the same (sender) link that it uses for sending telemetry data and events.\nThe AMQP adapter checks the configured message limit before accepting any command requests and responses. In case of incoming command requests from business applications or the command responses from devices, if the message limit is exceeded, the Adapter rejects the message with the reason amqp:resource-limit-exceeded.\nReceiving Commands A device MUST use the following source address in its attach frame to open a link for receiving commands:\n command (authenticated device) command/${tenant}/${device-id} (unauthenticated device)   Note Previous versions of Hono used control instead of command as address prefix. Using the control prefix is still supported but deprecated.  The adapter supports AT LEAST ONCE delivery of command messages only. A client therefore MUST use unsettled for the snd-settle-mode and first for the rcv-settle-mode fields of its attach frame during link establishment. All other combinations are not supported and result in the termination of the link.\nOnce the link has been established, the adapter will send command messages having the following properties:\n   Name Mandatory Location Type Description     subject yes properties string Contains the name of the command to be executed.   reply-to no properties string Contains the address to which the command response should be sent. This property will be empty for one-way commands.   correlation-id no properties string This property will be empty for one-way commands, otherwise it will contain the identifier used to correlate the response with the command request.    Sending a Response to a Command A device only needs to respond to commands that contain a reply-to address and a correlation-id. However, if the application expects a response, then devices must publish a response back to the application. Devices may use the same anonymous sender link for this purpose that they also use for sending telemetry data and events.\nThe adapter supports AT LEAST ONCE delivery of command response messages only. A client therefore MUST set the settled property to true and the rcv-settle-mode property to first in all transfer frame(s) it uses for uploading command responses. All other combinations are not supported by the adapter and result in the message being rejected.\nThe table below provides an overview of the properties that must be set on a command response message:\n   Name Mandatory Location Type Description     to yes properties string MUST contain the value of the reply-to property of the command request message.   correlation-id yes properties string MUST contain the value of the correlation-id property of the command request message.   status yes application-properties integer MUST contain a status code indicating the outcome of processing the command at the device (see Command \u0026amp; Control API for details).    Examples The AMQP adapter client can be used to simulate a device which receives commands and sends responses back to the application. The command line client is used to simulate an application sending commands to devices and receiving command responses from devices.\nStart the AMQP adapter client, as follows:\n# in directory: hono/cli/target/ java -jar hono-cli-*-exec.jar --spring.profiles.active=amqp-command --hono.client.username=sensor1@DEFAULT_TENANT --hono.client.password=hono-secret Device is now ready to receive commands (Press Ctrl + c to terminate)  After successfully starting the client, a message indicating that the device is ready to receive commands will be printed to standard output. The device is now waiting to receive commands from applications. To send a command to the device, open a new terminal shell and start the command application, as shown below:\n# in directory: hono/cli/ java -jar target/hono-cli-*-exec.jar --hono.client.host=localhost --hono.client.username=consumer@HONO --hono.client.password=verysecret --spring.profiles.active=command,ssl \u0026gt;\u0026gt;\u0026gt;\u0026gt;\u0026gt;\u0026gt;\u0026gt;\u0026gt;\u0026gt; Enter name of command for device [DEFAULT_TENANT:4711] (prefix with 'ow:' to send one-way command): setBrightness \u0026gt;\u0026gt;\u0026gt;\u0026gt;\u0026gt;\u0026gt;\u0026gt;\u0026gt;\u0026gt; Enter command payload: some-payload \u0026gt;\u0026gt;\u0026gt;\u0026gt;\u0026gt;\u0026gt;\u0026gt;\u0026gt;\u0026gt; Enter content type: text/plain   Note Change into the cli directory before running the command above to start the command application. If you change into the target directory (i.e cli/target), then the client will not be able to locate to certificate needed to connect to the messaging network.  Once the command application starts successfully, enter a command name, payload and content-type of the command to send to the device.\nAfter sending the command, the device (i.e AMQP command client) will print out the command name and payload that it receives and automatically sends a command response to the application.\n$ Received Command Message : [Command name: setBrightness, Command payload: some-payload] $ Command response sent [outcome: Accepted{}]  Downstream Meta Data The adapter includes the following meta data in the application properties of messages being sent downstream:\n   Name Type Description     device_id string The identifier of the device that the message originates from.   orig_adapter string Contains the adapter\u0026rsquo;s type name which can be used by downstream consumers to determine the protocol adapter that the message has been received over. The AMQP adapter\u0026rsquo;s type name is hono-amqp.   orig_address string Contains the AMQP target address that the device has used to send the data.    The adapter also considers defaults registered for the device at either the tenant or the device level. The values of the default properties are determined as follows:\n If the message already contains a non-empty property of the same name, the value if unchanged. Otherwise, if a default property of the same name is defined in the device\u0026rsquo;s registration information, that value is used. Otherwise, if a default property of the same name is defined for the tenant that the device belongs to, that value is used.  Note that of the standard AMQP 1.0 message properties only the content-type and ttl can be set this way to a default value.\nTenant specific Configuration The adapter uses the Tenant API to retrieve tenant specific configuration for adapter type hono-amqp. The following properties are (currently) supported:\n   Name Type Default Value Description     enabled boolean true If set to false the adapter will reject all data from devices belonging to the tenant and respond with a amqp:unauthorized-access as the error condition value for rejecting the message.   "
},
{
	"uri": "https://www.eclipse.org/hono/docs/user-guide/kura-adapter/",
	"title": "Kura Adapter",
	"tags": [],
	"description": "",
	"content": "The Kura protocol adapter exposes an MQTT topic hierarchy allowing Eclipse Kura\u0026trade; based gateways to publish control and data messages to Eclipse Hono\u0026trade;\u0026rsquo;s Telemetry and Event endpoints.\n Note The Kura adapter is supposed to be used with gateways running Kura version 3.x. Gateways running Kura version 4 and later should connect to the MQTT adapter instead.  The Kura adapter by default requires devices (gateways) to authenticate during connection establishment. In order to do so, gateways need to provide a username and a password in the MQTT CONNECT packet. The username must have the form auth-id@tenant, e.g. sensor1@DEFAULT_TENANT. The adapter verifies the credentials provided by the gateway against the credentials the configured Credentials service has on record for the gateway. The adapter uses the Credentials API\u0026rsquo;s get operation to retrieve the credentials-on-record with the tenant and auth-id provided by the device in the username and hashed-password as the type of secret as query parameters.\nPlease refer to the Eclipse Kura documentation on how to configure the gateway\u0026rsquo;s cloud service connection accordingly. It is important to set the gateway\u0026rsquo;s topic.context.account-name to the ID of the Hono tenant that the gateway has been registered with whereas the gateway\u0026rsquo;s client-id needs to be set to the corresponding Hono device ID. The auth-id used as part of the gateway\u0026rsquo;s username property needs to match the authentication identifier of a set of credentials registered for the device ID in Hono\u0026rsquo;s Credentials service. In other words, the credentials configured on the gateway need to belong to the corresponding device ID.\nOnce the gateway has established a connection to the Kura adapter, all control and data messages published by applications running on the gateway are sent to the adapter and mapped to Hono\u0026rsquo;s Telemetry and Event API endpoints as follows:\n The adapter treats all messages that are published to a topic starting with the configured HONO_KURA_CONTROL_PREFIX as control messages. All other messages are considered to be data messages. control messages with QoS 0 are forwarded to Hono\u0026rsquo;s telemetry endpoint whereas messages with QoS 1 are forwarded to the event endpoint. The corresponding AMQP 1.0 messages that are sent downstream have a content type of application/vnd.eclipse.kura-control. data messages with QoS 0 are forwarded to the telemetry endpoint whereas messages with QoS 1 are forwarded to the event endpoint. The corresponding AMQP 1.0 messages that are sent downstream have a content type of application/vnd.eclipse.kura-data.  Downstream Meta Data The adapter includes the following meta data in messages being sent downstream:\n   Name Location Type Description     device_id application string The identifier of the device that the message originates from.   orig_adapter application string Contains the adapter\u0026rsquo;s type name which can be used by downstream consumers to determine the protocol adapter that the message has been received over. The Kura adapter\u0026rsquo;s type name is hono-kura-mqtt.   orig_address application string Contains the name of the MQTT topic that the Kura gateway has originally published the data to.    The adapter also considers defaults registered for the device at either the tenant or the device level. The values of the default properties are determined as follows:\n If the message already contains a non-empty property of the same name, the value if unchanged. Otherwise, if a default property of the same name is defined in the device\u0026rsquo;s registration information, that value is used. Otherwise, if a default property of the same name is defined for the tenant that the device belongs to, that value is used.  Note that of the standard AMQP 1.0 message properties only the content-type and ttl can be set this way to a default value.\nTenant specific Configuration The adapter uses the Tenant API to retrieve tenant specific configuration for adapter type hono-kura-mqtt. The following properties are (currently) supported:\n   Name Type Default Value Description     enabled boolean true If set to false the adapter will reject all data from devices belonging to the tenant.   "
},
{
	"uri": "https://www.eclipse.org/hono/docs/user-guide/sigfox-adapter/",
	"title": "Sigfox Adapter",
	"tags": [],
	"description": "",
	"content": "The Sigfox protocol adapter exposes an HTTP endpoint for connecting up with the Sigfox backend for publishing telemetry, events and use command \u0026amp; control.\n Tech preview This protocol adapter is not considered production ready. Its APIs might still be subject to change without warning.  Pre-requisites This Sigfox adapter only connects to the Sigfox backend system (backend.sigfox.com). It does not allow direct access to Sigfox devices.\nSo you need to set up your Sigfox devices on backend.sigfox.com and then configure the callbacks connect to your installation of Hono.\nDevices and credentials In a nutshell, the Sigfox adapter requires a single device identity, acting as a gateway device. This identity will be used to connect to Hono. All devices registered with Sigfox (the actual Sigfox devices), will be registered in Hono to allow this first identity as their gateway device.\nSetup example The following sub-sections walk you through an example setup.\nRegistering devices This example assumes that the Sigfox protocol adapter is available as https://iot-sigfox-adapter.my.hono.\nCreate a new gateway device with the following registration:\n{ \u0026quot;device-id\u0026quot;: \u0026quot;sigfox-backend\u0026quot; }  Create new credentials for the gateway device. For example, using a username of sigfox and a password of test12:\n{ \u0026quot;auth-id\u0026quot;: \u0026quot;sigfox\u0026quot;, \u0026quot;device-id\u0026quot;: \u0026quot;sigfox-backend\u0026quot;, \u0026quot;enabled\u0026quot;: true, \u0026quot;secrets\u0026quot;: [ { \u0026quot;pwd-plain\u0026quot;: \u0026quot;test12\u0026quot;, } ], \u0026quot;type\u0026quot;: \u0026quot;hashed-password\u0026quot; }  Create a new device, referencing the previous gateway device. The device id must be your Sigfox device ID (e.g. 1AB2C3):\n{ \u0026quot;device-id\u0026quot;: \u0026quot;1AB2C3\u0026quot;, \u0026quot;via\u0026quot;: \u0026quot;sigfox-backend\u0026quot; }  Setting up callbacks Log in to the Sigfox backend at https://backend.sigfox.com and then open up the view Device Type -\u0026gt; Callbacks.\nCreate a new \u0026ldquo;Custom\u0026rdquo; callback, with the following settings (replacing \u0026lt;TENANT\u0026gt; with the name of the tenant):\n Type: DATA – UPLINK Channel: URL Url pattern: https://iot-sigfox-adapter.my.hono/data/telemetry/\u0026lt;TENANT\u0026gt;?device={device}\u0026amp;data={data} Use HTTP Method: GET Headers  Authorization – Basic … (see note below)  Send SNI: ☑ (Enabled)   Credentials At the moment you need to manually put in the Authorization header, you cannot put the credentials into the URL, as there is a bug in the Sigfox backend, which cannot be fixed by Hono. The backend does not properly escape the @ character, and thus sends foo%40tenant instead of foo@tenant to the Hono protocol adapter.\nAs a workaround, you can explicitly set the Authorization header to a value of Basic \u0026lt;base64 encoded credentials\u0026gt;. You can encode the credentials using:\necho -n \u0026quot;sigfox@tenant:password\u0026quot; | base64  To get the full value, including the Basic you may use:\necho \u0026quot;Basic $(echo -n \u0026quot;sigfox@tenant:password\u0026quot; | base64)\u0026quot;    Enabling command \u0026amp; control It is possible to enable command \u0026amp; control as well. For this you need to:\n Switch the Type of the DATA callback from UPLINK to BIDIR Add the ack query parameter to the Url pattern, e.g. https://iot-sigfox-adapter.my.hono/data/telemetry/\u0026lt;TENANT\u0026gt;?device={device}\u0026amp;data={data}\u0026amp;ack={ack}   Command requirements Sigfox allows only a very specific payload in command messages. You must send exactly 8 bytes of data. It only supports one way commands.  Events You can send events by using the path /data/event on the URL.\nConsuming data Use the standard way of consuming Hono messages.\nKnown bugs and limitations  Only the simple URL and only data (no service or device events are currently supported. "
},
{
	"uri": "https://www.eclipse.org/hono/docs/user-guide/jmeter_load_tests/",
	"title": "Load Tests with JMeter",
	"tags": [],
	"description": "",
	"content": "Eclipse Hono\u0026trade; comes with an Apache JMeter plugin which provides samplers that can be used in JMeter test plans to send and receive telemetry/event data.\nThe plugin provides a Hono Receiver Sampler which can be used together with JMeter\u0026rsquo;s standard HTTP Sampler and XMeter\u0026rsquo;s JMeter plugin for MQTT to play the roles of a downstream application (consumer) and devices uploading data to the HTTP and MQTT protocol adapters. The diagram below illustrates how the components are related to each other.\n  JMeter with Hono   Installation  Install JMeter Copy the plugin jar file \u0026lt;hono-installation\u0026gt;/jmeter/target/plugin/hono-jmeter-\u0026lt;version\u0026gt;-jar-with-dependencies.jar to the \u0026lt;jmeter-installation\u0026gt;/lib/ext folder. Start JMeter  Example Test Plans The \u0026lt;hono-installation\u0026gt;/jmeter/src/jmeter folder contains several JMeter test plans which you can use as a basis for your own tests. All test plans can be run against Hono\u0026rsquo;s example deployment.\n http_messaging_throughput_test.jmx runs a set of HTTP clients and AMQP 1.0 consumers for a given period of time. The senders publish data to Hono\u0026rsquo; HTTP adapter while the consumers receive messages from the AMQP 1.0 Messaging Network (in case of the example installation this is the Qpid Dispatch Router). The test plan measures the number of messages that are sent/received during the test execution. mqtt_messaging_throughput_test.jmx runs a set of MQTT clients and AMQP 1.0 consumers for a given period of time. The clients publish data to Hono\u0026rsquo; MQTT adapter while the consumers receive messages from the AMQP 1.0 Messaging Network (in case of the example installation this is the Qpid Dispatch Router). The test plan measures the number of messages that are sent/received during the test execution. To use this plan you also need to add the JMeter plugin for MQTT to your JMeter plugin path. amqp_messaging_throughput_test.jmx runs a set of AMQP 1.0 senders and consumers for a given period of time. The senders publish data to the AMQP 1.0 Messaging Network directly while the consumers receive messages from the AMQP 1.0 Messaging Network (in case of the example installation this is the Qpid Dispatch Router). The test plan measures the number of messages that are sent/received during the test execution.\nThe sender can be configured to wait for n active receivers (from this test plan and JMeter instance) which can be used to make sure, that the receivers consuming from the corresponding address (e.g. telemetry/DEFAULT_TENANT) are up and running before the senders begin to publish messages.  It is recommended to run the test plans in non-gui mode as illustrated by the example shell scripts that are contained in the \u0026lt;hono-installation\u0026gt;/jmeter/src/jmeter folder. You may need to adapt some of the properties to reflect your concrete setup, e.g. the path to the trust store, host names, ports etc.\n"
},
{
	"uri": "https://www.eclipse.org/hono/docs/admin-guide/",
	"title": "Admin Guide",
	"tags": [],
	"description": "",
	"content": " Admin Guide Learn how to operate Hono\u0026trade; and look-up the configuration options of it\u0026rsquo;s components.\n"
},
{
	"uri": "https://www.eclipse.org/hono/docs/admin-guide/common-config/",
	"title": "Common Configuration",
	"tags": [],
	"description": "",
	"content": "Most Hono components support a common set of configuration options. This section describes those options.\nEach component which supports the following options explicitly states so. If it doesn\u0026rsquo;t, then these options are not supported by this component.\nJava VM Options The Java VM started in Hono\u0026rsquo;s components can be configured with arbitrary command line options by means of setting the _JAVA_OPTIONS environment variable.\n   Environment Variable Mandatory Default Description     _JAVA_OPTIONS no - Any options that should be passed to the Java VM on the command line, e.g. -Xmx128m    Vert.x Options The vert.x framework instance used to run Hono\u0026rsquo;s components on can be configured using the following environment variables or corresponding command line options:\n   Environment Variable\nCommand Line Option Mandatory Default Description     HONO_VERTX_DNS_QUERY_TIMEOUT\n--hono.vertx.dnsQueryTimeout no 5000 The amount of time (in milliseconds) after which a DNS query is considered to be failed. Setting this variable to a smaller value may help to reduce the time required to establish connections to the services this adapter depends on. However, setting it to a value that is too small for any DNS query to succeed will effectively prevent any connections to be established at all.   HONO_VERTX_MAX_EVENT_LOOP_EXECUTE_TIME_MILLIS\n--hono.vertx.maxEventLoopExecuteTimeMillis no 2000 The maximum number of milliseconds that a task on the event loop may run without being considered to block the event loop.   HONO_VERTX_PREFER_NATIVE\n--hono.vertx.preferNative no false Tries to enable epoll() support on Linux (if available). See the notes below for an explanation of the benefits of enabling epoll.    \nUsing epoll() on Linux Using epoll() on Linux may provide better performance for applications which have a high I/O throughput. Especially when the application supports an asynchronous I/O model. This is true for most Hono components and applications using Hono.\nThe Netty framework supports using epoll() on Linux x86_64 based systems. Hono provides the a Maven build profile for enabling support for epoll during the build process.\nIn order to use epoll\n Hono needs to be built with the netty-native-linux-x86_64 Maven profile enabled and the HONO_VERTX_PREFER_NATIVE environment variable needs to be set to true on startup. "
},
{
	"uri": "https://www.eclipse.org/hono/docs/admin-guide/auth-server-config/",
	"title": "Auth Server Configuration",
	"tags": [],
	"description": "",
	"content": "The Auth Server component exposes a service endpoint implementing Eclipse Hono\u0026trade;\u0026rsquo;s Authentication API. Other services use this component for authenticating clients and retrieving a token asserting the client\u0026rsquo;s identity and corresponding authorities.\nThis component serves as a default implementation of the Authentication API only. On startup, it reads in all identities and their authorities from a JSON file from the file system. All data is then kept in memory and there are no remote service APIs for managing the identities and their authorities.\nThe Auth Server is implemented as a Spring Boot application. It can be run either directly from the command line or by means of starting the corresponding Docker image created from it.\nService Configuration In addition to the following options, this component supports the options described in Common Configuration.\nThe server can be configured by means of environment variables or corresponding command line options. The following table provides an overview of the configuration variables and corresponding command line options that the server supports:\n   Environment Variable\nCommand Line Option Mandatory Default Description     HONO_APP_MAX_INSTANCES\n--hono.app.maxInstances no #CPU cores The number of verticle instances to deploy. If not set, one verticle per processor core is deployed.   HONO_AUTH_AMQP_BIND_ADDRESS\n--hono.auth.amqp.bindAddress no 127.0.0.1 The IP address of the network interface that the secure port should be bound to.\nSee Port Configuration below for details.   HONO_AUTH_AMQP_CERT_PATH\n--hono.auth.amqp.certPath no - The absolute path to the PEM file containing the certificate that the server should use for authenticating to clients. This option must be used in conjunction with HONO_AUTH_AMQP_KEY_PATH.\nAlternatively, the HONO_AUTH_AMQP_KEY_STORE_PATH option can be used to configure a key store containing both the key as well as the certificate.   HONO_AUTH_AMQP_INSECURE_PORT\n--hono.auth.amqp.insecurePort no - The insecure port the server should listen on.\nSee Port Configuration below for details.   HONO_AUTH_AMQP_INSECURE_PORT_BIND_ADDRESS\n--hono.auth.amqp.insecurePortBindAddress no 127.0.0.1 The IP address of the network interface that the insecure port should be bound to.\nSee Port Configuration below for details.   HONO_AUTH_AMQP_INSECURE_PORT_ENABLED\n--hono.auth.amqp.insecurePortEnabled no false If set to true the server will open an insecure port (not secured by TLS) using either the port number set via HONO_AUTH_AMQP_INSECURE_PORT or the default AMQP port number (5672) if not set explicitly.\nSee Port Configuration below for details.   HONO_AUTH_AMQP_KEY_PATH\n--hono.auth.amqp.keyPath no - The absolute path to the (PKCS8) PEM file containing the private key that the server should use for authenticating to clients. Note that the private key is not protected by a password. You should therefore make sure that the key file can only be read by the user that the server process is running under. This option must be used in conjunction with HONO_AUTH_CERT_PATH.\nAlternatively, the HONO_AUTH_KEY_STORE_PATH option can be used to configure a key store containing both the key as well as the certificate.   HONO_AUTH_AMQP_KEY_STORE_PASSWORD\n--hono.auth.amqp.keyStorePassword no - The password required to read the contents of the key store.   HONO_AUTH_AMQP_KEY_STORE_PATH\n--hono.auth.amqp.keyStorePath no - The absolute path to the Java key store containing the private key and certificate that the server should use for authenticating to clients. Either this option or the HONO_AUTH_AMQP_KEY_PATH and HONO_AUTH_AMQP_CERT_PATH options need to be set in order to enable TLS secured connections with clients. The key store format can be either JKS or PKCS12 indicated by a .jks or .p12 file suffix respectively.   HONO_AUTH_AMQP_NATIVE_TLS_REQUIRED\n--hono.auth.amqp.nativeTlsRequired no false The server will probe for OpenSLL on startup if a secure port is configured. By default, the server will fall back to the JVM\u0026rsquo;s default SSL engine if not available. However, if set to true, the server will fail to start at all in this case.   HONO_AUTH_AMQP_PORT\n--hono.auth.amqp.port no 5671 The secure port that the server should listen on.\nSee Port Configuration below for details.   HONO_AUTH_AMQP_SECURE_PROTOCOLS\n--hono.auth.amqp.secureProtocols no TLSv1.2 A (comma separated) list of secure protocols that are supported when negotiating TLS sessions. Please refer to the vert.x documentation for a list of supported protocol names.   HONO_AUTH_AMQP_TRUST_STORE_PASSWORD\n--hono.auth.amqp.trustStorePassword no - The password required to read the contents of the trust store.   HONO_AUTH_AMQP_TRUST_STORE_PATH\n--hono.auth.amqp.trustStorePath no - The absolute path to the Java key store containing the CA certificates the service uses for authenticating clients. The key store format can be either JKS, PKCS12 or PEM indicated by a .jks, .p12 or .pem file suffix respectively.   HONO_AUTH_SVC_PERMISSIONS_PATH\n--hono.auth.svc.permissionsPath no classpath:/\npermissions.json The Spring resource URI of the JSON file defining the identities and corresponding authorities on Hono\u0026rsquo;s endpoint resources. The default file bundled with the Auth Server defines authorities required by protocol adapters and downstream consumer. The default permissions file should only be used for evaluation purposes.   HONO_AUTH_SVC_SIGNING_KEY_PATH\n--hono.auth.svc.signing.keyPath no - The absolute path to the (PKCS8) PEM file containing the private key that the server should use for signing tokens asserting an authenticated client\u0026rsquo;s identity and authorities. When using this variable, other services that need to validate the tokens issued by this service need to be configured with the corresponding certificate/public key. Alternatively, a symmetric key can be used for signing (and validating) by setting the HONO_AUTH_SVC_SIGNING_SHARED_SECRET variable. If none of these variables is set, the server falls back to the key indicated by the HONO_AUTH_AMQP_KEY_PATH variable. If that variable is also not set, startup of the server fails.   HONO_AUTH_SVC_SIGNING_SHARED_SECRET\n--hono.auth.svc.signing.sharedSecret no - A string to derive a symmetric key from that is used for signing tokens asserting an authenticated client\u0026rsquo;s identity and authorities. The key is derived from the string by using the bytes of the String\u0026rsquo;s UTF8 encoding. When setting the signing key using this variable, other services that need to validate the tokens issued by this service need to be configured with the same key. Alternatively, an asymmetric key pair can be used for signing (and validating) by setting the HONO_AUTH_SVC_SIGNING_KEY_PATH variable. If none of these variables is set, startup of the server fails.   HONO_AUTH_SVC_SIGNING_TOKEN_EXPIRATION\n--hono.auth.svc.signing.tokenExpiration no 600 The number of seconds after which the tokens created by this service for asserting an authenticated client\u0026rsquo;s identity should be considered invalid. Other Hono components will close AMQP connections with clients after this period in order to force the client to authenticate again and create a new token. In closed environments it should be save to set this value to a much higher value, e.g. several hours.    The variables only need to be set if the default value does not match your environment.\nPort Configuration The Auth Server can be configured to listen for connections on\n a secure port only (default) or an insecure port only or both a secure and an insecure port (dual port configuration)  The server will fail to start if none of the ports is configured properly.\nSecure Port Only The server needs to be configured with a private key, a certificate holding the public key and a trust store in order to open a TLS secured port.\nThere are two alternative ways for setting the private key and certificate:\n Setting the HONO_AUTH_AMQP_KEY_STORE_PATH and the HONO_AUTH_AMQP_KEY_STORE_PASSWORD variables in order to load the key \u0026amp; certificate from a password protected key store, or setting the HONO_AUTH_AMQP_KEY_PATH and HONO_AUTH_AMQP_CERT_PATH variables in order to load the key and certificate from two separate PEM files in PKCS8 format.  In order to set the trust store, the HONO_AUTH_AMQP_TRUST_STORE_PATH variable needs to be set to a key store containing the trusted root CA certificates. The HONO_AUTH_AMQP_TRUST_STORE_PASSWORD variable needs to be set if the key store requires a pass phrase for reading its contents.\nWhen starting up, the server will bind a TLS secured socket to the default secure AMQP port 5671. The port number can also be set explicitly using the HONO_AUTH_AMQP_PORT variable.\nThe HONO_AUTH_AMQP_BIND_ADDRESS variable can be used to specify the network interface that the port should be exposed on. By default the port is bound to the loopback device only, i.e. the port will only be accessible from the local host. Setting this variable to 0.0.0.0 will let the port being bound to all network interfaces (be careful not to expose the port unintentionally to the outside world).\nInsecure Port Only The secure port will mostly be required for production scenarios. However, it might be desirable to expose a non-TLS secured port instead, e.g. for testing purposes. In any case, the non-secure port needs to be explicitly enabled either by\n explicitly setting HONO_AUTH_AMQP_INSECURE_PORT to a valid port number, or by implicitly configuring the default AMQP port (5672) by simply setting HONO_AUTH_AMQP_INSECURE_PORT_ENABLED to true.  The server issues a warning on the console if HONO_AUTH_AMQP_INSECURE_PORT is set to the default secure AMQP port (5671).\nThe HONO_AUTH_AMQP_INSECURE_PORT_BIND_ADDRESS variable can be used to specify the network interface that the port should be exposed on. By default the port is bound to the loopback device only, i.e. the port will only be accessible from the local host. This variable might be used to e.g. expose the non-TLS secured port on a local interface only, thus providing easy access from within the local network, while still requiring encrypted communication when accessed from the outside over public network infrastructure.\nSetting this variable to 0.0.0.0 will let the port being bound to all network interfaces (be careful not to expose the port unintentionally to the outside world).\nDual Port In test setups and some production scenarios Hono server may be configured to open one secure and one insecure port at the same time.\nThis is achieved by configuring both ports correctly (see above). The server will fail to start if both ports are configured to use the same port number.\nSince the secure port may need different visibility in the network setup compared to the secure port, it has it\u0026rsquo;s own binding address HONO_AUTH_AMQP_INSECURE_PORT_BIND_ADDRESS. This can be used to narrow the visibility of the insecure port to a local network e.g., while the secure port may be visible worldwide.\nEphemeral Ports The server may be configured to open both a secure and a non-secure port at the same time simply by configuring both ports as described above. For this to work, both ports must be configured to use different port numbers, otherwise startup will fail.\nMetrics Configuration See Monitoring \u0026amp; Tracing Admin Guide for details on how to configure the reporting of metrics.\n"
},
{
	"uri": "https://www.eclipse.org/hono/docs/admin-guide/device-registry-config/",
	"title": "Device Registry Configuration",
	"tags": [],
	"description": "",
	"content": "The Device Registry component provides an exemplary implementation of Eclipse Hono\u0026trade;\u0026rsquo;s Device Registration, Credentials, Tenant and Device Connection APIs.\nProtocol adapters use these APIs to determine a device\u0026rsquo;s registration status, e.g. if it is enabled and if it is registered with a particular tenant, and to authenticate a device before accepting any data for processing from it.\nThere is no particular technical reason to implement these three APIs in one component, so for production scenarios there might be up to three different components each implementing one of the API\u0026rsquo;s.\nThe Device Registry component also exposes HTTP based resources for managing tenants and the registration information and credentials of devices.\nThe Device Registry is implemented as a Spring Boot application. It can be run either directly from the command line or by means of starting the corresponding Docker image created from it.\nService Configuration In addition to the following options, this component supports the options described in Common Configuration.\nThe following table provides an overview of the configuration variables and corresponding command line options for configuring the Device Registry.\n   Environment Variable\nCommand Line Option Mandatory Default Description     HONO_APP_MAX_INSTANCES\n--hono.app.maxInstances no #CPU cores The number of verticle instances to deploy. If not set, one verticle per processor core is deployed.   HONO_APP_TYPE\n--hono.app.type no file The device registry implementation to use. This may be either file or dummy. In the case of dummy a dummy implementation will be used which will consider all devices queried for as valid devices, having the access credentials hono-secret. Of course this shouldn\u0026rsquo;t be used for productive use.   HONO_CREDENTIALS_SVC_CACHE_MAX_AGE\n--hono.credentials.svc.cacheMaxAge no 180 The maximum period of time (seconds) that information returned by the service\u0026rsquo;s operations may be cached for.   HONO_CREDENTIALS_SVC_FILENAME\n--hono.credentials.svc.filename no /var/lib/hono/device-registry/\ncredentials.json The path to the file where the server stores credentials of devices. Hono tries to read credentials from this file during start-up and writes out all identities to this file periodically if property HONO_CREDENTIALS_SVC_SAVE_TO_FILE is set to true.\nPlease refer to Credentials File Format for details regarding the file\u0026rsquo;s format.   HONO_CREDENTIALS_SVC_MAX_BCRYPT_ITERATIONS\n--hono.credentials.svc.maxBcryptIterations no 10 The maximum number of iterations that are supported in password hashes using the BCrypt hash function. This limit is enforced by the device registry when adding or updating corresponding credentials. Increasing this number allows for potentially more secure password hashes to be used. However, the time required to compute the hash increases exponentially with the number of iterations.   HONO_CREDENTIALS_SVC_MODIFICATION_ENABLED\n--hono.credentials.svc.modificationEnabled no true When set to false the credentials contained in the registry cannot be updated nor removed.   HONO_CREDENTIALS_SVC_RECEIVER_LINK_CREDIT\n--hono.credentials.svc.receiverLinkCredit no 100 The number of credits to flow to a client connecting to the Credentials endpoint.   HONO_CREDENTIALS_SVC_SAVE_TO_FILE\n--hono.credentials.svc.saveToFile no false When set to true the server will periodically write out the registered credentials to the file specified by the HONO_CREDENTIALS_SVC_FILENAME property.   HONO_DEVICE_CONNECTION_SVC_MAX_DEVICES_PER_TENANT\n--hono.deviceConnection.svc.maxDevicesPerTenant no 100 The number of devices per tenant for which connection related data is stored. It is an error to set this property to a value \u0026lt;= 0.   HONO_REGISTRY_AMQP_BIND_ADDRESS\n--hono.registry.amqp.bindAddress no 127.0.0.1 The IP address of the network interface that the secure AMQP port should be bound to.\nSee Port Configuration below for details.   HONO_REGISTRY_AMQP_CERT_PATH\n--hono.registry.amqp.certPath no - The absolute path to the PEM file containing the certificate that the server should use for authenticating to clients. This option must be used in conjunction with HONO_REGISTRY_AMQP_KEY_PATH.\nAlternatively, the HONO_REGISTRY_AMQP_KEY_STORE_PATH option can be used to configure a key store containing both the key as well as the certificate.   HONO_REGISTRY_AMQP_INSECURE_PORT\n--hono.registry.amqp.insecurePort no - The insecure port the server should listen on for AMQP 1.0 connections.\nSee Port Configuration below for details.   HONO_REGISTRY_AMQP_INSECURE_PORT_BIND_ADDRESS\n--hono.registry.amqp.insecurePortBindAddress no 127.0.0.1 The IP address of the network interface that the insecure AMQP port should be bound to.\nSee Port Configuration below for details.   HONO_REGISTRY_AMQP_INSECURE_PORT_ENABLED\n--hono.registry.amqp.insecurePortEnabled no false If set to true the server will open an insecure port (not secured by TLS) using either the port number set via HONO_REGISTRY_AMQP_INSECURE_PORT or the default AMQP port number (5672) if not set explicitly.\nSee Port Configuration below for details.   HONO_REGISTRY_AMQP_KEY_PATH\n--hono.registry.amqp.keyPath no - The absolute path to the (PKCS8) PEM file containing the private key that the server should use for authenticating to clients. This option must be used in conjunction with HONO_REGISTRY_AMQP_CERT_PATH. Alternatively, the HONO_REGISTRY_AMQP_KEY_STORE_PATH option can be used to configure a key store containing both the key as well as the certificate.   HONO_REGISTRY_AMQP_KEY_STORE_PASSWORD\n--hono.registry.amqp.keyStorePassword no - The password required to read the contents of the key store.   HONO_REGISTRY_AMQP_KEY_STORE_PATH\n--hono.registry.amqp.keyStorePath no - The absolute path to the Java key store containing the private key and certificate that the server should use for authenticating to clients. Either this option or the HONO_REGISTRY_AMQP_KEY_PATH and HONO_REGISTRY_AMQP_CERT_PATH options need to be set in order to enable TLS secured connections with clients. The key store format can be either JKS or PKCS12 indicated by a .jks or .p12 file suffix respectively.   HONO_REGISTRY_AMQP_NATIVE_TLS_REQUIRED\n--hono.registry.amqp.nativeTlsRequired no false The server will probe for OpenSLL on startup if a secure port is configured. By default, the server will fall back to the JVM\u0026rsquo;s default SSL engine if not available. However, if set to true, the server will fail to start at all in this case.   HONO_REGISTRY_AMQP_PORT\n--hono.registry.amqp.port no 5671 The secure port that the server should listen on for AMQP 1.0 connections.\nSee Port Configuration below for details.   HONO_REGISTRY_AMQP_SECURE_PROTOCOLS\n--hono.registry.amqp.secureProtocols no TLSv1.2 A (comma separated) list of secure protocols that are supported when negotiating TLS sessions. Please refer to the vert.x documentation for a list of supported protocol names.   HONO_REGISTRY_REST_BIND_ADDRESS\n--hono.registry.rest.bindAddress no 127.0.0.1 The IP address of the network interface that the secure HTTP port should be bound to.\nSee Port Configuration below for details.   HONO_REGISTRY_REST_CERT_PATH\n--hono.registry.rest.certPath no - The absolute path to the PEM file containing the certificate that the server should use for authenticating to clients. This option must be used in conjunction with HONO_REGISTRY_REST_KEY_PATH.\nAlternatively, the HONO_REGISTRY_REST_KEY_STORE_PATH option can be used to configure a key store containing both the key as well as the certificate.   HONO_REGISTRY_REST_INSECURE_PORT\n--hono.registry.rest.insecurePort no - The insecure port the server should listen on for HTTP requests.\nSee Port Configuration below for details.   HONO_REGISTRY_REST_INSECURE_PORT_BIND_ADDRESS\n--hono.registry.rest.insecurePortBindAddress no 127.0.0.1 The IP address of the network interface that the insecure HTTP port should be bound to.\nSee Port Configuration below for details.   HONO_REGISTRY_REST_INSECURE_PORT_ENABLED\n--hono.registry.rest.insecurePortEnabled no false If set to true the server will open an insecure port (not secured by TLS) using either the port number set via HONO_REGISTRY_REST_INSECURE_PORT or the default AMQP port number (5672) if not set explicitly.\nSee Port Configuration below for details.   HONO_REGISTRY_REST_KEY_PATH\n--hono.registry.rest.keyPath no - The absolute path to the (PKCS8) PEM file containing the private key that the server should use for authenticating to clients. This option must be used in conjunction with HONO_REGISTRY_REST_CERT_PATH. Alternatively, the HONO_REGISTRY_REST_KEY_STORE_PATH option can be used to configure a key store containing both the key as well as the certificate.   HONO_REGISTRY_REST_KEY_STORE_PASSWORD\n--hono.registry.rest.keyStorePassword no - The password required to read the contents of the key store.   HONO_REGISTRY_REST_KEY_STORE_PATH\n--hono.registry.rest.keyStorePath no - The absolute path to the Java key store containing the private key and certificate that the server should use for authenticating to clients. Either this option or the HONO_REGISTRY_REST_KEY_PATH and HONO_REGISTRY_REST_CERT_PATH options need to be set in order to enable TLS secured connections with clients. The key store format can be either JKS or PKCS12 indicated by a .jks or .p12 file suffix respectively.   HONO_REGISTRY_REST_PORT\n--hono.registry.rest.port no 5671 The secure port that the server should listen on for HTTP requests.\nSee Port Configuration below for details.   HONO_REGISTRY_SVC_CACHE_MAX_AGE\n--hono.registry.svc.cacheMaxAge no 180 The maximum period of time (seconds) that information returned by the service\u0026rsquo;s operations may be cached for.   HONO_REGISTRY_SVC_FILENAME\n--hono.registry.svc.filename no /var/lib/hono/device-registry/\ndevice-identities.json The path to the file where the server stores identities of registered devices. Hono tries to read device identities from this file during start-up and writes out all identities to this file periodically if property HONO_REGISTRY_SVC_SAVE_TO_FILE is set to true.\nPlease refer to Device Identities File Format for details regarding the file\u0026rsquo;s format.   HONO_REGISTRY_SVC_MAX_DEVICES_PER_TENANT\n--hono.registry.svc.maxDevicesPerTenant no 100 The number of devices that can be registered for each tenant. It is an error to set this property to a value \u0026lt;= 0.   HONO_REGISTRY_SVC_MODIFICATION_ENABLED\n--hono.registry.svc.modificationEnabled no true When set to false the device information contained in the registry cannot be updated nor removed from the registry.   HONO_REGISTRY_SVC_RECEIVER_LINK_CREDIT\n--hono.registry.svc.receiverLinkCredit no 100 The number of credits to flow to a client connecting to the Device Registration endpoint.   HONO_REGISTRY_SVC_SAVE_TO_FILE\n--hono.registry.svc.saveToFile no false When set to true the server will periodically write out the registered device information to the file specified by the HONO_REGISTRY_SVC_FILENAME property.   HONO_REGISTRY_SVC_SIGNING_KEY_PATH\n--hono.registry.svc.signing.keyPath no - The absolute path to the (PKCS8) PEM file containing the private key that the server should use for signing tokens asserting a device\u0026rsquo;s registration status. When using this variable, other services that need to validate the tokens issued by this service need to be configured with the corresponding certificate/public key. Alternatively, a symmetric key can be used for signing (and validating) by setting the HONO_REGISTRY_SVC_SIGNING_SHARED_SECRET variable. If none of these variables is set, the server falls back to the key indicated by the HONO_REGISTRY_AMP_KEY_PATH variable. If that variable is also not set, startup of the server fails.   HONO_REGISTRY_SVC_SIGNING_SHARED_SECRET\n--hono.registry.svc.signing.sharedSecret no - A string to derive a symmetric key from that is used for signing tokens asserting a device\u0026rsquo;s registration status. The key is derived from the string by using the bytes of the String\u0026rsquo;s UTF8 encoding. When setting the signing key using this variable, other services that need to validate the tokens issued by this service need to be configured with the same key. Alternatively, an asymmetric key pair can be used for signing (and validating) by setting the HONO_REGISTRY_SVC_SIGNING_KEY_PATH variable. If none of these variables is set, startup of the server fails.   HONO_REGISTRY_SVC_SIGNING_TOKEN_EXPIRATION\n--hono.registry.svc.signing.tokenExpiration no 10 The expiration period to use for the tokens asserting the registration status of devices.   HONO_TENANT_SVC_CACHE_MAX_AGE\n--hono.tenant.svc.cacheMaxAge no 180 The maximum period of time (seconds) that information returned by the service\u0026rsquo;s operations may be cached for.   HONO_TENANT_SVC_FILENAME\n--hono.tenant.svc.filename no /var/lib/hono/device-registry/\ntenants.json The path to the file where the server stores tenants. Hono tries to read tenants from this file during start-up and writes out all identities to this file periodically if property HONO_TENANT_SVC_SAVE_TO_FILE is set to true.\nPlease refer to Tenants File Format for details regarding the file\u0026rsquo;s format.   HONO_TENANT_SVC_MODIFICATION_ENABLED\n--hono.tenant.svc.modificationEnabled no true When set to false the tenants contained in the registry cannot be updated nor removed.   HONO_TENANT_SVC_RECEIVER_LINK_CREDIT\n--hono.tenant.svc.receiverLinkCredit no 100 The number of credits to flow to a client connecting to the Tenant endpoint.   HONO_TENANT_SVC_SAVE_TO_FILE\n--hono.tenant.svc.saveToFile no false When set to true the server will periodically write out the registered tenants to the file specified by the HONO_TENANTS_SVC_TENANT_FILENAME property.    The variables only need to be set if the default value does not match your environment.\nPort Configuration The Device Registry supports configuration of both, an AMQP based endpoint as well as an HTTP based endpoint proving RESTful resources for managing registration information and credentials. Both endpoints can be configured to listen for connections on\n a secure port only (default) or an insecure port only or both a secure and an insecure port (dual port configuration)  The server will fail to start if none of the ports is configured properly.\nThe following sections apply to configuring both, the AMQP endpoint as well as the REST endpoint. The environment variables to use for configuring the REST endpoint are the same as the ones for the AMQP endpoint, substituting _AMQP_ with _REST_, e.g. HONO_REGISTRY_REST_KEY_PATH instead of HONO_REGISTRY_AMQP_KEY_PATH.\nSecure Port Only The server needs to be configured with a private key and certificate in order to open a TLS secured port.\nThere are two alternative ways for doing so:\n Setting the HONO_REGISTRY_AMQP_KEY_STORE_PATH and the HONO_REGISTRY_AMQP_KEY_STORE_PASSWORD variables in order to load the key \u0026amp; certificate from a password protected key store, or setting the HONO_REGISTRY_AMQP_KEY_PATH and HONO_REGISTRY_AMQP_CERT_PATH variables in order to load the key and certificate from two separate PEM files in PKCS8 format.  When starting up, the server will bind a TLS secured socket to the default secure AMQP port 5671. The port number can also be set explicitly using the HONO_REGISTRY_AMQP_PORT variable.\nThe HONO_REGISTRY_AMQP_BIND_ADDRESS variable can be used to specify the network interface that the port should be exposed on. By default the port is bound to the loopback device only, i.e. the port will only be accessible from the local host. Setting this variable to 0.0.0.0 will let the port being bound to all network interfaces (be careful not to expose the port unintentionally to the outside world).\nInsecure Port Only The secure port will mostly be required for production scenarios. However, it might be desirable to expose a non-TLS secured port instead, e.g. for testing purposes. In any case, the non-secure port needs to be explicitly enabled either by\n explicitly setting HONO_REGISTRY_AMQP_INSECURE_PORT to a valid port number, or by implicitly configuring the default AMQP port (5672) by simply setting HONO_REGISTRY_AMQP_INSECURE_PORT_ENABLED to true.  The server issues a warning on the console if HONO_REGISTRY_AMQP_INSECURE_PORT is set to the default secure AMQP port (5671).\nThe HONO_REGISTRY_AMQP_INSECURE_PORT_BIND_ADDRESS variable can be used to specify the network interface that the port should be exposed on. By default the port is bound to the loopback device only, i.e. the port will only be accessible from the local host. This variable might be used to e.g. expose the non-TLS secured port on a local interface only, thus providing easy access from within the local network, while still requiring encrypted communication when accessed from the outside over public network infrastructure.\nSetting this variable to 0.0.0.0 will let the port being bound to all network interfaces (be careful not to expose the port unintentionally to the outside world).\nDual Port In test setups and some production scenarios Hono server may be configured to open one secure and one insecure port at the same time.\nThis is achieved by configuring both ports correctly (see above). The server will fail to start if both ports are configured to use the same port number.\nSince the secure port may need different visibility in the network setup compared to the secure port, it has it\u0026rsquo;s own binding address HONO_REGISTRY_AMQP_INSECURE_PORT_BIND_ADDRESS. This can be used to narrow the visibility of the insecure port to a local network e.g., while the secure port may be visible worldwide.\nEphemeral Ports The server may be configured to open both a secure and a non-secure port at the same time simply by configuring both ports as described above. For this to work, both ports must be configured to use different port numbers, otherwise startup will fail.\nAuthentication Service Connection Configuration The Device Registry requires a connection to an implementation of Hono\u0026rsquo;s Authentication API in order to authenticate and authorize client requests.\nThe connection is configured according to Hono Client Configuration where the ${PREFIX} is set to HONO_AUTH. Since Hono\u0026rsquo;s Authentication Service does not allow caching of the responses, the cache properties can be ignored.\nIn addition to the standard client configuration properties, following properties need to be set for the connection:\n   Environment Variable\nCommand Line Option Mandatory Default Description     HONO_AUTH_VALIDATION_CERT_PATH\n--hono.auth.validation.certPath no - The absolute path to the PEM file containing the public key that the service should use for validating tokens issued by the Authentication service. Alternatively, a symmetric key can be used for validating tokens by setting the HONO_AUTH_VALIDATION_SHARED_SECRET variable. If none of these variables is set, the service falls back to the key indicated by the HONO_AUTH_CERT_PATH variable. If that variable is also not set, startup of the service fails.   HONO_AUTH_VALIDATION_SHARED_SECRET\n--hono.auth.validation.sharedSecret no - A string to derive a symmetric key from which is used for validating tokens issued by the Authentication service. The key is derived from the string by using the bytes of the String\u0026rsquo;s UTF8 encoding. When setting the validation key using this variable, the Authentication service must be configured with the same key. Alternatively, an asymmetric key pair can be used for validating (and signing) by setting the HONO_AUTH_SIGNING_CERT_PATH variable. If none of these variables is set, startup of the service fails.    Metrics Configuration See Monitoring \u0026amp; Tracing Admin Guide for details on how to configure the reporting of metrics.\nDevice Identities File Format The Device Registry supports persisting the device identities and their registration information to a JSON file in the local file system. The Getting started Guide includes an example configuration which illustrates the file format used. The configuration file\u0026rsquo;s location is /deploy/src/main/deploy/example-device-identities.json.\nCredentials File Format The Device Registry supports persisting the devices\u0026rsquo; credentials to a JSON file in the local file system. The Getting started Guide includes an example configuration which illustrates the file format used. The configuration file\u0026rsquo;s location is /deploy/src/main/deploy/example-credentials.json.\nTenants File Format The Device Registry supports persisting tenants to a JSON file in the local file system. The configuration file\u0026rsquo;s location is /deploy/src/main/deploy/example-tenants.json.\nConfiguring Gateway Devices The Device Registry supports devices to act on behalf of other devices. This is particularly useful for cases where a device does not connect directly to a Hono protocol adapter but is connected to a gateway component that is usually specific to the device\u0026rsquo;s communication protocol. It is the gateway component which then connects to a Hono protocol adapter and publishes data on behalf of the device(s). Examples of such a set up include devices using SigFox or LoRa for communication.\nIn these cases the protocol adapter will authenticate the gateway component instead of the device for which it wants to publish data. In order to verify that the gateway is authorized to publish data on behalf of the particular device, the protocol adapter should include the gateway\u0026rsquo;s device identifier (as determined during the authentication process) in its invocation of the Device Registration API\u0026rsquo;s assert Device Registration operation.\nThe Device Registry will then do the following: 1. Verify that the device exists and is enabled. 2. Verify that the gateway exists and is enabled. 3. Verify that the device\u0026rsquo;s registration information contains a property called via and that its value is either the gateway\u0026rsquo;s device identifier or a JSON array which contains the gateway\u0026rsquo;s device identifier as one of its values.\nOnly if all conditions are met, the Device Registry returns an assertion of the device\u0026rsquo;s registration status. The protocol adapter can then forward the published data to the AMQP Messaging Network in the same way as for any device that connects directly to the adapter.\nThe example configuration file (located at /deploy/src/main/deploy/example-device-identities.json) includes a device and a corresponding gateway configured in this way.\n"
},
{
	"uri": "https://www.eclipse.org/hono/docs/admin-guide/device-connection-config/",
	"title": "Configuring the Device Connection Service",
	"tags": [],
	"description": "",
	"content": "The Device Connection service provides an implementation of Eclipse Hono\u0026trade;\u0026rsquo;s Device Connection API.\nProtocol adapters use this API to store and retrieve information about the gateway that a device is using to connect to Hono\u0026rsquo;s protocol adapters. This information is necessary for routing commands to the particular protocol adapter instance that the gateway used by the device is connected to.\nThe Device Connection component provides a production grade implementation of the Device Connection API which uses a remote data grid for storing information about device connections. The data grid can be scaled out independently from the Device Connection service components to meet the storage demands at hand.\nThe Device Connection component is implemented as a Spring Boot application. It can be run either directly from the command line or by means of starting the corresponding Docker image created from it.\nService Configuration In addition to the following options, this component supports the options described in Common Configuration.\nThe following table provides an overview of the configuration variables and corresponding command line options for configuring the Device Connection component.\n   Environment Variable\nCommand Line Option Mandatory Default Description     HONO_APP_MAX_INSTANCES\n--hono.app.maxInstances no #CPU cores The number of Verticle instances to deploy. If not set, one Verticle per processor core is deployed.   HONO_DEVICE_CONNECTION_AMQP_BIND_ADDRESS\n--hono.registry.amqp.bindAddress no 127.0.0.1 The IP address of the network interface that the secure AMQP port should be bound to.\nSee Port Configuration below for details.   HONO_DEVICE_CONNECTION_AMQP_CERT_PATH\n--hono.deviceConnection.amqp.certPath no - The absolute path to the PEM file containing the certificate that the server should use for authenticating to clients. This option must be used in conjunction with HONO_DEVICE_CONNECTION_AMQP_KEY_PATH.\nAlternatively, the HONO_DEVICE_CONNECTION_AMQP_KEY_STORE_PATH option can be used to configure a key store containing both the key as well as the certificate.   HONO_DEVICE_CONNECTION_AMQP_INSECURE_PORT\n--hono.deviceConnection.amqp.insecurePort no - The insecure port the server should listen on for AMQP 1.0 connections.\nSee Port Configuration below for details.   HONO_DEVICE_CONNECTION_AMQP_INSECURE_PORT_BIND_ADDRESS\n--hono.deviceConnection.amqp.insecurePortBindAddress no 127.0.0.1 The IP address of the network interface that the insecure AMQP port should be bound to.\nSee Port Configuration below for details.   HONO_DEVICE_CONNECTION_AMQP_INSECURE_PORT_ENABLED\n--hono.deviceConnection.amqp.insecurePortEnabled no false If set to true the server will open an insecure port (not secured by TLS) using either the port number set via HONO_REGISTRY_AMQP_INSECURE_PORT or the default AMQP port number (5672) if not set explicitly.\nSee Port Configuration below for details.   HONO_DEVICE_CONNECTION_AMQP_KEY_PATH\n--hono.deviceConnection.amqp.keyPath no - The absolute path to the (PKCS8) PEM file containing the private key that the server should use for authenticating to clients. This option must be used in conjunction with HONO_DEVICE_CONNECTION_AMQP_CERT_PATH. Alternatively, the HONO_DEVICE_CONNECTION_AMQP_KEY_STORE_PATH option can be used to configure a key store containing both the key as well as the certificate.   HONO_DEVICE_CONNECTION_AMQP_KEY_STORE_PASSWORD\n--hono.deviceConnection.amqp.keyStorePassword no - The password required to read the contents of the key store.   HONO_DEVICE_CONNECTION_AMQP_KEY_STORE_PATH\n--hono.deviceConnection.amqp.keyStorePath no - The absolute path to the Java key store containing the private key and certificate that the server should use for authenticating to clients. Either this option or the HONO_DEVICE_CONNECTION_AMQP_KEY_PATH and HONO_DEVICE_CONNECTION_AMQP_CERT_PATH options need to be set in order to enable TLS secured connections with clients. The key store format can be either JKS or PKCS12 indicated by a .jks or .p12 file suffix respectively.   HONO_DEVICE_CONNECTION_AMQP_NATIVE_TLS_REQUIRED\n--hono.deviceConnection.amqp.nativeTlsRequired no false The server will probe for OpenSLL on startup if a secure port is configured. By default, the server will fall back to the JVM\u0026rsquo;s default SSL engine if not available. However, if set to true, the server will fail to start at all in this case.   HONO_DEVICE_CONNECTION_AMQP_PORT\n--hono.deviceConnection.amqp.port no 5671 The secure port that the server should listen on for AMQP 1.0 connections.\nSee Port Configuration below for details.   HONO_DEVICE_CONNECTION_AMQP_RECEIVER_LINK_CREDIT\n--hono.deviceConnection.amqp.receiverLinkCredit no 100 The number of credits to flow to a client connecting to the service\u0026rsquo;s AMQP endpoint.   HONO_DEVICE_CONNECTION_AMQP_SECURE_PROTOCOLS\n--hono.deviceConnection.amqp.secureProtocols no TLSv1.2 A (comma separated) list of secure protocols that are supported when negotiating TLS sessions. Please refer to the vert.x documentation for a list of supported protocol names.    The variables only need to be set if the default value does not match your environment.\nPort Configuration The Device Connection component supports configuration of both, an AMQP based endpoint as well as an HTTP based endpoint proving RESTful resources for managing registration information and credentials. Both endpoints can be configured to listen for connections on\n a secure port only (default) or an insecure port only or both a secure and an insecure port (dual port configuration)  The server will fail to start if none of the ports is configured properly.\nSecure Port Only The server needs to be configured with a private key and certificate in order to open a TLS secured port.\nThere are two alternative ways for doing so:\n Setting the HONO_DEVICE_CONNECTION_AMQP_KEY_STORE_PATH and the HONO_DEVICE_CONNECTION_AMQP_KEY_STORE_PASSWORD variables in order to load the key \u0026amp; certificate from a password protected key store, or setting the HONO_DEVICE_CONNECTION_AMQP_KEY_PATH and HONO_DEVICE_CONNECTION_AMQP_CERT_PATH variables in order to load the key and certificate from two separate PEM files in PKCS8 format.  When starting up, the server will bind a TLS secured socket to the default secure AMQP port 5671. The port number can also be set explicitly using the HONO_DEVICE_CONNECTION_AMQP_PORT variable.\nThe HONO_DEVICE_CONNECTION_AMQP_BIND_ADDRESS variable can be used to specify the network interface that the port should be exposed on. By default the port is bound to the loopback device only, i.e. the port will only be accessible from the local host. Setting this variable to 0.0.0.0 will let the port being bound to all network interfaces (be careful not to expose the port unintentionally to the outside world).\nInsecure Port Only The secure port will mostly be required for production scenarios. However, it might be desirable to expose a non-TLS secured port instead, e.g. for testing purposes. In any case, the non-secure port needs to be explicitly enabled either by\n explicitly setting HONO_DEVICE_CONNECTION_AMQP_INSECURE_PORT to a valid port number, or by implicitly configuring the default AMQP port (5672) by simply setting HONO_DEVICE_CONNECTION_AMQP_INSECURE_PORT_ENABLED to true.  The server issues a warning on the console if HONO_DEVICE_CONNECTION_AMQP_INSECURE_PORT is set to the default secure AMQP port (5671).\nThe HONO_DEVICE_CONNECTION_AMQP_INSECURE_PORT_BIND_ADDRESS variable can be used to specify the network interface that the port should be exposed on. By default the port is bound to the loopback device only, i.e. the port will only be accessible from the local host. This variable might be used to e.g. expose the non-TLS secured port on a local interface only, thus providing easy access from within the local network, while still requiring encrypted communication when accessed from the outside over public network infrastructure.\nSetting this variable to 0.0.0.0 will let the port being bound to all network interfaces (be careful not to expose the port unintentionally to the outside world).\nDual Port In test setups and some production scenarios Hono server may be configured to open one secure and one insecure port at the same time.\nThis is achieved by configuring both ports correctly (see above). The server will fail to start if both ports are configured to use the same port number.\nSince the secure port may need different visibility in the network setup compared to the secure port, it has it\u0026rsquo;s own binding address HONO_DEVICE_CONNECTION_AMQP_INSECURE_PORT_BIND_ADDRESS. This can be used to narrow the visibility of the insecure port to a local network e.g., while the secure port may be visible worldwide.\nEphemeral Ports The server may be configured to open both a secure and a non-secure port at the same time simply by configuring both ports as described above. For this to work, both ports must be configured to use different port numbers, otherwise startup will fail.\nData Grid Connection Configuration The Device Connection component requires a connection to a remote data grid using the Infinispan Hotrod protocol to store device connection information in.\nThe following table provides an overview of the configuration variables and corresponding command line options for configuring the connection to the data grid:\n   Environment Variable\nCommand Line Option Mandatory Default Description     HONO_DEVICE_CONNECTION_REMOTE_SERVER_LIST\n--hono.deviceConnection.remote.serverList yes - A list of remote servers in the form: host1[:port][;host2[:port]].....   HONO_DEVICE_CONNECTION_REMOTE_AUTH_SERVER_NAME\n--hono.deviceConnection.remote.authServerName yes - The server name to indicate in the SASL handshake when authenticating to the server.   HONO_DEVICE_CONNECTION_REMOTE_AUTH_USERNAME\n--hono.deviceConnection.remote.authUsername yes - The username to use for authenticating to the server.   HONO_DEVICE_CONNECTION_REMOTE_AUTH_PASSWORD\n--hono.deviceConnection.remote.authPassword yes - The password to use for authenticating to the server.    In general, the service supports all configuration properties of the Infinispan Hotrod client using hono.deviceConnection.remote instead of the infinispan.client.hotrod prefix.\nAuthentication Service Connection Configuration The Device Connection component requires a connection to an implementation of Hono\u0026rsquo;s Authentication API in order to authenticate and authorize client requests.\nThe connection is configured according to Hono Client Configuration where the ${PREFIX} is set to HONO_AUTH. Since Hono\u0026rsquo;s Authentication Service does not allow caching of the responses, the cache properties can be ignored.\nIn addition to the standard client configuration properties, following properties need to be set for the connection:\n   Environment Variable\nCommand Line Option Mandatory Default Description     HONO_AUTH_VALIDATION_CERT_PATH\n--hono.auth.validation.certPath no - The absolute path to the PEM file containing the public key that the service should use for validating tokens issued by the Authentication service. Alternatively, a symmetric key can be used for validating tokens by setting the HONO_AUTH_VALIDATION_SHARED_SECRET variable. If none of these variables is set, the service falls back to the key indicated by the HONO_AUTH_CERT_PATH variable. If that variable is also not set, startup of the service fails.   HONO_AUTH_VALIDATION_SHARED_SECRET\n--hono.auth.validation.sharedSecret no - A string to derive a symmetric key from which is used for validating tokens issued by the Authentication service. The key is derived from the string by using the bytes of the String\u0026rsquo;s UTF8 encoding. When setting the validation key using this variable, the Authentication service must be configured with the same key. Alternatively, an asymmetric key pair can be used for validating (and signing) by setting the HONO_AUTH_SIGNING_CERT_PATH variable. If none of these variables is set, startup of the service fails.    Metrics Configuration See Monitoring \u0026amp; Tracing Admin Guide for details on how to configure the reporting of metrics.\n"
},
{
	"uri": "https://www.eclipse.org/hono/docs/admin-guide/http-adapter-config/",
	"title": "HTTP Adapter Configuration",
	"tags": [],
	"description": "",
	"content": "The HTTP protocol adapter exposes a HTTP based API for Eclipse Hono\u0026trade;\u0026rsquo;s Telemetry and Event endpoints.\nThe adapter is implemented as a Spring Boot application. It can be run either directly from the command line or by means of starting the corresponding Docker image created from it.\nService Configuration In addition to the following options, this component supports the options described in Common Configuration.\nThe following table provides an overview of the configuration variables and corresponding command line options for configuring the HTTP adapter.\n   Environment Variable\nCommand Line Option Mandatory Default Description     HONO_APP_MAX_INSTANCES\n--hono.app.maxInstances no #CPU cores The number of verticle instances to deploy. If not set, one verticle per processor core is deployed.   HONO_HTTP_AUTHENTICATION_REQUIRED\n--hono.http.authenticationRequired no true If set to true the protocol adapter requires devices to authenticate when connecting to the adapter. The credentials provided by the device are verified using the configured Credentials Service. Devices that have failed to authenticate are not allowed to publish any data.   HONO_HTTP_BIND_ADDRESS\n--hono.http.bindAddress no 127.0.0.1 The IP address of the network interface that the secure port should be bound to.\nSee Port Configuration below for details.   HONO_HTTP_CERT_PATH\n--hono.http.certPath no - The absolute path to the PEM file containing the certificate that the protocol adapter should use for authenticating to clients. This option must be used in conjunction with HONO_HTTP_KEY_PATH.\nAlternatively, the HONO_HTTP_KEY_STORE_PATH option can be used to configure a key store containing both the key as well as the certificate.   HONO_HTTP_DEFAULTS_ENABLED\n--hono.http.defaultsEnabled no true If set to true the protocol adapter uses default values registered for a device to augment messages published by the device with missing information like a content type. In particular, the protocol adapter adds default values registered for the device as (application) properties with the same name to the AMQP 1.0 messages it sends downstream to the AMQP Messaging Network.   HONO_HTTP_INSECURE_PORT\n--hono.http.insecurePort no - The insecure port the protocol adapter should listen on.\nSee Port Configuration below for details.   HONO_HTTP_INSECURE_PORT_BIND_ADDRESS\n--hono.http.insecurePortBindAddress no 127.0.0.1 The IP address of the network interface that the insecure port should be bound to.\nSee Port Configuration below for details.   HONO_HTTP_INSECURE_PORT_ENABLED\n--hono.http.insecurePortEnabled no false If set to true the protocol adapter will open an insecure port (not secured by TLS) using either the port number set via HONO_HTTP_INSECURE_PORT or the default port number (8080) if not set explicitly.\nSee Port Configuration below for details.   HONO_HTTP_KEY_PATH\n--hono.http.keyPath no - The absolute path to the (PKCS8) PEM file containing the private key that the protocol adapter should use for authenticating to clients. This option must be used in conjunction with HONO_HTTP_CERT_PATH. Alternatively, the HONO_HTTP_KEY_STORE_PATH option can be used to configure a key store containing both the key as well as the certificate.   HONO_HTTP_KEY_STORE_PASSWORD\n--hono.http.keyStorePassword no - The password required to read the contents of the key store.   HONO_HTTP_KEY_STORE_PATH\n--hono.http.keyStorePath no - The absolute path to the Java key store containing the private key and certificate that the protocol adapter should use for authenticating to clients. Either this option or the HONO_HTTP_KEY_PATH and HONO_HTTP_CERT_PATH options need to be set in order to enable TLS secured connections with clients. The key store format can be either JKS or PKCS12 indicated by a .jks or .p12 file suffix respectively.   HONO_HTTP_NATIVE_TLS_REQUIRED\n--hono.http.nativeTlsRequired no false The server will probe for OpenSLL on startup if a secure port is configured. By default, the server will fall back to the JVM\u0026rsquo;s default SSL engine if not available. However, if set to true, the server will fail to start at all in this case.   HONO_HTTP_MAX_PAYLOAD_SIZE\n--hono.http.maxPayloadSize no 2048 The maximum allowed size of an incoming HTTP request\u0026rsquo;s body in bytes. Requests with a larger body size are rejected with a 413 Request entity too large response.   HONO_HTTP_PORT\n--hono.http.port no 8443 The secure port that the protocol adapter should listen on.\nSee Port Configuration below for details.   HONO_HTTP_REALM\n--hono.http.realm no Hono The name of the realm that unauthenticated devices are prompted to provide credentials for. The realm is used in the WWW-Authenticate header returned to devices in response to unauthenticated requests.   HONO_HTTP_SECURE_PROTOCOLS\n--hono.http.secureProtocols no TLSv1.2 A (comma separated) list of secure protocols that are supported when negotiating TLS sessions. Please refer to the vert.x documentation for a list of supported protocol names.    The variables only need to be set if the default value does not match your environment.\nPort Configuration The HTTP protocol adapter can be configured to listen for connections on\n a secure port only (default) or an insecure port only or both a secure and an insecure port (dual port configuration)  The HTTP protocol adapter will fail to start if none of the ports is configured properly.\nSecure Port Only The protocol adapter needs to be configured with a private key and certificate in order to open a TLS secured port.\nThere are two alternative ways for doing so:\n Setting the HONO_HTTP_KEY_STORE_PATH and the HONO_HTTP_KEY_STORE_PASSWORD variables in order to load the key \u0026amp; certificate from a password protected key store, or setting the HONO_HTTP_KEY_PATH and HONO_HTTP_CERT_PATH variables in order to load the key and certificate from two separate PEM files in PKCS8 format.  When starting up, the protocol adapter will bind a TLS secured socket to the default secure port 8443. The port number can also be set explicitly using the HONO_HTTP_PORT variable.\nThe HONO_HTTP_BIND_ADDRESS variable can be used to specify the network interface that the port should be exposed on. By default the port is bound to the loopback device only, i.e. the port will only be accessible from the local host. Setting this variable to 0.0.0.0 will let the port being bound to all network interfaces (be careful not to expose the port unintentionally to the outside world).\nInsecure Port Only The secure port will mostly be required for production scenarios. However, it might be desirable to expose a non-TLS secured port instead, e.g. for testing purposes. In any case, the non-secure port needs to be explicitly enabled either by\n explicitly setting HONO_HTTP_INSECURE_PORT to a valid port number, or by implicitly configuring the default port (8080) by simply setting HONO_HTTP_INSECURE_PORT_ENABLED to true.  The protocol adapter issues a warning on the console if HONO_HTTP_INSECURE_PORT is set to the default secure HTTP port (8443).\nThe HONO_HTTP_INSECURE_PORT_BIND_ADDRESS variable can be used to specify the network interface that the port should be exposed on. By default the port is bound to the loopback device only, i.e. the port will only be accessible from the local host. This variable might be used to e.g. expose the non-TLS secured port on a local interface only, thus providing easy access from within the local network, while still requiring encrypted communication when accessed from the outside over public network infrastructure.\nSetting this variable to 0.0.0.0 will let the port being bound to all network interfaces (be careful not to expose the port unintentionally to the outside world).\nDual Port The protocol adapter may be configured to open both a secure and a non-secure port at the same time simply by configuring both ports as described above. For this to work, both ports must be configured to use different port numbers, otherwise startup will fail.\nEphemeral Ports Both the secure as well as the insecure port numbers may be explicitly set to 0. The protocol adapter will then use arbitrary (unused) port numbers determined by the operating system during startup.\nAMQP 1.0 Messaging Network Connection Configuration The adapter requires a connection to the AMQP 1.0 Messaging Network in order to forward telemetry data and events received from devices to downstream consumers.\nThe connection to the messaging network is configured according to Hono Client Configuration with HONO_MESSAGING being used as ${PREFIX}. Since there are no responses being received, the properties for configuring response caching can be ignored.\nTenant Service Connection Configuration The adapter requires a connection to an implementation of Hono\u0026rsquo;s Tenant API in order to retrieve information for a tenant.\nThe connection to the Tenant Service is configured according to Hono Client Configuration where the ${PREFIX} is set to HONO_TENANT and the additional values for response caching apply.\nThe adapter caches the responses from the service according to the cache directive included in the response. If the response doesn\u0026rsquo;t contain a cache directive no data will be cached.\nDevice Registration Service Connection Configuration The adapter requires a connection to an implementation of Hono\u0026rsquo;s Device Registration API in order to retrieve registration status assertions for connected devices.\nThe connection to the Device Registration Service is configured according to Hono Client Configuration where the ${PREFIX} is set to HONO_REGISTRATION.\nThe adapter caches the responses from the service according to the cache directive included in the response. If the response doesn\u0026rsquo;t contain a cache directive no data will be cached.\nCredentials Service Connection Configuration The adapter requires a connection to an implementation of Hono\u0026rsquo;s Credentials API in order to retrieve credentials stored for devices that needs to be authenticated. During connection establishment, the adapter uses the Credentials API to retrieve the credentials on record for the device and matches that with the credentials provided by a device.\nThe connection to the Credentials Service is configured according to Hono Client Configuration where the ${PREFIX} is set to HONO_CREDENTIALS.\nThe adapter caches the responses from the service according to the cache directive included in the response. If the response doesn\u0026rsquo;t contain a cache directive no data will be cached.\nDevice Connection Service Connection Configuration The adapter requires a connection to an implementation of Hono\u0026rsquo;s Device Connection API in order to determine the gateway that a device is connected via to a protocol adapter. This information is required in order to forward commands issued by applications to the protocol adapter instance that the gateway is connected to.\nThe connection to the Device Connection service is configured according to Hono Client Configuration where the ${PREFIX} is set to HONO_DEVICE_CONNECTION.\nResponses from the Device Connection service are never cached, so the properties for configuring the cache are ignored.\nResource Limits Checker Configuration The adapter can use metrics collected by a Prometheus server to enforce certain limits set at the tenant level like the overall number of connected devices allowed per tenant.\nThe following table provides an overview of the configuration variables and corresponding command line options for configuring the checker.\n   Environment Variable\nCommand Line Option Mandatory Default Value Description     HONO_PLAN_PROMETHEUS_BASED_HOST\n--hono.plan.prometheusBased.host no none The host name or IP address of the Prometheus server to retrieve the metrics data from. This property needs to be set in order to enable the Prometheus based checks.   HONO_PLAN_PROMETHEUS_BASED_PORT\n--hono.plan.prometheusBased.port no 9090 The port of the Prometheus server to retrieve metrics data from.   HONO_PLAN_PROMETHEUS_BASED_CACHE_MIN_SIZE\n--hono.plan.prometheusBased.cacheMinSize no 20 The minimum size of the cache to store the metrics data retrieved from the Prometheus server. The cache is used for storing the current amount of data exchanged with devices of tenants.   HONO_PLAN_PROMETHEUS_BASED_CACHE_MAX_SIZE\n--hono.plan.prometheusBased.cacheMaxSize no 1000 The maximum size of the cache to store the metrics data retrieved from the Prometheus server.   HONO_PLAN_PROMETHEUS_BASED_CACHE_TIMEOUT\n--hono.plan.prometheusBased.cacheTimeout no 600 The number of seconds after which the cached metrics data should be considered invalid.    Metrics Configuration See Monitoring \u0026amp; Tracing Admin Guide for details on how to configure the reporting of metrics.\n"
},
{
	"uri": "https://www.eclipse.org/hono/docs/admin-guide/amqp-adapter-config/",
	"title": "AMQP Adapter Configuration",
	"tags": [],
	"description": "",
	"content": "The AMQP protocol adapter allows clients (devices and gateway components) that speaks AMQP 1.0 to publish telemetry messages and events to Eclipse Hono\u0026trade;\u0026rsquo;s Telemetry and Event endpoints.\nThe adapter is implemented as a Spring Boot application. It can be run either directly from the command line or by means of starting the corresponding Docker image created from it.\nService Configuration In addition to the following options, this component supports the options described in Common Configuration.\nThe following table provides an overview of the configuration variables and corresponding command line options for configuring the AMQP adapter.\n   Environment Variable\nCommand Line Option Mandatory Default Value Description     HONO_AMQP_AUTHENTICATION_REQUIRED\n--hono.amqp.authenticationRequired no true If set to true the protocol adapter requires devices to authenticate when connecting to the adapter. The credentials provided by the device are verified using the configured Credentials Service. Devices that have failed to authenticate are not allowed to publish any data.   HONO_AMQP_BIND_ADDRESS\n--hono.amqp.bindAddress no 127.0.0.1 The IP address of the network interface that the secure port should be bound to.\nSee Port Configuration below for details.   HONO_AMQP_CERT_PATH\n--hono.amqp.certPath no - The absolute path to the PEM file containing the certificate that the protocol adapter should use for authenticating to clients. This option must be used in conjunction with HONO_AMQP_KEY_PATH.\nAlternatively, the HONO_AMQP_KEY_STORE_PATH option can be used to configure a key store containing both the key as well as the certificate.   HONO_AMQP_DEFAULTS_ENABLED\n--hono.amqp.defaultsEnabled no true If set to true the protocol adapter uses default values registered for a device to augment messages published by the device with missing information like a content type. In particular, the protocol adapter adds default values registered for the device as (application) properties with the same name to the AMQP 1.0 messages it sends downstream to the AMQP Messaging Network.   HONO_AMQP_INSECURE_PORT_BIND_ADDRESS\n--hono.amqp.insecurePortBindAddress no 127.0.0.1 The IP address of the network interface that the insecure port should be bound to.\nSee Port Configuration below for details.   HONO_AMQP_INSECURE_PORT\n--hono.amqp.insecurePort no 4040 The port number that the protocol adapter should listen on for insecure connections.\nSee Port Configuration below for details.   HONO_AMQP_INSECURE_PORT_ENABLED\n--hono.amqp.insecurePortEnabled no false If set to true the protocol adapter will open an insecure port (not secured by TLS) using either the port number set via HONO_AMQP_INSECURE_PORT or the default AMQP port number (1883) if not set explicitly.\nSee Port Configuration below for details.   HONO_AMQP_KEY_PATH\n--hono.amqp.keyPath no - The absolute path to the (PKCS8) PEM file containing the private key that the protocol adapter should use for authenticating to clients. This option must be used in conjunction with HONO_AMQP_CERT_PATH. Alternatively, the HONO_AMQP_KEY_STORE_PATH option can be used to configure a key store containing both the key as well as the certificate.   HONO_AMQP_KEY_STORE_PASSWORD\n--hono.amqp.keyStorePassword no - The password required to read the contents of the key store.   HONO_AMQP_KEY_STORE_PATH\n--hono.amqp.keyStorePath no - The absolute path to the Java key store containing the private key and certificate that the protocol adapter should use for authenticating to clients. Either this option or the HONO_AMQP_KEY_PATH and HONO_AMQP_CERT_PATH options need to be set in order to enable TLS secured connections with clients. The key store format can be either JKS or PKCS12 indicated by a .jks or .p12 file suffix respectively.   HONO_AMQP_MAX_CONNECTIONS\n--hono.amqp.maxConnections no 0 The maximum number of concurrent connections that the protocol adapter should accept. If not set (or set to 0), the protocol adapter determines a reasonable value based on the available resources like memory and CPU.   HONO_AMQP_MAX_FRAME_SIZE\n--hono.amqp.maxFrameSize no 16384 The maximum number of bytes that can be sent in an AMQP message delivery over the connection with a device. When a client sends an AMQP frame of larger size, the connection is closed.   HONO_AMQP_MAX_PAYLOAD_SIZE\n--hono.amqp.maxPayloadSize no 2048 The maximum allowed size of an incoming AMQP message in bytes. When a client sends a message with a larger payload, the message is discarded and the link to the client is closed.   HONO_AMQP_MAX_SESSION_FRAMES\n--hono.amqp.maxSessionFrames no 30 The maximum number of AMQP transfer frames for sessions created on this connection. This is the number of transfer frames that may simultaneously be in flight for all links in the session.   HONO_AMQP_NATIVE_TLS_REQUIRED\n--hono.amqp.nativeTlsRequired no false The server will probe for OpenSSL on startup if a secure port is configured. By default, the server will fall back to the JVM\u0026rsquo;s default SSL engine if not available. However, if set to true, the server will fail to start at all in this case.   HONO_AMQP_PORT\n--hono.amqp.port no 4041 The secure port that the protocol adapter should listen on.\nSee Port Configuration below for details.   HONO_AMQP_SECURE_PROTOCOLS\n--hono.amqp.secureProtocols no TLSv1.2 A (comma separated) list of secure protocols that are supported when negotiating TLS sessions. Please refer to the vert.x documentation for a list of supported protocol names.   HONO_APP_MAX_INSTANCES\n--hono.app.maxInstances no #CPU cores The number of verticle instances to deploy. If not set, one verticle per processor core is deployed.    The variables only need to be set if the default values do not match your environment.\nPort Configuration The AMQP protocol adapter can be configured to listen for connections on\n a secure port only (default) or an insecure port only or both a secure and an insecure port (dual port configuration)  The AMQP protocol adapter will fail to start if none of the ports is configured properly.\nSecure Port Only The protocol adapter needs to be configured with a private key and certificate in order to open a TLS secured port.\nThere are two alternative ways for doing so:\n either setting the HONO_AMQP_KEY_STORE_PATH and the HONO_AMQP_KEY_STORE_PASSWORD variables in order to load the key \u0026amp; certificate from a password protected key store, or setting the HONO_AMQP_KEY_PATH and HONO_AMQP_CERT_PATH variables in order to load the key and certificate from two separate PEM files in PKCS8 format.  When starting up, the protocol adapter will bind a TLS secured socket to the default secure port 4041. The port number can also be set explicitly using the HONO_AMQP_PORT variable.\nThe HONO_AMQP_BIND_ADDRESS variable can be used to specify the network interface that the port should be exposed on. By default the port is bound to the loopback device only, i.e. the port will only be accessible from the local host. Setting this variable to 0.0.0.0 will let the port being bound to all network interfaces (be careful not to expose the port unintentionally to the outside world).\nInsecure Port Only The secure port will mostly be required for production scenarios. However, it might be desirable to expose a non-TLS secured port instead, e.g. for testing purposes. In any case, the non-secure port needs to be explicitly enabled either by\n explicitly setting HONO_AMQP_INSECURE_PORT to a valid port number, or by implicitly configuring the default adapter port (4040) by simply setting HONO_AMQP_INSECURE_PORT_ENABLED to true.  The protocol adapter issues a warning on the console if HONO_AMQP_INSECURE_PORT is set to the default secure port (4041) used by the adapter for secure connections.\nThe HONO_AMQP_INSECURE_PORT_BIND_ADDRESS variable can be used to specify the network interface that the port should be exposed on. By default the port is bound to the loopback device only, i.e. the port will only be accessible from the local host. This variable might be used to e.g. expose the non-TLS secured port on a local interface only, thus providing easy access from within the local network, while still requiring encrypted communication when accessed from the outside over public network infrastructure.\nSetting this variable to 0.0.0.0 will let the port being bound to all network interfaces (be careful not to expose the port unintentionally to the outside world).\nDual Port The protocol adapter may be configured to open both a secure and a non-secure port at the same time simply by configuring both ports as described above. For this to work, both ports must be configured to use different port numbers, otherwise startup will fail.\nEphemeral Ports Both the secure as well as the insecure port numbers may be explicitly set to 0. The protocol adapter will then use arbitrary (unused) port numbers determined by the operating system during startup.\nAMQP 1.0 Messaging Network Connection Configuration The adapter requires a connection to the AMQP 1.0 Messaging Network in order to forward telemetry data and events received from devices to downstream consumers.\nThe connection to the messaging network is configured according to Hono Client Configuration with HONO_MESSAGING being used as ${PREFIX}. Since there are no responses being received, the properties for configuring response caching can be ignored.\nTenant Service Connection Configuration The adapter requires a connection to an implementation of Hono\u0026rsquo;s Tenant API in order to retrieve information for a tenant.\nThe connection to the Tenant Service is configured according to Hono Client Configuration where the ${PREFIX} is set to HONO_TENANT and the additional values for response caching apply.\nThe adapter caches the responses from the service according to the cache directive included in the response. If the response doesn\u0026rsquo;t contain a cache directive no data will be cached.\nDevice Registration Service Connection Configuration The adapter requires a connection to an implementation of Hono\u0026rsquo;s Device Registration API in order to retrieve registration status assertions for connected devices.\nThe connection to the Device Registration Service is configured according to Hono Client Configuration where the ${PREFIX} is set to HONO_REGISTRATION.\nThe adapter caches the responses from the service according to the cache directive included in the response. If the response doesn\u0026rsquo;t contain a cache directive no data will be cached.\nCredentials Service Connection Configuration The adapter requires a connection to an implementation of Hono\u0026rsquo;s Credentials API in order to retrieve credentials stored for devices that needs to be authenticated. During connection establishment, the adapter uses the Credentials API to retrieve the credentials on record for the device and matches that with the credentials provided by a device.\nThe connection to the Credentials Service is configured according to Hono Client Configuration where the ${PREFIX} is set to HONO_CREDENTIALS.\nThe adapter caches the responses from the service according to the cache directive included in the response. If the response doesn\u0026rsquo;t contain a cache directive no data will be cached.\nDevice Connection Service Connection Configuration The adapter requires a connection to an implementation of Hono\u0026rsquo;s Device Connection API in order to determine the gateway that a device is connected via to a protocol adapter. This information is required in order to forward commands issued by applications to the protocol adapter instance that the gateway is connected to.\nThe connection to the Device Connection service is configured according to Hono Client Configuration where the ${PREFIX} is set to HONO_DEVICE_CONNECTION.\nResponses from the Device Connection service are never cached, so the properties for configuring the cache are ignored.\nResource Limits Checker Configuration The adapter can use metrics collected by a Prometheus server to enforce certain limits set at the tenant level like the overall number of connected devices allowed per tenant.\nThe following table provides an overview of the configuration variables and corresponding command line options for configuring the checker.\n   Environment Variable\nCommand Line Option Mandatory Default Value Description     HONO_PLAN_PROMETHEUS_BASED_HOST\n--hono.plan.prometheusBased.host no none The host name or IP address of the Prometheus server to retrieve the metrics data from. This property needs to be set in order to enable the Prometheus based checks.   HONO_PLAN_PROMETHEUS_BASED_PORT\n--hono.plan.prometheusBased.port no 9090 The port of the Prometheus server to retrieve metrics data from.   HONO_PLAN_PROMETHEUS_BASED_CACHE_MIN_SIZE\n--hono.plan.prometheusBased.cacheMinSize no 20 The minimum size of the cache to store the metrics data retrieved from the Prometheus server. The cache is used for storing the current amount of data exchanged with devices of tenants.   HONO_PLAN_PROMETHEUS_BASED_CACHE_MAX_SIZE\n--hono.plan.prometheusBased.cacheMaxSize no 1000 The maximum size of the cache to store the metrics data retrieved from the Prometheus server.   HONO_PLAN_PROMETHEUS_BASED_CACHE_TIMEOUT\n--hono.plan.prometheusBased.cacheTimeout no 600 The number of seconds after which the cached metrics data should be considered invalid.    Metrics Configuration See Monitoring \u0026amp; Tracing Admin Guide for details on how to configure the reporting of metrics.\n"
},
{
	"uri": "https://www.eclipse.org/hono/docs/admin-guide/mqtt-adapter-config/",
	"title": "MQTT Adapter Configuration",
	"tags": [],
	"description": "",
	"content": "The MQTT protocol adapter exposes an MQTT topic hierarchy for publishing messages and events to Eclipse Hono\u0026trade;\u0026rsquo;s Telemetry and Event endpoints.\nThe adapter is implemented as a Spring Boot application. It can be run either directly from the command line or by means of starting the corresponding Docker image created from it.\nService Configuration In addition to the following options, this component supports the options described in Common Configuration.\nThe following table provides an overview of the configuration variables and corresponding command line options for configuring the MQTT adapter.\n   Environment Variable\nCommand Line Option Mandatory Default Value Description     HONO_APP_MAX_INSTANCES\n--hono.app.maxInstances no #CPU cores The number of verticle instances to deploy. If not set, one verticle per processor core is deployed.   HONO_CONNECTION_EVENTS_PRODUCER\n--hono.connectionEvents.producer no logging The implementation of connection events producer which is to be used. This may be logging or events.\nSee Connection Events   HONO_MQTT_AUTHENTICATION_REQUIRED\n--hono.mqtt.authenticationRequired no true If set to true the protocol adapter requires devices to authenticate when connecting to the adapter. The credentials provided by the device are verified using the configured Credentials Service. Devices that have failed to authenticate are not allowed to publish any data.   HONO_MQTT_BIND_ADDRESS\n--hono.mqtt.bindAddress no 127.0.0.1 The IP address of the network interface that the secure port should be bound to.\nSee Port Configuration below for details.   HONO_MQTT_CERT_PATH\n--hono.mqtt.certPath no - The absolute path to the PEM file containing the certificate that the protocol adapter should use for authenticating to clients. This option must be used in conjunction with HONO_MQTT_KEY_PATH.\nAlternatively, the HONO_MQTT_KEY_STORE_PATH option can be used to configure a key store containing both the key as well as the certificate.   HONO_MQTT_COMMAND_ACK_TIMEOUT\n--hono.mqtt.commandAckTimeout no 100 The amount of time (milliseconds) after which the sending of a command to a device using QoS 1 is considered to be failed. The value of this variable should be increased in cases where devices are connected over a network with high latency.   HONO_MQTT_DEFAULTS_ENABLED\n--hono.mqtt.defaultsEnabled no true If set to true the protocol adapter uses default values registered for a device to augment messages published by the device with missing information like a content type. In particular, the protocol adapter adds default values registered for the device as (application) properties with the same name to the AMQP 1.0 messages it sends downstream to the AMQP Messaging Network.   HONO_MQTT_INSECURE_PORT_BIND_ADDRESS\n--hono.mqtt.insecurePortBindAddress no 127.0.0.1 The IP address of the network interface that the insecure port should be bound to.\nSee Port Configuration below for details.   HONO_MQTT_INSECURE_PORT_ENABLED\n--hono.mqtt.insecurePortEnabled no false If set to true the protocol adapter will open an insecure port (not secured by TLS) using either the port number set via HONO_MQTT_INSECURE_PORT or the default MQTT port number (1883) if not set explicitly.\nSee Port Configuration below for details.   HONO_MQTT_KEY_PATH\n--hono.mqtt.keyPath no - The absolute path to the (PKCS8) PEM file containing the private key that the protocol adapter should use for authenticating to clients. This option must be used in conjunction with HONO_MQTT_CERT_PATH. Alternatively, the HONO_MQTT_KEY_STORE_PATH option can be used to configure a key store containing both the key as well as the certificate.   HONO_MQTT_KEY_STORE_PASSWORD\n--hono.mqtt.keyStorePassword no - The password required to read the contents of the key store.   HONO_MQTT_KEY_STORE_PATH\n--hono.mqtt.keyStorePath no - The absolute path to the Java key store containing the private key and certificate that the protocol adapter should use for authenticating to clients. Either this option or the HONO_MQTT_KEY_PATH and HONO_MQTT_CERT_PATH options need to be set in order to enable TLS secured connections with clients. The key store format can be either JKS or PKCS12 indicated by a .jks or .p12 file suffix respectively.   HONO_MQTT_MAX_CONNECTIONS\n--hono.mqtt.maxConnections no 0 The maximum number of concurrent connections that the protocol adapter should accept. If not set (or set to 0), the protocol adapter determines a reasonable value based on the available resources like memory and CPU.   HONO_MQTT_MAX_PAYLOAD_SIZE\n--hono.mqtt.maxPayloadSize no 2048 The maximum allowed size of an incoming MQTT message\u0026rsquo;s payload in bytes. When a client sends a message with a larger payload, the message is discarded and the connection to the client gets closed.   HONO_MQTT_NATIVE_TLS_REQUIRED\n--hono.mqtt.nativeTlsRequired no false The server will probe for OpenSLL on startup if a secure port is configured. By default, the server will fall back to the JVM\u0026rsquo;s default SSL engine if not available. However, if set to true, the server will fail to start at all in this case.   HONO_MQTT_PORT\n--hono.mqtt.port no 8883 The secure port that the protocol adapter should listen on.\nSee Port Configuration below for details.   HONO_MQTT_SECURE_PROTOCOLS\n--hono.mqtt.secureProtocols no TLSv1.2 A (comma separated) list of secure protocols that are supported when negotiating TLS sessions. Please refer to the vert.x documentation for a list of supported protocol names.    The variables only need to be set if the default values do not match your environment.\nPort Configuration The MQTT protocol adapter can be configured to listen for connections on\n a secure port only (default) or an insecure port only or both a secure and an insecure port (dual port configuration)  The MQTT protocol adapter will fail to start if none of the ports is configured properly.\nSecure Port Only The protocol adapter needs to be configured with a private key and certificate in order to open a TLS secured port.\nThere are two alternative ways for doing so:\n either setting the HONO_MQTT_KEY_STORE_PATH and the HONO_MQTT_KEY_STORE_PASSWORD variables in order to load the key \u0026amp; certificate from a password protected key store, or setting the HONO_MQTT_KEY_PATH and HONO_MQTT_CERT_PATH variables in order to load the key and certificate from two separate PEM files in PKCS8 format.  When starting up, the protocol adapter will bind a TLS secured socket to the default secure MQTT port 8883. The port number can also be set explicitly using the HONO_MQTT_PORT variable.\nThe HONO_MQTT_BIND_ADDRESS variable can be used to specify the network interface that the port should be exposed on. By default the port is bound to the loopback device only, i.e. the port will only be accessible from the local host. Setting this variable to 0.0.0.0 will let the port being bound to all network interfaces (be careful not to expose the port unintentionally to the outside world).\nInsecure Port Only The secure port will mostly be required for production scenarios. However, it might be desirable to expose a non-TLS secured port instead, e.g. for testing purposes. In any case, the non-secure port needs to be explicitly enabled either by\n explicitly setting HONO_MQTT_INSECURE_PORT to a valid port number, or by implicitly configuring the default MQTT port (1883) by simply setting HONO_MQTT_INSECURE_PORT_ENABLED to true.  The protocol adapter issues a warning on the console if HONO_MQTT_INSECURE_PORT is set to the default secure MQTT port (8883).\nThe HONO_MQTT_INSECURE_PORT_BIND_ADDRESS variable can be used to specify the network interface that the port should be exposed on. By default the port is bound to the loopback device only, i.e. the port will only be accessible from the local host. This variable might be used to e.g. expose the non-TLS secured port on a local interface only, thus providing easy access from within the local network, while still requiring encrypted communication when accessed from the outside over public network infrastructure.\nSetting this variable to 0.0.0.0 will let the port being bound to all network interfaces (be careful not to expose the port unintentionally to the outside world).\nDual Port The protocol adapter may be configured to open both a secure and a non-secure port at the same time simply by configuring both ports as described above. For this to work, both ports must be configured to use different port numbers, otherwise startup will fail.\nEphemeral Ports Both the secure as well as the insecure port numbers may be explicitly set to 0. The protocol adapter will then use arbitrary (unused) port numbers determined by the operating system during startup.\nAMQP 1.0 Messaging Network Connection Configuration The adapter requires a connection to the AMQP 1.0 Messaging Network in order to forward telemetry data and events received from devices to downstream consumers.\nThe connection to the messaging network is configured according to Hono Client Configuration with HONO_MESSAGING being used as ${PREFIX}. Since there are no responses being received, the properties for configuring response caching can be ignored.\nTenant Service Connection Configuration The adapter requires a connection to an implementation of Hono\u0026rsquo;s Tenant API in order to retrieve information for a tenant.\nThe connection to the Tenant Service is configured according to Hono Client Configuration where the ${PREFIX} is set to HONO_TENANT and the additional values for response caching apply.\nThe adapter caches the responses from the service according to the cache directive included in the response. If the response doesn\u0026rsquo;t contain a cache directive no data will be cached.\nDevice Registration Service Connection Configuration The adapter requires a connection to an implementation of Hono\u0026rsquo;s Device Registration API in order to retrieve registration status assertions for connected devices.\nThe connection to the Device Registration Service is configured according to Hono Client Configuration where the ${PREFIX} is set to HONO_REGISTRATION.\nThe adapter caches the responses from the service according to the cache directive included in the response. If the response doesn\u0026rsquo;t contain a cache directive no data will be cached.\nCredentials Service Connection Configuration The adapter requires a connection to an implementation of Hono\u0026rsquo;s Credentials API in order to retrieve credentials stored for devices that needs to be authenticated. During connection establishment, the adapter uses the Credentials API to retrieve the credentials on record for the device and matches that with the credentials provided by a device.\nThe connection to the Credentials Service is configured according to Hono Client Configuration where the ${PREFIX} is set to HONO_CREDENTIALS.\nThe adapter caches the responses from the service according to the cache directive included in the response. If the response doesn\u0026rsquo;t contain a cache directive no data will be cached.\nDevice Connection Service Connection Configuration The adapter requires a connection to an implementation of Hono\u0026rsquo;s Device Connection API in order to determine the gateway that a device is connected via to a protocol adapter. This information is required in order to forward commands issued by applications to the protocol adapter instance that the gateway is connected to.\nThe connection to the Device Connection service is configured according to Hono Client Configuration where the ${PREFIX} is set to HONO_DEVICE_CONNECTION.\nResponses from the Device Connection service are never cached, so the properties for configuring the cache are ignored.\nResource Limits Checker Configuration The adapter can use metrics collected by a Prometheus server to enforce certain limits set at the tenant level like the overall number of connected devices allowed per tenant.\nThe following table provides an overview of the configuration variables and corresponding command line options for configuring the checker.\n   Environment Variable\nCommand Line Option Mandatory Default Value Description     HONO_PLAN_PROMETHEUS_BASED_HOST\n--hono.plan.prometheusBased.host no none The host name or IP address of the Prometheus server to retrieve the metrics data from. This property needs to be set in order to enable the Prometheus based checks.   HONO_PLAN_PROMETHEUS_BASED_PORT\n--hono.plan.prometheusBased.port no 9090 The port of the Prometheus server to retrieve metrics data from.   HONO_PLAN_PROMETHEUS_BASED_CACHE_MIN_SIZE\n--hono.plan.prometheusBased.cacheMinSize no 20 The minimum size of the cache to store the metrics data retrieved from the Prometheus server. The cache is used for storing the current amount of data exchanged with devices of tenants.   HONO_PLAN_PROMETHEUS_BASED_CACHE_MAX_SIZE\n--hono.plan.prometheusBased.cacheMaxSize no 1000 The maximum size of the cache to store the metrics data retrieved from the Prometheus server.   HONO_PLAN_PROMETHEUS_BASED_CACHE_TIMEOUT\n--hono.plan.prometheusBased.cacheTimeout no 600 The number of seconds after which the cached metrics data should be considered invalid.    Metrics Configuration See Monitoring \u0026amp; Tracing Admin Guide for details on how to configure the reporting of metrics.\n"
},
{
	"uri": "https://www.eclipse.org/hono/docs/admin-guide/kura-adapter-config/",
	"title": "Kura Adapter Configuration",
	"tags": [],
	"description": "",
	"content": "The Kura protocol adapter exposes an MQTT topic hierarchy allowing Eclipse Kura\u0026trade; based gateways to publish control and data messages to Eclipse Hono\u0026trade;\u0026rsquo;s Telemetry and Event endpoints.\nThe adapter is implemented as a Spring Boot application. It can be run either directly from the command line or by means of starting the corresponding Docker image created from it.\nService Configuration In addition to the following options, this component supports the options described in Common Configuration.\nThe following table provides an overview of the configuration variables and corresponding command line options for configuring the MQTT adapter.\n   Environment Variable\nCommand Line Option Mandatory Default Value Description     HONO_APP_MAX_INSTANCES\n--hono.app.maxInstances no #CPU cores The number of verticle instances to deploy. If not set, one verticle per processor core is deployed.   HONO_KURA_AUTHENTICATION_REQUIRED\n--hono.kura.authenticationRequired no true If set to true the protocol adapter requires devices to authenticate when connecting to the adapter. The credentials provided by the device are verified using the configured Credentials Service. Devices that have failed to authenticate are not allowed to publish any data.   HONO_KURA_BIND_ADDRESS\n--hono.kura.bindAddress no 127.0.0.1 The IP address of the network interface that the secure port should be bound to.\nSee Port Configuration below for details.   HONO_KURA_CERT_PATH\n--hono.kura.certPath no - The absolute path to the PEM file containing the certificate that the protocol adapter should use for authenticating to clients. This option must be used in conjunction with HONO_KURA_KEY_PATH.\nAlternatively, the HONO_KURA_KEY_STORE_PATH option can be used to configure a key store containing both the key as well as the certificate.   HONO_KURA_CONTROL_PREFIX\n--hono.kura.controlPrefix no $EDC The topic.control-prefix to use for determining if a message published by a Kura gateway is a control message. All messages published to a topic that does not start with this prefix are considered data messages.   HONO_KURA_CTRL_MSG_CONTENT_TYPE\n--hono.kura.ctrlMsgContentType no application/vnd.eclipse.kura-control The content type to set on AMQP messages created from Kura control messages.   HONO_KURA_DATA_MSG_CONTENT_TYPE\n--hono.kura.dataMsgContentType no application/vnd.eclipse.kura-data The content type to set on AMQP messages created from Kura data messages.   HONO_KURA_DEFAULTS_ENABLED\n--hono.kura.defaultsEnabled no true If set to true the protocol adapter uses default values registered for a device to augment messages published by the device with missing information like a content type. In particular, the protocol adapter adds default values registered for the device as (application) properties with the same name to the AMQP 1.0 messages it sends downstream to the AMQP Messaging Network.   HONO_KURA_INSECURE_PORT\n--hono.kura.insecurePort no - The insecure port the protocol adapter should listen on.\nSee Port Configuration below for details.   HONO_KURA_INSECURE_PORT_BIND_ADDRESS\n--hono.kura.insecurePortBindAddress no 127.0.0.1 The IP address of the network interface that the insecure port should be bound to.\nSee Port Configuration below for details.   HONO_KURA_INSECURE_PORT_ENABLED\n--hono.kura.insecurePortEnabled no false If set to true the protocol adapter will open an insecure port (not secured by TLS) using either the port number set via HONO_KURA_INSECURE_PORT or the default MQTT port number (1883) if not set explicitly.\nSee Port Configuration below for details.   HONO_KURA_KEY_PATH\n--hono.kura.keyPath no - The absolute path to the (PKCS8) PEM file containing the private key that the protocol adapter should use for authenticating to clients. This option must be used in conjunction with HONO_KURA_CERT_PATH. Alternatively, the HONO_KURA_KEY_STORE_PATH option can be used to configure a key store containing both the key as well as the certificate.   HONO_KURA_KEY_STORE_PASSWORD\n--hono.kura.keyStorePassword no - The password required to read the contents of the key store.   HONO_KURA_KEY_STORE_PATH\n--hono.kura.keyStorePath no - The absolute path to the Java key store containing the private key and certificate that the protocol adapter should use for authenticating to clients. Either this option or the HONO_KURA_KEY_PATH and HONO_KURA_CERT_PATH options need to be set in order to enable TLS secured connections with clients. The key store format can be either JKS or PKCS12 indicated by a .jks or .p12 file suffix respectively.   HONO_KURA_MAX_PAYLOAD_SIZE\n--hono.kura.maxPayloadSize no 2048 The maximum allowed size of an incoming MQTT message\u0026rsquo;s payload in bytes. When a client sends a message with a larger payload, the message is discarded and the connection to the client gets closed.   HONO_KURA_NATIVE_TLS_REQUIRED\n--hono.kura.nativeTlsRequired no false The server will probe for OpenSLL on startup if a secure port is configured. By default, the server will fall back to the JVM\u0026rsquo;s default SSL engine if not available. However, if set to true, the server will fail to start at all in this case.   HONO_KURA_PORT\n--hono.kura.port no 8883 The secure port that the protocol adapter should listen on.\nSee Port Configuration below for details.   HONO_KURA_SECURE_PROTOCOLS\n--hono.kura.secureProtocols no TLSv1.2 A (comma separated) list of secure protocols that are supported when negotiating TLS sessions. Please refer to the vert.x documentation for a list of supported protocol names.    The variables only need to be set if the default values do not match your environment.\nPort Configuration The Kura protocol adapter can be configured to listen for connections on\n a secure port only (default) or an insecure port only or both a secure and an insecure port (dual port configuration)  The Kura protocol adapter will fail to start if none of the ports is configured properly.\nSecure Port Only The protocol adapter needs to be configured with a private key and certificate in order to open a TLS secured port.\nThere are two alternative ways for doing so:\n either setting the HONO_KURA_KEY_STORE_PATH and the HONO_KURA_KEY_STORE_PASSWORD variables in order to load the key \u0026amp; certificate from a password protected key store, or setting the HONO_KURA_KEY_PATH and HONO_KURA_CERT_PATH variables in order to load the key and certificate from two separate PEM files in PKCS8 format.  When starting up, the protocol adapter will bind a TLS secured socket to the default secure MQTT port 8883. The port number can also be set explicitly using the HONO_KURA_PORT variable.\nThe HONO_KURA_BIND_ADDRESS variable can be used to specify the network interface that the port should be exposed on. By default the port is bound to the loopback device only, i.e. the port will only be accessible from the local host. Setting this variable to 0.0.0.0 will let the port being bound to all network interfaces (be careful not to expose the port unintentionally to the outside world).\nInsecure Port Only The secure port will mostly be required for production scenarios. However, it might be desirable to expose a non-TLS secured port instead, e.g. for testing purposes. In any case, the non-secure port needs to be explicitly enabled either by\n explicitly setting HONO_KURA_INSECURE_PORT to a valid port number, or by implicitly configuring the default MQTT port (1883) by simply setting HONO_KURA_INSECURE_PORT_ENABLED to true.  The protocol adapter issues a warning on the console if HONO_KURA_INSECURE_PORT is set to the default secure MQTT port (8883).\nThe HONO_KURA_INSECURE_PORT_BIND_ADDRESS variable can be used to specify the network interface that the port should be exposed on. By default the port is bound to the loopback device only, i.e. the port will only be accessible from the local host. This variable might be used to e.g. expose the non-TLS secured port on a local interface only, thus providing easy access from within the local network, while still requiring encrypted communication when accessed from the outside over public network infrastructure.\nSetting this variable to 0.0.0.0 will let the port being bound to all network interfaces (be careful not to expose the port unintentionally to the outside world).\nDual Port The protocol adapter may be configured to open both a secure and a non-secure port at the same time simply by configuring both ports as described above. For this to work, both ports must be configured to use different port numbers, otherwise startup will fail.\nEphemeral Ports Both the secure as well as the insecure port numbers may be explicitly set to 0. The protocol adapter will then use arbitrary (unused) port numbers determined by the operating system during startup.\nAMQP 1.0 Messaging Network Connection Configuration The adapter requires a connection to the AMQP 1.0 Messaging Network in order to forward telemetry data and events received from devices to downstream consumers.\nThe connection to the messaging network is configured according to Hono Client Configuration with HONO_MESSAGING being used as ${PREFIX}. Since there are no responses being received, the properties for configuring response caching can be ignored.\nTenant Service Connection Configuration The adapter requires a connection to an implementation of Hono\u0026rsquo;s Tenant API in order to retrieve information for a tenant.\nThe connection to the Tenant Service is configured according to Hono Client Configuration where the ${PREFIX} is set to HONO_TENANT and the additional values for response caching apply.\nThe adapter caches the responses from the service according to the cache directive included in the response. If the response doesn\u0026rsquo;t contain a cache directive no data will be cached.\nDevice Registration Service Connection Configuration The adapter requires a connection to an implementation of Hono\u0026rsquo;s Device Registration API in order to retrieve registration status assertions for connected devices.\nThe connection to the Device Registration Service is configured according to Hono Client Configuration where the ${PREFIX} is set to HONO_REGISTRATION.\nThe adapter caches the responses from the service according to the cache directive included in the response. If the response doesn\u0026rsquo;t contain a cache directive no data will be cached.\nCredentials Service Connection Configuration The adapter requires a connection to an implementation of Hono\u0026rsquo;s Credentials API in order to retrieve credentials stored for devices that needs to be authenticated. During connection establishment, the adapter uses the Credentials API to retrieve the credentials on record for the device and matches that with the credentials provided by a device.\nThe connection to the Credentials Service is configured according to Hono Client Configuration where the ${PREFIX} is set to HONO_CREDENTIALS.\nThe adapter caches the responses from the service according to the cache directive included in the response. If the response doesn\u0026rsquo;t contain a cache directive no data will be cached.\nDevice Connection Service Connection Configuration The adapter requires a connection to an implementation of Hono\u0026rsquo;s Device Connection API in order to determine the gateway that a device is connected via to a protocol adapter. This information is required in order to forward commands issued by applications to the protocol adapter instance that the gateway is connected to.\nThe connection to the Device Connection service is configured according to Hono Client Configuration where the ${PREFIX} is set to HONO_DEVICE_CONNECTION.\nResponses from the Device Connection service are never cached, so the properties for configuring the cache are ignored.\nResource Limits Checker Configuration The adapter can use metrics collected by a Prometheus server to enforce certain limits set at the tenant level like the overall number of connected devices allowed per tenant.\nThe following table provides an overview of the configuration variables and corresponding command line options for configuring the checker.\n   Environment Variable\nCommand Line Option Mandatory Default Value Description     HONO_PLAN_PROMETHEUS_BASED_HOST\n--hono.plan.prometheusBased.host no none The host name or IP address of the Prometheus server to retrieve the metrics data from. This property needs to be set in order to enable the Prometheus based checks.   HONO_PLAN_PROMETHEUS_BASED_PORT\n--hono.plan.prometheusBased.port no 9090 The port of the Prometheus server to retrieve metrics data from.   HONO_PLAN_PROMETHEUS_BASED_CACHE_MIN_SIZE\n--hono.plan.prometheusBased.cacheMinSize no 20 The minimum size of the cache to store the metrics data retrieved from the Prometheus server. The cache is used for storing the current amount of data exchanged with devices of tenants.   HONO_PLAN_PROMETHEUS_BASED_CACHE_MAX_SIZE\n--hono.plan.prometheusBased.cacheMaxSize no 1000 The maximum size of the cache to store the metrics data retrieved from the Prometheus server.   HONO_PLAN_PROMETHEUS_BASED_CACHE_TIMEOUT\n--hono.plan.prometheusBased.cacheTimeout no 600 The number of seconds after which the cached metrics data should be considered invalid.    Metrics Configuration See Monitoring \u0026amp; Tracing Admin Guide for details on how to configure the reporting of metrics.\n"
},
{
	"uri": "https://www.eclipse.org/hono/docs/admin-guide/hono-client-configuration/",
	"title": "Hono Client Configuration",
	"tags": [],
	"description": "",
	"content": "The org.eclipse.hono.client.HonoClient factory can be used to create specific clients for accessing services implementing one or more of Hono\u0026rsquo;s APIs.\nThe factory uses environment variables and/or command line options to configure the connection to the service and the caching of responses to service invocations. All variables used for configuring a particular Hono Client factory instance share a common prefix. This way, multiple sets of variables can be used to configure multiple factories for connecting to different service endpoints without interfering with each other. For example, the set of variables for configuring the client factory for the Device Registration service may use the common prefix HONO_REGISTRATION whereas the set for configuring the factory for the Credentials service may use HONO_CREDENTIALS.\nConnection Properties The following table provides an overview of the configuration variables and corresponding command line options for configuring the AMQP connection to the service. Note that the variables map to the properties of class org.eclipse.hono.config.ClientConfigProperties which can be used to programmatically configure a client.\nThe variable names contain ${PREFIX} as a placeholder for the particular common prefix being used. The ${prefix} placeholder used in the command line option name is the same as ${PREFIX}, using all lower case characters and . instead of _ as the delimiter, e.g. the variable prefix HONO_CREDENTIALS corresponds to the command line option prefix hono.credentials).\n   Environment Variable\nCommand Line Option Mandatory Default Value Description     ${PREFIX}_AMQP_HOSTNAME\n--${prefix}.amqpHostname no - The name to use as the hostname in the client\u0026rsquo;s AMQP open frame during connection establishment. This variable can be used to indicate the virtual host to connect to on the server.   ${PREFIX}_CERT_PATH\n--${prefix}.certPath no - The absolute path to the PEM file containing the certificate that the client should use for authenticating to the server. This variable must be used in conjunction with ${PREFIX}_KEY_PATH.\nAlternatively, the ${PREFIX}_KEY_STORE_PATH variable can be used to configure a key store containing both the key as well as the certificate.   ${PREFIX}_CONNECT_TIMEOUT\n--${prefix}.connectTimeout no 5000 The maximum amount of time (milliseconds) that the client should wait for the AMQP connection to be opened. This includes the time for TCP/TLS connection establishment, SASL handshake and exchange of the AMQP open frame. This property can be used to tune the time period to wait according to the network latency involved with the connection between the client and the service.   ${PREFIX}_CREDENTIALS_PATH\n--${prefix}.credentialsPath no - The absolute path to a properties file that contains a username and a password property to use for authenticating to the service.\nThis variable is an alternative to using ${PREFIX}_USERNAME and ${PREFIX}_PASSWORD which has the advantage of not needing to expose the secret (password) in the client process\u0026rsquo; environment.   ${PREFIX}_FLOW_LATENCY\n--${prefix}.flowLatency no 20 The maximum amount of time (milliseconds) that the client should wait for credits after a link to the service has been established.   ${PREFIX}_HOST\n--${prefix}.host no localhost The IP address or name of the host to connect to. NB: This needs to be set to an address that can be resolved within the network the adapter runs on. When running as a Docker container, use Docker\u0026rsquo;s --network command line option to attach the local container to the Docker network that the service is running on.   ${PREFIX}_HOSTNAME_VERIFICATION_REQUIRED\n--${prefix}.hostnameVerificationRequired no true A flag indicating whether the value of the ${PREFIX}_HOST variable must match the distinguished name or any of the alternative names asserted by the server\u0026rsquo;s certificate when connecting using TLS.   ${PREFIX}_IDLE_TIMEOUT\n--${prefix}.idleTimeout no 16000 Sets the amount of time in milliseconds after which a connection will be closed when no frames have been received from the remote peer. This property is also used to configure a heartbeat mechanism, checking that the connection is still alive. The corresponding heartbeat interval will be set to idleTimeout/2 ms.   ${PREFIX}_INACTIVE_LINK_TIMEOUT\n--${prefix}.inactiveLinkTimeout no 0ms Sets duration after which an AMQP sender link will be closed when no message has been sent on it with an amount and an unit, e.g. 2h for 2 hours. See the Spring Boot documentation for an explanation of the format. Links will not be closed automatically if the value is 0ms.   ${PREFIX}_INITIAL_CREDITS\n--${prefix}.initialCredits no 200 The number of credits that a consuming client will initially issue to the service (sender) after link creation. This value effectively limits the number of messages that can be in flight unsettled.   ${PREFIX}_KEY_PATH\n--${prefix}.keyPath no - The absolute path to the (PKCS8) PEM file containing the private key that the client should use for authenticating to the server. Note that the private key is not protected by a password. You should therefore make sure that the key file can only be read by the user that the client process is running under. This variable must be used in conjunction with ${PREFIX}_CERT_PATH. Alternatively, the ${PREFIX}_KEY_STORE_PATH variable can be used to configure a key store containing both the key as well as the certificate.   ${PREFIX}_KEY_STORE_PASSWORD\n--${prefix}.keyStorePassword no - The password required to read the contents of the key store.   ${PREFIX}_KEY_STORE_PATH\n--${prefix}.keyStorePath no - The absolute path to the Java key store containing the private key and certificate that the client should use for authenticating to the server. Either this variable or the ${PREFIX}_KEY_PATH and ${PREFIX}_CERT_PATH variables need to be set in order to enable SASL External based authentication to the server. The key store format can be either JKS or PKCS12 indicated by a .jks or .p12 file suffix respectively.   ${PREFIX}_LINK_ESTABLISMENT_TIMEOUT\n--${prefix}.linkEstablishmentTimeout no 1000 The maximum amount of time (milliseconds) that the client should wait for the service\u0026rsquo;s attach frame during link establishment. This property can be used to tune the time period to wait according to the network latency involved with the communication link between the client and the service.   ${PREFIX}_NAME\n--${prefix}.name no - The name to use as the container-id in the client\u0026rsquo;s AMQP open frame during connection establishment.   ${PREFIX}_PORT\n--${prefix}.port no 5671 The port that the service is listening on.   ${PREFIX}_USERNAME\n--${prefix}.username no - The username to use for authenticating to the service. This property (and the corresponding password) needs to be set in order to enable SASL Plain based authentication to the service.   ${PREFIX}_PASSWORD\n--${prefix}.password no - The password to use for authenticating to the service.   ${PREFIX}_SEND_MESSAGE_TIMEOUT\n--${prefix}.sendMessageTimeout no 1000 The maximum number of milliseconds to wait for a delivery update after an event or command message was sent before the send operation is failed. Setting this value to a higher value increases the chance of successful service invocation in situations where network latency is high.   ${PREFIX}_RECONNECT_ATTEMPTS\n--${prefix}.reconnectAttempts no -1 The number of attempts (in addition to the original connection attempt) that the client should make in order to establish an AMQP connection with the peer before giving up. The default value of this property is -1 which means that the client will try forever.   ${PREFIX}_RECONNECT_DELAY_INCREMENT\n--${prefix}.reconnectDelayIncrement no 100 The factor (milliseconds) used in the exponential backoff algorithm for determining the delay before trying to re-establish an AMQP connection with the peer. The delay after an initial, failed connection attempt will be the value of the ${PREFIX}_RECONNECT_MIN_DELAY variable. Each subsequent connection attempt will use a random delay between the minimum delay and the value determined by exponentially increasing the delay by the ${PREFIX}_RECONNECT_DELAY_INCREMENT factor. The overall limit of the delay time is defined by the ${PREFIX}_RECONNECT_MAX_DELAY variable.   ${PREFIX}_RECONNECT_MAX_DELAY\n--${prefix}.reconnectMaxDelay no 7000 The maximum number of milliseconds to wait before trying to re-establish an AMQP connection with the peer.   ${PREFIX}_RECONNECT_MIN_DELAY\n--${prefix}.reconnectMinDelay no 0 The minimum number of milliseconds to wait before trying to re-establish an AMQP connection with the peer.   ${PREFIX}_REQUEST_TIMEOUT\n--${prefix}.requestTimeout no 200 The maximum number of milliseconds to wait for a response before a service invocation is failed. Setting this value to a higher value increases the chance of successful service invocation in situations where network latency is high.   ${PREFIX}_SECURE_PROTOCOLS\n--${prefix}.secureProtocols no TLSv1.2 A (comma separated) list of secure protocols that are supported when negotiating TLS sessions. Please refer to the vert.x documentation for a list of supported protocol names.   ${PREFIX}_TLS_ENABLED\n--${prefix}.tlsEnabled no false If set to true the connection to the peer will be encrypted using TLS and the peer\u0026rsquo;s identity will be verified using the JVM\u0026rsquo;s configured standard trust store.\nThis variable only needs to be set to enable TLS explicitly if no specific trust store is configured using the ${PREFIX}_TRUST_STORE_PATH variable.   ${PREFIX}_TRUST_STORE_PATH\n--${prefix}.trustStorePath no - The absolute path to the Java key store containing the CA certificates the adapter uses for authenticating the service. This property must be set if the service has been configured to support TLS. The key store format can be either JKS, PKCS12 or PEM indicated by a .jks, .p12 or .pem file suffix respectively.   ${PREFIX}_TRUST_STORE_PASSWORD\n--${prefix}.trustStorePassword no - The password required to read the contents of the trust store.    Response Caching The clients created by a Hono client factory support the caching of responses received in response to service invocations. Caching can greatly improve performance by preventing costly invocations of remote service operations. However, it usually only makes sense for resources that do not change too frequently. The Hono client follows the approach to caching used in HTTP 1.1. In particular, it supports cache directives that a service includes in the response messages it sends back to the Hono client.\nIn order to enable caching, the org.eclipse.hono.client.impl.HonoClientImpl factory class needs to be configured with a cache manager using the setCacheManager method. Any specific client created by the factory will then cache responses to service invocations based on the following rules:\n If the response contains a no-cache directive, the response is not cached at all. Otherwise, if the response contains a max-age directive, the response is cached for the number of seconds specified by the directive. Otherwise, if the response message does not contain any of the above directives and the response\u0026rsquo;s status code is one of the codes defined in RFC 2616, Section 13.4 Response Cacheability, the response is put to the cache using the default timeout defined by the ${PREFIX}_RESPONSE_CACHE_DEFAULT_TIMEOUT variable as the maximum age.  The following table provides an overview of the configuration variables and corresponding command line options for configuring the Hono client\u0026rsquo;s caching behavior.\n   Environment Variable\nCommand Line Option Mandatory Default Value Description     ${PREFIX}_RESPONSE_CACHE_MIN_SIZE\n--${prefix}.responseCacheMinSize no 20 The minimum number of responses that can be cached.   ${PREFIX}_RESPONSE_CACHE_MAX_SIZE\n--${prefix}.responseCacheMaxSize no 1000 The maximum number of responses that can be cached. It is up to the particular cache implementation, how to deal with new cache entries once this limit has been reached.   ${PREFIX}_RESPONSE_CACHE_DEFAULT_TIMEOUT\n--${prefix}.responseCacheDefaultTimeout no 600 The default number of seconds after which cached responses should be considered invalid.    Using TLS The client can be configured to use TLS for\n authenticating the server during connection establishment and (optionally) authenticating to the server using a client certificate (if the server supports this)  In order to authenticate the server by means of the server\u0026rsquo;s certificate, the client needs to be configured with a trust anchor containing the certificate authorities that the client trusts. The trust anchor can be configured explicitly by means of the ${PREFIX}_TRUST_STORE_PATH and ${PREFIX}_TRUST_STORE_PASSWORD variables. This is most useful in cases where the server\u0026rsquo;s certificate has not been signed by one of the public root CAs that are contained in the JRE\u0026rsquo;s standard trust store. However, if the server does use a certificate signed by such a public CA, then it is sufficient to set the ${PREFIX}_TLS_ENABLED variable to true in order for the client to support TLS when connecting to the server.\nThe client can also be configured to authenticate to the server by means of an X.509 client certificate if the server is configured to support this. The ${PREFIX}_CERT_PATH and ${PREFIX}_KEY_PATH variables can be used to set the paths to PEM files containing the certificate and private key. Alternatively, the ${PREFIX}_KEY_STORE_PATH and ${PREFIX}_KEY_STORE_PASSWORD variables can be used to set the path and password of a key store which contains both the certificate as well as the private key.\nThe client supports TLS 1.2 only by default for negotiating TLS sessions with servers. Additional protocols can be enabled by setting the ${PREFIX}_SECURE_PROTOCOLS variable to a comma separated list of protocol names as defined in the vert.x documentation. However, great care should be taken when enabling older protocols because most of them are vulnerable to attacks.\n"
},
{
	"uri": "https://www.eclipse.org/hono/docs/admin-guide/amqp-network-config/",
	"title": "AMQP 1.0 Messaging Network Configuration",
	"tags": [],
	"description": "",
	"content": "The Qpid Dispatch Router, together with the Apache Artemis message broker, serves as the default AMQP 1.0 Messaging Network that is used in Hono\u0026rsquo;s example deployment as described in the Deployment Guides.\nThe Dispatch Router component exposes service endpoints implementing the north bound part of Hono\u0026rsquo;s Telemetry, Event and Command \u0026amp; Control APIs which are used by applications to interact with devices.\nDispatch Router Configuration The Dispatch Router is part of the Apache Qpid project. Hono uses Dispatch Router by means of the EnMasse project\u0026rsquo;s Dispatch Router Docker image created from the Qpid project source code.\nThe Dispatch Router can be configured by means of configuration files. Hono includes an example configuration in the deploy/src/main/config/qpid folder which is used by the example deployment scripts. Please refer to the Dispatch Router documentation for details regarding the configuration file format and options.\nArtemis Broker Configuration The Artemis Broker is part of the Apache ActiveMQ project. Hono uses Artemis by means of the EnMasse project\u0026rsquo;s Artemis Docker image created from the Artemis project source code.\nThe Artemis Broker can be configured by means of configuration files. Hono includes an example configuration in the deploy/src/main/config/artemis folder which is used by the example deployment scripts. Please refer to the Artemis documentation for details regarding the configuration file format and options.\n"
},
{
	"uri": "https://www.eclipse.org/hono/docs/admin-guide/secure_communication/",
	"title": "Secure Communication",
	"tags": [],
	"description": "",
	"content": "The individual components of an Eclipse Hono\u0026trade; installation, e.g. the protocol adapters, AMQP Messaging Network, Hono Auth etc., and the clients attaching to Hono in order to send and receive data all communicate with each other using AMQP 1.0 over TCP. The Hono components and the clients will usually not be located on the same local network but will probably communicate over public networking infrastructure. For most use cases it is therefore desirable, if not necessary, to provide for confidentiality of the data being transferred between these components. This section describes how Hono supports confidentiality by means of Transport Layer Security (TLS) and how to configure it.\nEnabling TLS All of Hono\u0026rsquo;s components can be configured to use TLS for establishing an encrypted communication channel with peers. When a client initiates a connection with a server, the TLS handshake protocol is used to negotiate parameters of a secure channel to be used for exchanging data. The most important of those parameters is a secret (symmetric) encryption key that is only known to the client and the server and which is used to transparently encrypt all data being sent over the connection as long as the connection exists. With each new connection, a new secret key is negotiated.\nUsing TLS in this way requires configuring the server component with a cryptographic private/public key pair and a certificate which binds an identity claim to the public key. It is out of scope of this document to describe the full process of creating such a key pair and acquiring a corresponding certificate. The demo-certs module already contains a set of keys and certificates to be used for evaluation and demonstration purposes. Throughout the rest of this section we will use these keys and certificates . Please refer to the demo-certs/README.md file for details regarding how to create your own keys and certificates.\nWithin a Hono installation the following communication channels can be secured with TLS:\n Applications connecting to Dispatch Router - Client applications consuming e.g. Telemetry data from Hono connect to the AMQP Messaging Network. This connection can be secured by configuring the client and the messaging network for TLS. Device Registry connecting to Auth Server - The Device Registry connects to the Auth Server in order to verify client credentials and determine the client\u0026rsquo;s authorities. This (internal) connection can (should) be secured by configuring the Auth Server and Device Registry for TLS. Protocol Adapter to Device Registry - A protocol adapter connects to the Device Registry in order to retrieve assertions regarding the registration status of devices. This (internal) connection can be secured by configuring the protocol adapter and the Device Registry for TLS. Protocol Adapter connecting to AMQP Messaging Network - A protocol adapter connects to the messaging network in order to forward telemetry data and commands hence and forth between downstream components (client applications) and devices. This (internal) connection can be secured by configuring the Dispatch Router and the protocol adapters for TLS. Devices connecting to a Protocol Adapter - Devices use TLS to both authenticate the protocol adapter and to establish an encrypted channel that provides integrity and privacy when transmitting data. Note that the specifics of if and how TLS can be used with a particular protocol adapter is specific to the transport protocol the adapter uses for communicating with the devices. Liveness/readiness probes connecting to Service Health Checks - Systems like Kubernetes are periodically checking the health status of the individual services . This communication can be secured by configuring the health check of the individual services to expose a secure endpoint.  Auth Server The Auth Server supports the use of TLS for connections to clients. Please refer to the Auth Server admin guide for details regarding the required configuration steps.\nThe demo-certs/certs folder includes the following demo keys and certificates to be used with the Auth Server for that purpose.\n   File Description     auth-server-key.pem The example private key for creating signatures.   auth-server-cert.pem The example certificate asserting the server\u0026rsquo;s identity.   trusted-certs.pem Trusted CA certificates to use for verifying signatures.    Dispatch Router The Dispatch Router reads its configuration from a file on startup (the default location is /etc/qpid-dispatch/qdrouterd.conf). Please refer to the Dispatch Router documentation for details regarding the configuration of TLS/SSL.\nThe demo-certs/certs folder includes the following demo keys and certificates to be used with the Dispatch Router for that purpose:\n   File Description     qdrouter-key.pem The example private key for creating signatures.   qdrouter-cert.pem The example certificate asserting the server\u0026rsquo;s identity.   trusted-certs.pem Trusted CA certificates to use for verifying signatures.    Device Registry The Device Registry supports the use of TLS for connections to protocol adapters and the Auth Server. Please refer to the Device Registry admin guide for details regarding the required configuration steps.\nThe demo-certs/certs folder contains the following demo keys and certificates to be used with the Device Registry for that purpose.\n   File Description     auth-server-cert.pem The certificate of the Auth Server, used to verify the signatures of tokens issued by the Auth Server.   device-registry-key.pem The example private key for creating signatures.   device-registry-cert.pem The example certificate asserting the server\u0026rsquo;s identity.   trusted-certs.pem Trusted CA certificates to use for verifying signatures.    HTTP Adapter The HTTP adapter supports the use of TLS for its connections to the Tenant service, the Device Registration service, the Credentials service and the AMQP Messaging Network. The adapter also supports the use of TLS for connections with devices. For this purpose, the adapter can be configured with a server certificate and private key. Please refer to the HTTP adapter admin guide for details regarding the required configuration steps.\nThe demo-certs/certs folder contains the following demo keys and certificates to be used with the HTTP adapter for that purpose.\n   File Description     http-adapter-key.pem The example private key for creating signatures.   http-adapter-cert.pem The example certificate asserting the adapter\u0026rsquo;s identity.   trusted-certs.pem Trusted CA certificates to use for verifying signatures.    MQTT Adapter The MQTT adapter supports the use of TLS for its connections to the Tenant service, the Device Registration service, the Credentials service and the AMQP Messaging Network. The adapter also supports the use of TLS for connections with devices. For this purpose, the adapter can be configured with a server certificate and private key. Please refer to the MQTT adapter admin guide for details regarding the required configuration steps.\nThe demo-certs/certs folder contains the following demo keys and certificates to be used with the MQTT adapter for that purpose.\n   File Description     mqtt-adapter-key.pem The example private key for creating signatures.   mqtt-adapter-cert.pem The example certificate asserting the adapter\u0026rsquo;s identity.   trusted-certs.pem Trusted CA certificates to use for verifying signatures.    Kura Adapter The Kura adapter supports the use of TLS for its connections to the Tenant service, the Device Registration service, the Credentials service and the AMQP Messaging Network. The adapter also supports the use of TLS for connections with devices. For this purpose, the adapter can be configured with a server certificate and private key. Please refer to the Kura adapter admin guide for details regarding the required configuration steps.\nThe demo-certs/certs folder contains the following demo keys and certificates to be used with the Kura adapter for that purpose.\n   File Description     kura-adapter-key.pem The example private key for creating signatures.   kura-adapter-cert.pem The example certificate asserting the adapter\u0026rsquo;s identity.   trusted-certs.pem Trusted CA certificates to use for verifying signatures.    Client Application When the connection between an application client and Hono (i.e. the Dispatch Router) is supposed to be secured by TLS (which is a good idea), then the client application needs to be configured to trust the CA that signed the Dispatch Router\u0026rsquo;s certificate chain. When the application uses the org.eclipse.hono.client.HonoClientImpl class from the client module, then this can be done by means of configuring the org.eclipse.hono.connection.ConnectionFactoryImpl with a trust store containing the CA\u0026rsquo;s certificate. Please refer to the Hono Client configuration guide for details regarding the configuration properties that need to be set.\nThe demo-certs/certs folder contains the following demo keys to be used with client applications for that purpose.\n   File Description     trusted-certs.pem Trusted CA certificates to use for verifying signatures.    Using OpenSSL Hono\u0026rsquo;s individual services are implemented in Java and therefore, by default, use the SSL/TLS engine that comes with the Java Virtual Machine that the services are running on. In case of the Docker images provided by Hono this is the SSL engine of OpenJDK. While the standard SSL engine has the advantage of being a part of the JVM itself and thus being available on every operating system that the JVM is running on without further installation, it provides only limited performance and throughput when compared to native TLS implementations like OpenSSL.\nIn order to address this problem, the Netty networking library that is used in Hono\u0026rsquo;s components can be configured to employ the OpenSSL instead of the JVM\u0026rsquo;s SSL engine by means of Netty\u0026rsquo;s Forked Tomcat Native (tcnative) module.\nThe tcnative module comes in several flavors, corresponding to the way that the OpenSSL library has been linked in. The statically linked versions include a specific version of OpenSSL (or BoringSSL for that matter) and is therefore most easy to use on supported platforms, regardless of whether another version of OpenSSL is already installed or not. In contrast, the dynamically linked variants depend on a particular version of OpenSSL being already installed on the operating system. Both approaches have their pros and cons and Hono therefore does not include tcnative in its Docker images by default, i.e. Hono\u0026rsquo;s services will use the JVM\u0026rsquo;s default SSL engine by default.\nConfiguring Containers When starting up any of Hono\u0026rsquo;s Docker images as a container, the JVM will look for additional jar files to include in its classpath in the container\u0026rsquo;s /opt/hono/extensions folder. Thus, using a specific variant of tcnative is just a matter of configuring the container to mount a volume or binding a host folder at that location and putting the desired variant of tcnative into the corresponding volume or host folder.r Assuming that the Auth Server should be run with the statically linked, BoringSSL based tcnative variant, the following steps are necessary:\n Download tcnative matching the platform architecture (linux-x86_64). Put the jar file to a folder on the Docker host, e.g. /tmp/tcnative. Start the Auth Server Docker image mounting the host folder:\ndocker run --name hono-auth-server --mount type=bind,src=/tmp/tcnative,dst=/opt/hono/extensions,ro ... eclipse/hono-service-auth   Note that the command given above does not contain the environment variables and secrets that are usually required to configure the service properly.\nWhen the Auth Server starts up, it will look for a working variant of tcnative on its classpath and (if found) use it for establishing TLS connections. The service\u0026rsquo;s log file will indicate whether the JVM\u0026rsquo;s default SSL engine or OpenSSL is used.\nUsing a Docker volume instead of a bind mount works the same way but requires the use of volume as the type of the --mount parameter. Please refer to the Docker reference documentation for details.\n"
},
{
	"uri": "https://www.eclipse.org/hono/docs/admin-guide/monitoring-tracing-config/",
	"title": "Monitoring &amp; Tracing",
	"tags": [],
	"description": "",
	"content": "The individual components of an Eclipse Hono\u0026trade; installation need to work together in order to provide their functionality to devices and applications. Under normal circumstances these interactions work flawlessly. However, due to the nature of distributed systems, any one (or more) of the components may crash or become otherwise unavailable due to arbitrary reasons. This page describes how Hono supports operations teams by providing insights into the individual service components and their interactions with each other by means of reporting metrics and tracing the processing of individual messages through the system.\nWhen a device uploads telemetry data to the HTTP adapter, the adapter invokes operations on the Device Registration, Credentials and the Tenant services in order to authenticate and authorize the device before sending the telemetry data downstream to the AMQP 1.0 Messaging Network. The overall success of this process and the latency involved before the message reaches the consumer is determined by the individual interactions between the service components.\nMonitoring In a production environment, an operations team will usually want to keep track of some key performance indicators (KPI) which allow the team to determine the overall health of the system, e.g. memory and CPU consumption etc. Hono supports the tracking of such KPIs by means of metrics it can be configured to report. The metrics are usually collected in a time series database like InfluxDB or Prometheus and then visualized on a monitoring dash-board built using frameworks like Grafana. Such a dash-board can usually also be configured to send alarms when certain thresholds are exceeded.\nMetrics usually provide insights into the past and current status of an individual component. The values can be aggregated to provide a picture of the overall system\u0026rsquo;s status. As such, metrics provide a great way to monitor system health and, in particular, to anticipate resource shortages and use such knowledge to pro-actively prevent system failure.\nConfiguring a Metrics Back End Hono uses Micrometer for providing metrics. It is possible to drop in any Micrometer compatible back end. Hono also uses the Micrometer integration with Spring Boot and Vert.x.\nPlease refer to the Micrometer documentation for details regarding the configuration of a specific Micrometer back end. In most cases, you only need to add the back end specific jar files to the class path and add back end specific configuration to the application.yml file.\nThe Hono build supports configuration of a specific metrics back end by means of Maven profiles. The following build profiles are currently supported:\n metrics-prometheus – Enables the Prometheus backend. metrics-graphite – Enables the Graphite backend. metrics-influxdb – Enables the InfluxDB backend.  Additionally to selecting a metrics back end, you may need to configure the back end using Spring configuration options. See the documentation mentioned above for more information.\nNote that none of the above profiles are active by default, i.e. you need to explicitly activate one of them when starting the build using Maven\u0026rsquo;s -p command line parameter.\nUsing Prometheus Most of the metrics back ends have data being pushed to from the components reporting the metrics. However, Prometheus is different in that it polls (or scrapes) all components periodically for new metrics data. For this to work, the Prometheus server needs to be configured with the IP addresses of the components to monitor. In the example deployment that comes with Hono, the Kubernetes pods that the Hono components are running in are marked by means of a label. The Prometheus server then periodically queries the Kubernetes API to determine a list of pods (and their IP addresses) that have the corresponding label. The components themselves need to expose a corresponding HTTP endpoint that the Prometheus server can connect to for scraping the meter data. All Hono components that report metrics can be configured to expose such an endpoint via their Health Check server which already exposes endpoints for determining the component\u0026rsquo;s readiness and liveness status.\nLegacy Metrics Support In addition to using standard Micrometer back ends, Hono also provides out of the box support for the pre-0.8 Graphite based format. This will configure the Graphite adapter to output metrics in the legacy format used by Hono versions before 0.8. Further configuration of the Graphite adapter can be made using the standard Spring Boot configuration of Micrometer. The legacy support can be enabled using the following configuration switch:\n   Environment Variable\nCommand Line Option Mandatory Default Description     HONO_METRICS_LEGACY\n--hono.metrics.legacy no false Enable legacy metrics using graphite.    It is also necessary to enable the build profile for Graphite (metrics-graphite), as the legacy back end is based on the Graphite wire format. The profile will add the necessary dependencies to the build. If the dependencies are missing, the startup of the Hono components will fail.\nThe names and semantics of the individual metrics being reported by the components are described in the Legacy Metrics specification.\nHealth Check Server Configuration All of Hono\u0026rsquo;s service components and protocol adapters contain a Health Check server which can be configured to expose several HTTP endpoints for determining the component\u0026rsquo;s status. In particular, the server exposes a /readiness, a /liveness and an optional /prometheus URI endpoint.\nThe former two endpoints are supposed to be used by container orchestration platforms like Kubernetes to monitor the runtime status of the containers that it manages. These endpoints are always exposed when the health check server is started.\nThe /prometheus endpoint can be used by a Prometheus server to retrieve collected meter data from the component. It is only exposed if Prometheus has been configured as the metrics back end as described above.\nThe health check server can be configured by means of the following environment variables:\n   Environment Variable\nCommand Line Option Default Value Description     HONO_HEALTH_CHECK_BIND_ADDRESS\n--hono.healthCheck.bindAddress 127.0.0.1 The IP address of the network interface that the health check server\u0026rsquo;s secure port should be bound to. The server will only be started if this property is set to some other than the default value and corresponding key material has been configured using the HONO_HEALTH_CHECK_KEY_PATH and HONO_HEALTH_CHECK_CERT_PATH variables.   HONO_HEALTH_CHECK_CERT_PATH\n--hono.healthCheck.certPath - The absolute path to the PEM file containing the certificate that the secure server should use for authenticating to clients. This option must be used in conjunction with HONO_HEALTH_CHECK_KEY_PATH.\nAlternatively, the HONO_HEALTH_CHECK_KEY_STORE_PATH option can be used to configure a key store containing both the key as well as the certificate.   HONO_HEALTH_CHECK_INSECURE_PORT_BIND_ADDRESS\n--hono.healthCheck.insecurePortBindAddress 127.0.0.1 The IP address of the network interface that the health check server\u0026rsquo;s insecure port should be bound to. The server will only be started if this property is set to some other than the default value.   HONO_HEALTH_CHECK_INSECURE_PORT\n--hono.healthCheck.insecurePort 8088 The port that the insecure server should listen on.   HONO_HEALTH_CHECK_KEY_PATH\n--hono.healthCheck.keyPath - The absolute path to the (PKCS8) PEM file containing the private key that the secure server should use for authenticating to clients. This option must be used in conjunction with HONO_HEALTH_CHECK_CERT_PATH. Alternatively, the HONO_HEALTH_CHECK_KEY_STORE_PATH option can be used to configure a key store containing both the key as well as the certificate.   HONO_HEALTH_CHECK_PORT\n--hono.healthCheck.port 8088 The port that the secure server should listen on.   HONO_HEALTH_CHECK_KEY_STORE_PASSWORD\n--hono.healthCheck.keyStorePassword - The password required to read the contents of the key store.   HONO_HEALTH_CHECK_KEY_STORE_PATH\n--hono.healthCheck.keyStorePath - The absolute path to the Java key store containing the private key and certificate that the secure server should use for authenticating to clients. Either this option or the HONO_HEALTH_CHECK_KEY_PATH and HONO_HEALTH_CHECK_CERT_PATH options need to be set in order to enable TLS secured connections with clients. The key store format can be either JKS or PKCS12 indicated by a .jks or .p12 file suffix respectively. The HONO_HEALTH_CHECK_KEY_STORE_PASSWORD variable can be used to set the password required for reading the key store.     Failure to start The component/service will fail to start if neither the secure not the insecure server have been configured properly.  Tracing In normal operation the vast majority of messages should be flowing through the system without any noteworthy delays or problems. In fact, that is the whole purpose of Hono. However, that doesn\u0026rsquo;t mean that nothing can go wrong. For example, when a tenant\u0026rsquo;s device administrator changes the credentials of a device in the Credentials service but has not yet updated the credentials on the device yet, then the device will start to fail in uploading any data to the protocol adapter it connects to. After a while, a back end application\u0026rsquo;s administrator might notice, that there hasn\u0026rsquo;t been any data being received from that particular device for quite some time. The application administrator therefore calls up the Hono operations team and complains about the data being lost somewhere.\nThe operations team will have a hard time determining what is happening, because it will need to figure out which components have been involved in the processing of the device and why the data hasn\u0026rsquo;t been processed as usual. The metrics alone usually do not help much here because metrics are usually not scoped to individual devices. The logs written by the individual components, on the other hand, might contain enough information to correlate individual entries in the log with each other and thus trace the processing of the message throughout the system. However, this is usually a very tedious (and error prone) process and the relevant information is often only logged at a level (e.g. DEBUG) that is not used in production (often INFO or above).\nIn order to address this problem, Hono\u0026rsquo;s service components are instrumented using OpenTracing. OpenTracing provides Vendor-neutral APIs and instrumentation for distributed tracing. The OpenTracing web page provides a list of supported tracer implementations from which users can choose in order to collect (and examine) the tracing information generated by Hono\u0026rsquo;s individual components.\nConfiguring a Tracer Hint: The description in this chapter applies to any compatible OpenTracing implementation. For an easier approach to configure usage of Jaeger tracing, see the next chapter.\nHono\u0026rsquo;s components use the OpenTracing Tracer Resolver mechanism to find and initialize a concrete OpenTracing implementation during startup of the component. The discovery mechanism is using Java\u0026rsquo;s ServiceLoader and as such relies on the required resources to be available on the class path.\nWhen starting up any of Hono\u0026rsquo;s Docker images as a container, the JVM will look for additional jar files to include in its class path in the container\u0026rsquo;s /opt/hono/extensions folder. Thus, using a specific implementation of OpenTracing is just a matter of configuring the container to mount a volume or binding a host folder at that location and putting the implementation\u0026rsquo;s jar files and resources into the corresponding volume or host folder.\n Note This also means that (currently) only Tracer implementations can be used with Hono that also implement the Tracer Resolver mechanism.  Assuming that the HTTP adapter should be configured to use Jaeger tracing, the following steps are necessary:\n Download Jaeger\u0026rsquo;s Java Tracer Resolver implementation and its dependencies (see the hint at the end). Put the jars to a folder on the Docker host, e.g. /tmp/jaeger. Start the HTTP adapter Docker image mounting the host folder:\ndocker run --name hono-adapter-http-vertx \\ --mount type=bind,src=/tmp/jaeger,dst=/opt/hono/extensions,ro \\ ... \\ eclipse/hono-adapter-http-vertx   Note: the command given above does not contain the environment variables and secrets that are required to configure the service properly. The environment variables for configuring the Jaeger client are also missing. Please refer to the Jaeger documentation for details.\nWhen the HTTP adapter starts up, it will look for a working implementation of the Tracer Resolver on its classpath and (if found) initialize and use it for publishing traces. The adapter\u0026rsquo;s log file will indicate the name of the Tracer implementation being used.\nUsing a Docker volume instead of a bind mount works the same way but requires the use of volume as the type of the --mount parameter. Please refer to the Docker reference documentation for details.\nHint: to resolve all dependencies for jaeger-tracerresolver in order to provide them to /opt/hono/extensions, you may want to rely on Maven\u0026rsquo;s dependency plugin. To obtain all jar files you can invoke the following command in a simple Maven project that contains only the dependency to jaeger-tracerresolver:\nmvn dependency:copy-dependencies  All jar files can then be found in the directory target/dependency.\nConfiguring usage of Jaeger tracing (included in Docker images) In case Jaeger tracing shall be used, there is an alternative to putting the jar files in the container\u0026rsquo;s /opt/hono/extensions folder as described above. This is to have the Jaeger tracing jar files be included in the Hono Docker images by using the jaeger Maven profile when building Hono.\nFor example, building the HTTP adapter image with the Jaeger client included:\n# in directory: hono/adapters/http-vertx/ mvn clean install -Pbuild-docker-image,jaeger  Note that when running the created docker image, the environment variables for configuring the Jaeger client still need to be set. Please refer to the Jaeger documentation for details.\nEnforcing the recording of traces for a tenant Typically, in production systems, the tracing components will be configured to not store all trace spans in the tracing backend, in order to reduce the performance impact. For debugging purposes it can however be beneficial to enforce the recording of certain traces. Hono allows this by providing a configuration option in the Tenant information with which all traces concerning the processing of telemetry, event and command messages for that specific tenant will be recorded. Furthermore, this enforced trace sampling can be restricted to only apply to messages sent in the context of a specific authentication identifier. Please refer to the description of the tracing object in the Tenant Information for details.\n"
},
{
	"uri": "https://www.eclipse.org/hono/docs/dev-guide/",
	"title": "Developer Guide",
	"tags": [],
	"description": "",
	"content": " Developer Guide Learn how to integrate your custom components with Hono\u0026trade;.\n"
},
{
	"uri": "https://www.eclipse.org/hono/docs/dev-guide/building_hono/",
	"title": "Building from Source",
	"tags": [],
	"description": "",
	"content": " Hono can be deployed using the pre-built Docker images available from our Docker Hub repositories. However, customizing and/or extending Hono\u0026rsquo;s functionality requires building the images from source code.\nThis page provides step by step instructions for getting the source code and building the Hono\u0026rsquo;s Docker images from it.\nPrerequisites for building Hono Docker Creating Hono\u0026rsquo;s container images using the Hono build process requires a Docker daemon running either locally or on another host you have access to. Please follow the instructions on the Docker web site to install Docker on your platform.\nJava Hono is written in Java and therefore requires a Java Development Kit (JDK) version 11 or higher installed on your computer. Please follow the JDK vendor\u0026rsquo;s instructions for installing Java on your operating system.\nMaven Hono\u0026rsquo;s build process is based on Apache Maven. You need at least Maven 3.5 in order to build Hono. Please follow the installation instructions on the Maven home page.\nGit A Git client is required if you want to contribute changes/improvements to the Hono project. It is not necessary for simply building Hono locally. Please refer to the Git Downloads page for installation instructions.\nGetting the Hono Source Code Either\n download the latest release archive and extract the archive to a local folder or clone the Hono source code repository from GitHub:  git clone https://github.com/eclipse/hono.git  This will create a hono folder in the current working directory and clone the whole repository into that folder.  Starting the Hono Build Process Run the following from the source folder:\n# in the \u0026quot;hono\u0026quot; folder containing the source code mvn clean install -Ddocker.host=tcp://${host}:${port} -Pbuild-docker-image,metrics-prometheus  with ${host} and ${port} reflecting the name/IP address and port of the host where Docker is running on. This will build all libraries, Docker images and example code. If you are running on Linux and Docker is installed locally or you have set the DOCKER_HOST environment variable, you can omit the -Ddocker.host property definition.\nIf you plan to build the Docker images more frequently, e.g. because you want to extend or improve the Hono code, then you should define the docker.host property in your Maven settings.xml file containing the very same value as you would use on the command line as indicated above. The file is usually located in the .m2 folder in your user\u0026rsquo;s home directory. This way you can simply do a mvn clean install later on and the Docker images will be built automatically as well because the build-docker-image profile is activated automatically if the Maven property docker.host is set.\n Be patient The first build might take several minutes because Docker will need to download all the base images that Hono is relying on. However, most of these will be cached by Docker so that subsequent builds will be running much faster.  "
},
{
	"uri": "https://www.eclipse.org/hono/docs/dev-guide/java_client_consumer/",
	"title": "Consuming Messages from Java",
	"tags": [],
	"description": "",
	"content": " To illustrate how Eclipse Hono\u0026trade; can be integrated with Java code, a simple application is provided that consumes telemetry and event data for devices belonging to the default tenant.\nIt also includes support for Command and Control:\nif indicated by a received downstream message that contains a ttd value (refer to Device notifications for details) it tries to send a command to the device. If the value of ttd indicates that the device stays connected for an unlimited time (ttd == -1), the application will periodically repeat to send a command until notified the device is disconnected again (ttd == 0).\nThis application shall serve as a blueprint to integrate your existing java source code with Hono. Its code is found in the example module in the package org.eclipse.hono.vertx.example.\nThe provided classes are kept as simple as possible (in the tradition of a classical \u0026ldquo;Hello World\u0026rdquo; implementation) while still covering the most relevant messaging patterns (downstream and upstream messages). For this purpose they make use of simple constant definitions and deal with exceptions as rarely as possible. You may want to change the level of detail that should be logged to the console by editing the contained resources/logback.xml file.\nPlease refer to the javadoc of the classes for details.\n Note Note that production ready code likely has to think more about error handling and logging than this simple blueprint.  Configure the example For simplicity, all configurations are defined as Java constants inside the class HonoExampleConstants.\nIf you have Hono running in Docker under localhost, the example should work out of the box.\nSome configuration values can be overridden by providing them as property to the application.\nThis includes the host and the port of the AMQP network. In the standard setup of Hono they should be configured to the qdrouter from the Apache Qpid project. In production scenarios this might be a large setup of AMQP routers, brokers, etc.\nPlease refer to the class HonoExampleConstants to find out which part of the application can be configured by properties.\nRun the example The application waits for messages until you press any key or kill it.\nIt is started by\n# in directory: hono/example/ mvn exec:java -Dexec.mainClass=org.eclipse.hono.vertx.example.HonoExampleApplication  or - if e.g. the host of the AMQP network should be changed -\nmvn exec:java -Dexec.mainClass=org.eclipse.hono.vertx.example.HonoExampleApplication -Dconsumer.host=192.168.99.100  Telemetry and Event messages Depending on the logger configuration, all received downstream messages are printed to the console.\nPlease note that consumers do not connect with Hono directly, but rather with an AMQP router network.\nCommand and Control By using a helper class provided by Hono, a callback in the application code is invoked when a downstream message was received that signals the device will stay connected to the protocol adapter for some time (see Device notifications for details).\nInside this callback an arbitrary simple command is sent down to the device (once or periodically) and the response is logged to the console.\nEncryption of communication For the encrypted communication with Hono, the necessary truststore is already installed and used by the Hono client.\nIf you want to integrate the code with your own software, please copy the provided truststore (hono/demo-certs/certs/trusted-certs.pem) from the Hono project to the resources directory of your project and adopt the code pointing to the file location.\n"
},
{
	"uri": "https://www.eclipse.org/hono/docs/dev-guide/custom_http_adapter/",
	"title": "Implement a Custom Hono HTTP Protocol Adapter",
	"tags": [],
	"description": "",
	"content": "Eclipse Hono\u0026trade; comes with a default HTTP Adapter which can be used to interact with devices via HTTP. The default HTTP Adapter also serves as a blueprint for implementing a custom HTTP protocol adapter.\nThis section will guide you through the steps to build your own custom HTTP protocol adapter.\nPrerequisites You should be familiar with the setup and start of Hono. Refer to the Getting Started guide.\nThe standard HTTP Adapter Hono\u0026rsquo;s HTTP Adapter supports telemetry and event data processing. Please refer to the HTTP Adapter User Guide and HTTP Adapter Admin Guide for details regarding the usage and configuration of the HTTP Adapter.\nYou can find the source of the HTTP Adapter at https://github.com/eclipse/hono/tree/master/adapters/http-vertx.\nAnatomy of the standard HTTP Adapter Like many other Hono components, the HTTP Adapter is built on top of the Vert.x framework.\nThe HTTP Adapter\u0026rsquo;s VertxBasedHttpProtocolAdapter class is derived from an abstract base class. This base class implements the standard functionality for component initialization, receiving HTTP requests from devices or external clients, and forwarding of data to the downstream AMQP Messaging Network.\nDerive a custom HTTP Protocol Adapter Use the standard HTTP Adapter as a blueprint.\nAdding Routes In Vert.x, a route is a mapping of an HTTP request to a handler. Inside a route, Vert.x provides a RoutingContext instance which gives access to the HTTP request (and response) object containing the HTTP headers.\nThe standard HTTP Adapter overrides the abstract method addRoutes(), provided by the base class, and adds routes for processing telemetry data and events.\n// route for uploading telemetry data router.route(HttpMethod.PUT, String.format(\u0026quot;/telemetry/:%s/:%s\u0026quot;, PARAM_TENANT, PARAM_DEVICE_ID)) .handler(ctx -\u0026gt; uploadTelemetryMessage(ctx, getTenantParam(ctx), getDeviceIdParam(ctx)));  The route for telemetry data parses the HTTP request, extracts the tenant and deviceId parameters from the request URL path, and forwards the message payload to the method uploadTelemetryMessage(), provided by the base class.\nNB Note the Vert.x place holder indicators : inside the URL path pattern /telemetry/:%s/:%s. Vert.x makes matching place holders available as request parameters. See Capturing path parameters in the Vert.x documentation.\nThe route for events looks very similar to the route for telemetry data. It forwards the event message payload to the uploadEventMessage() method.\nPlease refer to the Telemetry API and Event API for details about the different Hono APIs.\nIn the custom HTTP protocol adapter adapt the routes according to your needs.\nBuild and run the custom HTTP Protocol Adapter If you have Hono running, you can launch your custom HTTP protocol adapter as a Docker Container or a Spring Boot application.\nYou may adopt the Maven profile build-docker-image from the Maven POM file of the standard HTTP Adapter into your custom adapter\u0026rsquo;s Maven POM file.\nFollow the guidelines for running the HTTP Adapter in HTTP Adapter. Don\u0026rsquo;t forget to configure the custom protocol adapter to bind to a different port than the standard HTTP Adapter if you intend to run them both at the same time. See the Port Configuration section of the HTTP Adapter documentation for details.\nUsing the custom HTTP Protocol Adapter Now that you have your custom HTTP protocol adapter up and running, you can use any HTTP client, like curl or HTTPie, to publish data to your custom adapter.\nNote that before publishing data to your custom HTTP protocol adapter, you need to start a consumer for the tenant you intend to publish data for. Otherwise you will not be able to successfully send data. For this purpose, you may use the example consumer as described in the Getting Started guide.\nFurther extend the custom HTTP Protocol Adapter The abstract base class includes additional hooks which you may use to plug into the adapter\u0026rsquo;s life cycle:\n   Hook Description     preStartup() called before start of adapter\u0026rsquo;s HTTP server   onStartupSuccess() called after successful start of adapter   preShutdown() called before stop of adapter\u0026rsquo;s HTTP server   postShutdown called after successful stop of adapter   "
},
{
	"uri": "https://www.eclipse.org/hono/docs/api/",
	"title": "API",
	"tags": [],
	"description": "",
	"content": " API Documentation of the APIs defined by Hono\u0026trade;.\n"
},
{
	"uri": "https://www.eclipse.org/hono/docs/api/telemetry/",
	"title": "Telemetry API Specification",
	"tags": [],
	"description": "",
	"content": "The Telemetry API is used by Protocol Adapters to send telemetry data downstream. Business Applications and other consumers use the API to receive data published by devices belonging to a particular tenant.\nThe Telemetry API is defined by means of AMQP 1.0 message exchanges, i.e. a client needs to connect to Hono using AMQP 1.0 in order to invoke operations of the API as described in the following sections. Throughout the remainder of this page we will simply use AMQP when referring to AMQP 1.0.\nSouthbound Operations The following operations can be used by Protocol Adapters to forward telemetry data received from devices to downstream consumers like Business Applications.\nForward Telemetry Data Preconditions\n Adapter has established an AMQP connection with the AMQP Messaging Network. Adapter has established an AMQP link in role sender with the AMQP Messaging Network using target address telemetry/${tenant_id} where ${tenant_id} is the ID of the tenant that the client wants to upload telemetry data for. The device for which the adapter wants to send telemetry data has been registered (see Device Registration API).  The adapter indicates its preferred message delivery mode by means of the snd-settle-mode and rcv-settle-mode fields of its attach frame during link establishment.\n   snd-settle-mode rcv-settle-mode Delivery semantics     unsettled, mixed first Using unsettled for the snd-settle-mode allows for adapters to implement both AT LEAST ONCE or AT MOST ONCE delivery semantics, depending on whether the adapter waits for and considers the disposition frames it receives from the AMQP Messaging Network or not. This is the recommended mode for forwarding telemetry data.   settled first Using settled for the snd-settle-mode allows for adapters to implement AT MOST ONCE delivery semantics only. This is the fastest mode of delivery but has the drawback of less reliable end-to-end flow control and potential loss of messages without notice.    All other combinations are not supported by Hono and may result in the termination of the link or connection (depending on the configuration of the AMQP Messaging Network).\nMessage Flow\nAs indicated above, it is up to the discretion of the protocol adapter whether it wants to use AT LEAST ONCE or AT MOST ONCE delivery semantics.\nHono\u0026rsquo;s HTTP adapter allows devices to indicate, which delivery semantics they want to use when uploading telemetry data.\nThe following sequence diagram illustrates the flow of messages involved in the HTTP Adapter forwarding an unsettled telemetry data message to the downstream AMQP Messaging Network implementing AT MOST ONCE delivery semantics.\n  Forward telemetry data flow (AT MOST ONCE)    Device 4711 PUTs telemetry data to the HTTP Adapter  HTTP Adapter transfers telemetry data to AMQP 1.0 Messaging Network. HTTP Adapter acknowledges the reception of the data to the Device.  AMQP 1.0 Messaging Network acknowledges reception of the message which is ignored by the HTTP Adapter.   Note In the example above the HTTP adapter does not wait for the outcome of the transfer of the message to the AMQP Messaging Network before sending back the HTTP response to the device. If the messaging network had sent a disposition frame with the rejected instead of the accepted outcome, the HTTP adapter would still have signaled a 202 status code back to the device. In this case the data would have been lost without the device noticing.  The following sequence diagram illustrates the flow of messages involved in the HTTP Adapter forwarding an unsettled telemetry data message to the downstream AMQP Messaging Network implementing AT LEAST ONCE delivery semantics.\n  Forward telemetry data flow (AT LEAST ONCE)    Device 4711 PUTs telemetry data to the HTTP Adapter, indicating QoS Level 1.  HTTP Adapter transfers telemetry data to AMQP 1.0 Messaging Network. AMQP 1.0 Messaging Network acknowledges reception of the message. HTTP Adapter acknowledges the reception of the data to the Device.   When the AMQP Messaging Network fails to settle the transfer of a telemetry message or settles the transfer with any other outcome than accepted, the protocol adapter MUST NOT try to re-send such rejected messages but SHOULD indicate the failed transfer to the device if the transport protocol provides means to do so.\nMessage Format\nThe following table provides an overview of the properties a client needs to set on a Forward Telemetry Data message.\n   Name Mandatory Location Type Description     content-type yes properties symbol A content type indicating the type and characteristics of the data contained in the payload, e.g. text/plain; charset=\u0026quot;utf-8\u0026quot; for a text message or application/json etc. The value may be set to application/octet-stream if the message payload is to be considered opaque binary data.   creation-time no properties timestamp The instant in time when the message has been created (see the AMQP 1.0 specification for details). This property is mandatory if ttd is set, otherwise it is optional.   device_id yes application-properties string The identifier of the device that the data in the payload is originating from.   ttd no application-properties int The time \u0026lsquo;til disconnect indicates the number of seconds that the device will remain connected to the protocol adapter. The value of this property must be interpreted relative to the message\u0026rsquo;s creation-time. A value of -1 is used to indicate that the device will remain connected until further notice, i.e. until another message indicates a ttd value of 0. In absence of this property, the connection status of the device is to be considered indeterminate. Backend Applications might use this information to determine a time window during which the device will be able to receive a command.    The body of the message MUST consist of a single AMQP Data section containing the telemetry data. The format and encoding of the data MUST be indicated by the content-type and (optional) content-encoding properties of the message.\nAny additional properties set by the client in either the properties or application-properties sections are preserved by Hono, i.e. these properties will also be contained in the message delivered to consumers.\nNorthbound Operations Receive Telemetry Data Hono delivers messages containing telemetry data reported by a particular device in the same order that they have been received in (using the Upload Telemetry Data operation defined above). Hono MAY drop telemetry messages that it cannot deliver to any consumers. Reasons for this include that there are no consumers connected to Hono or the existing consumers are not able to process the messages from Hono fast enough.\nHono supports multiple non-competing Business Application consumers of telemetry data for a given tenant. Hono allows each Business Application to have multiple competing consumers for telemetry data for a given tenant to share the load of processing the messages.\nPreconditions\n Client has established an AMQP connection with Hono. Client has established an AMQP link in role receiver with Hono using source address telemetry/${tenant_id} where ${tenant_id} represents the ID of the tenant the client wants to retrieve telemetry data for.  Hono supports both AT MOST ONCE as well as AT LEAST ONCE delivery of telemetry messages. However, clients SHOULD use AT LEAST ONCE delivery in order to support end-to-end flow control and therefore SHOULD set the snd-settle-mode field to unsettled and the rcv-settle-mode field to first in their attach frame during link establishment.\nA client MAY indicate to Hono during link establishment that it wants to distribute the telemetry messages received for a given tenant among multiple consumers by including a link property subscription-name whose value is shared by all other consumers of the tenant. Hono ensures that messages from a given device are delivered to the same consumer. Note that this also means that telemetry messages MAY not be evenly distributed among consumers, e.g. when only a single device sends data. NB This feature is not supported yet.\nIn addition a client MAY include a boolean link property ordering-required with value false during link establishment in order to indicate to Hono that it does not require messages being delivered strictly in order per device but instead allows for messages being distributed evenly among the consumers. NB This feature is not supported yet.\nMessage Flow\nThe following sequence diagram illustrates the flow of messages involved in a Business Application receiving a telemetry data message from Hono. The delivery mode used is AT LEAST ONCE.\n  Receive Telemetry Data    AMQP 1.0 Messaging Network delivers telemetry message to Business Application.  Business Application acknowledges reception of message.    Note The Business Application can only consume telemetry messages that have been uploaded to Hono after the Business Application has established the link with the AMQP 1.0 Messaging Network. This is because telemetry messages are not durable, i.e. they are not persisted in Hono in order to be forwarded at a later time.  Message Format\nThe format of the messages containing the telemetry data is the same as for the Upload Telemetry Data operation.\n"
},
{
	"uri": "https://www.eclipse.org/hono/docs/api/event/",
	"title": "Event API Specification",
	"tags": [],
	"description": "",
	"content": "The Event API is used by Protocol Adapters to send event messages downstream. Business Applications and other consumers use the API to receive messages published by devices belonging to a particular tenant.\nThe Event API is defined by means of AMQP 1.0 message exchanges, i.e. a client needs to connect to Hono using AMQP 1.0 in order to invoke operations of the API as described in the following sections. Throughout the remainder of this page we will simply use AMQP when referring to AMQP 1.0.\nSouthbound Operations The following operations can be used by Protocol Adapters to forward event messages received from devices to downstream consumers like Business Applications.\nForward Event Preconditions\n Adapter has established an AMQP connection with the AMQP Messaging Network. Adapter has established an AMQP link in role sender with the AMQP Messaging Network using target address event/${tenant_id} where ${tenant_id} is the ID of the tenant that the client wants to upload event messages for. The device for which the adapter wants to send an event has been registered (see Device Registration API).  Hono supports AT LEAST ONCE delivery of Event messages only. A client therefore MUST use unsettled for the snd-settle-mode and first for the rcv-settle-mode fields of its attach frame during link establishment. All other combinations are not supported by Hono and may result in the termination of the link or connection (depending on the configuration of the AMQP Messaging Network).\nThe AMQP messages used to forward events to the AMQP Messaging Network MUST have their durable property set to true. The AMQP Messaging Network is expected to write such messages to a persistent store before settling the transfer with the accepted outcome.\nMessage Flow\nThe following sequence diagram illustrates the flow of messages involved in the MQTT Adapter forwarding an event to the downstream AMQP Messaging Network.\n  Forward event flow    Device 4711 publishes an event using MQTT QoS 1.  MQTT Adapter transfers data to AMQP 1.0 Messaging Network. AMQP 1.0 Messaging Network acknowledges reception of the message. MQTT Adapter acknowledges the message published by the device.   When the AMQP Messaging Network fails to settle the transfer of an event message or settles the transfer with any other outcome than accepted, the protocol adapter MUST NOT try to re-send such rejected messages but MUST indicate the failed transfer to the device if the transport protocol provides means to do so.\nMessage Format\nSee Telemetry API for definition of message format.\nNorthbound Operations Receive Events Hono delivers messages containing events reported by a particular device in the same order that they have been received in (using the Forward Event operation defined above).\nHono supports multiple non-competing Business Application consumers of event messages for a given tenant. Hono allows each Business Application to have multiple competing consumers for event messages for a given tenant to share the load of processing the messages.\nPreconditions\n Client has established an AMQP connection with Hono. Client has established an AMQP link in role receiver with Hono using source address event/${tenant_id} where ${tenant_id} represents the ID of the tenant the client wants to retrieve event messages for.  Hono supports AT LEAST ONCE delivery of Event messages only. A client therefore MUST use unsettled for the snd-settle-mode and first for the rcv-settle-mode fields of its attach frame during link establishment. All other combinations are not supported by Hono and result in the termination of the link.\nMessage Flow\nThe following sequence diagram illustrates the flow of messages involved in a Business Application receiving an event data message from Hono.\n  Receive event data flow (success)    AMQP 1.0 Messaging Network delivers event message to Business Application.  Business Application acknowledges reception of message.   Message Format\nSee Telemetry API for definition of message format.\nWell-known Event Message Types Hono defines several well-known event types which have specific semantics. Events of these types are identified by means of the AMQP message\u0026rsquo;s content-type.\nEmpty Notification An AMQP message containing this type of event does not have any payload so the body of the message MUST be empty.\nThe AMQP 1.0 properties an event sender needs to set for an empty notification event are defined in the Telemetry API.\nThe relevant properties are listed again in the following table:\n   Name Mandatory Location Type Description     content-type yes properties symbol MUST be set to application/vnd.eclipse-hono-empty-notification   ttd no application-properties int The time \u0026lsquo;til disconnect as described in the Telemetry API.    NB: An empty notification can be used to indicate to a Business Application that a device is currently ready to receive an upstream message by setting the ttd property. Backend Applications may use this information to determine the time window during which the device will be able to receive a command.\nConnection Event Protocol Adapters may send this type of event to indicate that a connection with a device has been established or has ended. Note that such events can only be sent for authenticated devices, though, because an event is always scoped to a tenant and the tenant of a device is established as part of the authentication process.\nThe AMQP message for a connection event MUST contain the following properties in addition to the standard event properties:\n   Name Mandatory Location Type Description     content-type yes properties symbol Must be set to application/vnd.eclipse-hono-dc-notification+json   device_id yes application-properties string The ID of the authenticated device    Each connection event\u0026rsquo;s payload MUST contain a UTF-8 encoded string representation of a single JSON object with the following fields:\n   Name Mandatory Type Description     cause yes string The cause of the connection event. MUST be set to either connected or disconnected.   remote-id yes string An identifier of the device that is the subject of this event, e.g. an IP address:port, client id etc. The format and semantics of this identifier is specific to the protocol adapter and the transport protocol it supports.   source yes string The type name of the protocol adapter reporting the event, e.g. hono-mqtt.   data no object An arbitrary JSON object which may contain additional information about the occurrence of the event.    The example below might be used by the MQTT adapter to indicate that a connection with a device using client identifier mqtt-client-id-1 has been established:\n{ \u0026quot;cause\u0026quot;: \u0026quot;connected\u0026quot;, \u0026quot;remote-id\u0026quot;: \u0026quot;mqtt-client-id-1\u0026quot;, \u0026quot;source\u0026quot;: \u0026quot;hono-mqtt\u0026quot;, \u0026quot;data\u0026quot;: { \u0026quot;foo\u0026quot;: \u0026quot;bar\u0026quot; } } "
},
{
	"uri": "https://www.eclipse.org/hono/docs/api/command-and-control/",
	"title": "Command &amp; Control API Specification",
	"tags": [],
	"description": "",
	"content": "The Command \u0026amp; Control API of Eclipse Hono\u0026trade; is used by Business Applications to send commands to connected devices.\nCommands can be used to trigger actions on devices. Examples include updating a configuration property, installing a software component or switching the state of an actuator.\nHono distinguishes two types of commands. The first type is one-way only. In this case the sender of the command does not expect the device to send back a message in response to the command. This type of command is referred to as a one-way command in the remainder of this page. One-way commands may be used to e.g. notify a device about a change of state.\nThe second type of commands expects a response to be sent back from the device as a result of processing the command. In this case the response contains a status code which indicates whether the command could be processed successfully. If so, the response may also include data representing the result of processing the command. This type of command is plainly referred to as a command because it represents the default case.\nThe Command \u0026amp; Control API is defined by means of AMQP 1.0 message exchanges, i.e. a client needs to connect to Hono using AMQP 1.0 in order to invoke operations of the API as described in the following sections. Throughout the remainder of this page we will simply use AMQP when referring to AMQP 1.0.\nSend a One-Way Command Business Applications use this operation to send a command to a device for which they do not expect to receive a response from the device.\nPreconditions\n The Business Application has established an AMQP connection with the AMQP 1.0 Network. The Business Application has established an AMQP link in role sender with the target address command/${tenant_id}, where ${tenant_id} is the ID of the tenant that the device belongs to. This link is used by the Business Application to send command messages.  The following sequence diagram illustrates the establishment of the required link:\n  Application connecting to the AMQP 1.0 Messaging Network    Deprecation Previous versions of Hono required applications to\n use a sender link with target address control/${tenant_id}/${device_id} for sending one-ways commands to a specific device.  This link address can still be used but support for it will be removed in a future version of Hono! Newly built applications should only use the tenant scoped link as described above. Note that the deprecated link address also does not support sending commands to devices connected via a gateway.\n  Message Format\nThe following table provides an overview of the properties the Business Application needs to set on a one-way command message.\n   Name Mandatory Location Type Description     to yes properties string MUST contain the target address command/${tenant_id}/${device_id} of the message, where ${device_id} is the ID of the device to send the message to.   subject yes properties string The name of the command to be executed by the device.   content-type no properties string If present, MUST contain a Media Type as defined by RFC 2046 which describes the semantics and format of the command\u0026rsquo;s input data contained in the message payload. However, not all protocol adapters will support this property as not all transport protocols provide means to convey this information, e.g. MQTT 3.1.1 has no notion of message headers.   message-id no properties string An identifier that uniquely identifies the message at the sender side.    The command message MAY contain arbitrary payload to be sent to the device in a single AMQP Data section. The value of the message\u0026rsquo;s subject property may provide a hint to the device regarding the format, encoding and semantics of the payload data.\nHono indicates the outcome of the operation by means of the following AMQP delivery states:\n   Delivery State Description     accepted The command has been delivered to the device for processing.   released The command has not been delivered to the device because the device is (currently) not connected.   rejected The command has not been delivered to the device because it does not contain all required information.    Note that Hono relies on the particular protocol adapter to deliver commands to devices. Depending on the used transport protocol and the adapter\u0026rsquo;s implementation, the accepted outcome may thus indicate any of the following:\n An attempt has been made to deliver the command to the device. However, it is unclear if the device has received (or processed) the command. The device has acknowledged the reception of the command but has not processed the command yet. The device has received and processed the command.  Examples\nThe following sequence diagram shows the successful delivery of a one-way command called switchOn to device 4711 of the DEFAULT_TENANT:\n  Successfully send a One-Way Command   The following sequence diagram shows how the delivery of the same one-way command fails because the device is not connected:\n  Device not connected   The following sequence diagram illustrates how a malformed command sent by a Business Application gets rejected:\n  Malformed Command message   Send a (Request/Response) Command Business Applications use this operation to send a command to a device for which they expect the device to send back a response.\n\nPreconditions\n The Business Application has established an AMQP connection with the AMQP 1.0 Network. The Business Application has established an AMQP link in role sender with the target address command/${tenant_id}, where ${tenant_id} is the ID of the tenant that the device belongs to. This link is used by the Business Application to send command messages. The Business Application has established an AMQP link in role receiver with the source address command_response/${tenant_id}/${reply_id}. This link is used by the Business Application to receive the response to the command from the device. This link’s source address is also used as the reply-to address for the request messages. The ${reply_id} may be any arbitrary string chosen by the application.  The following sequence diagram illustrates the establishment of the required links:\n  Application connecting to the AMQP 1.0 Messaging Network    Deprecation Previous versions of Hono required applications to\n use a sender link with target address control/${tenant_id}/${device_id} for sending commands to a specific device and use a receiver link with source address control/${tenant_id}/${device_id}/{reply_id} for receiving command responses from a device.  These link addresses can still be used but support for them will be removed in a future version of Hono! Newly built applications should only use the tenant scoped links as described above. Note that the deprecated link addresses also do not support sending commands to devices connected via a gateway.\n  Command Message Format\nThe following table provides an overview of the properties the Business Application needs to set on a command message.\n   Name Mandatory Location Type Description     to yes properties string MUST contain the target address command/${tenant_id}/${device_id} of the message, where ${device_id} is the ID of the device to send the message to.   subject yes properties string MUST contain the command name to be executed by a device.   content-type no properties string If present, MUST contain a Media Type as defined by RFC 2046 which describes the semantics and format of the command\u0026rsquo;s input data contained in the message payload. However, not all protocol adapters will support this property as not all transport protocols provide means to convey this information, e.g. MQTT 3.1.1 has no notion of message headers.   correlation-id no properties string MAY contain an ID used to correlate a response message to the original request. If set, it is used as the correlation-id property in the response, otherwise the value of the message-id property is used. Either this or the message-id property MUST be set.   message-id no properties string MAY contain an identifier that uniquely identifies the message at the sender side. Either this or the correlation-id property MUST be set.   reply-to yes properties string MUST contain the source address that the application expects to receive the response from. This address MUST be the same as the source address used for establishing the client\u0026rsquo;s receiver link (see Preconditions above).    The command message MAY contain arbitrary payload to be sent to the device in a single AMQP Data section. The value of the command message\u0026rsquo;s subject value may provide a hint to the device regarding the format, encoding and semantics of the payload data.\nHono uses following AMQP delivery states to indicate the outcome of sending the command to the device:\n   Delivery State Description     accepted The command has been delivered to the device for processing.   released The command has not been delivered to the device because the device is (currently) not connected.   rejected The command has not been delivered to the device because it does not contain all required information.    Note that Hono relies on the particular protocol adapter to deliver commands to devices. Depending on the used transport protocol and the adapter\u0026rsquo;s implementation, the accepted outcome may thus indicate any of the following:\n An attempt has been made to deliver the command to the device. However, it is unclear if the device has received (or processed) the command. The device has acknowledged the reception of the command but has not processed the command yet.  An application can determine the overall outcome of the operation by means of the response to the command that is sent back by the device. An application should consider execution of a command to have failed, if it does not receive a response within a reasonable amount of time.\nResponse Message Format\nThe following table provides an overview of the properties set on a message sent in response to a command.\n   Name Mandatory Location Type Description     content-type no properties string If present, MUST contain a Media Type as defined by RFC 2046 which describes the semantics and format of the command\u0026rsquo;s input data contained in the message payload. However, not all protocol adapters will support this property as not all transport protocols provide means to convey this information, e.g. MQTT 3.1.1 has no notion of message headers.   correlation-id yes properties string MUST contain the correlation ID used to match the command message with the response message containing the result of execution on the device.   device_id yes application-properties string The identifier of the device that sent the response.   status yes application-properties integer MUST indicate the status of the execution. See table below for possible values.   tenant_id yes application-properties string The identifier of the tenant that the device belongs to.    The status property must contain an HTTP 1.1 response status code:\n   Code Description     2xx The command has been processed successfully.   4xx The command could not be processed due to a client error, e.g. malformed message payload.   5xx The command could not be processed due to an internal problem at the device side.    The semantics of the individual codes are specific to the device and command. For status codes indicating an error (codes in the 400 - 599 range) the message body MAY contain a detailed description of the error that occurred.\nIf a command message response contains a payload, the body of the message MUST consist of a single AMQP Data section containing the response message data.\nExamples\nThe following sequence diagram illustrates how a Business Application sends a command called getReading to device 4711 of the DEFAULT_TENANT and receives a response from the device:\n  Successfully send a Command   The sending of a command may fail for the same reasons as those illustrated for sending a one-way command. Additionally, the sending of a command may be considered unsuccessful by an application if it does not receive the response from the device in a reasonable amount of time:\n  Command times out  "
},
{
	"uri": "https://www.eclipse.org/hono/docs/api/tenant/",
	"title": "Tenant API Specification",
	"tags": [],
	"description": "",
	"content": "The Tenant API is used by Hono\u0026rsquo;s protocol adapters to retrieve information that affects all devices belonging to a particular tenant. A tenant is a logical entity, which groups together a set of devices. The information registered for a tenant is used for example to determine if devices belonging to the tenant are allowed to connect to a certain protocol adapter or if devices are required to authenticate.\nThis document describes the Tenant API\u0026rsquo;s operations and the payload data format used by them. Please refer to Multi Tenancy for details regarding the way Hono supports multiple tenants.\nThe Tenant API is defined by means of AMQP 1.0 message exchanges, i.e. a client needs to connect to Hono using an AMQP 1.0 client in order to invoke operations of the API as described in the following sections.\n\nPreconditions for invoking the Tenant API  Client has established an AMQP connection with the Tenant service. Client has established an AMQP link in role sender on the connection using target address tenant. This link is used by the client to send request messages to the Tenant service. Client has established an AMQP link in role receiver on the connection using source address tenant/${reply-to} where reply-to may be any arbitrary string chosen by the client. This link is used by the client to receive responses to the requests it has sent to the Tenant service. This link\u0026rsquo;s source address is also referred to as the reply-to address for the request messages.    Client connecting to Tenant service   Get Tenant Information Clients use this operation to retrieve information about a tenant.\nMessage Flow\nThe following sequence diagram illustrates the flow of messages involved in a Client retrieving tenant information.\n  Client retrieving tenant information   Request Message Format\nThe following table provides an overview of the properties a client needs to set on a message to get tenant information:\n   Name Mandatory Location AMQP Type Description     correlation-id no properties message-id MAY contain an ID used to correlate a response message to the original request. If set, it is used as the correlation-id property in the response, otherwise the value of the message-id property is used. Either this or the message-id property MUST be set.   message-id no properties string MAY contain an identifier that uniquely identifies the message at the sender side. Either this or the correlation-id property MUST be set.   reply-to yes properties string MUST contain the source address that the client wants to receive response messages from. This address MUST be the same as the source address used for establishing the client\u0026rsquo;s receive link (see Preconditions).   subject yes properties string MUST be set to get.    The body of the request message MUST consist of a single Data section containing a UTF-8 encoded string representation of a single JSON object.\nThe JSON object MUST contain exactly one of the following search criteria properties:\n   Name Mandatory JSON Type Description     subject-dn no string The subject DN of the trusted certificate authority\u0026rsquo;s public key in the format defined by RFC 2253.   tenant-id no string The identifier of the tenant to get.    The following request payload may be used to look up the tenant with identifier ACME Corporation:\n{ \u0026quot;tenant-id\u0026quot;: \u0026quot;ACME Corporation\u0026quot; }  The following request payload may be used to look up the tenant for which a trusted certificate authority with subject DN O=ACME Corporation, CN=devices has been configured:\n{ \u0026quot;subject-dn\u0026quot;: \u0026quot;CN=devices,O=ACME Corporation\u0026quot; }  Response Message Format\nThe following table provides an overview of the properties contained in a response message to a get tenant information request:\n   Name Mandatory Location AMQP Type Description     correlation-id yes properties message-id Contains the message-id (or the correlation-id, if specified) of the request message that this message is the response to.   content-type no properties string MUST be set to application/json if the invocation of the operation was successful and the body of the response message contains payload as described below.   status yes application-properties int Contains the status code indicating the outcome of the operation. Concrete values and their semantics are defined for each particular operation.   cache_control no application-properties string Contains an RFC 2616 compliant cache directive. The directive contained in the property MUST be obeyed by clients that are caching responses.    The response message\u0026rsquo;s status property may contain the following codes:\n   Code Description     200 OK, The response message body contains the requested tenant information.   400 Bad Request, the request message did not contain all mandatory properties.   403 Forbidden, the client is not authorized to retrieve information for the given tenant.   404 Not Found, there is no tenant matching the given search criteria.    For status codes indicating an error (codes in the 400 - 499 range) the message body MAY contain a detailed description of the error that occurred. In this case, the response message\u0026rsquo;s content-type property SHOULD be set accordingly.\nOtherwise the response message contains the information for the requested tenant as described in the following sections.\n\nTenant Information Format Tenant information is carried in a single Data section of the response message as a UTF-8 encoded string representation of a single JSON object. It is an error to include payload that is not of this type.\nThe table below provides an overview of the standard members defined for the JSON response object:\n   Name Mandatory JSON Type Description     adapters no array A list of configuration options valid for certain adapters only. The format of a configuration option is described here Adapter Configuration Format. NB If the element is provided then the list MUST NOT be empty. NB Only a single entry per type is allowed. If multiple entries for the same type are present it is handled as an error. NB If the element is omitted then all adapters are enabled in their default configuration.   defaults no object Arbitrary default properties for devices belonging to the tenant. The properties can be used by protocol adapters to augment downstream messages with missing information, e.g. setting a default content type or time-to-live.   enabled yes boolean If set to false the tenant is currently disabled. Protocol adapters MUST NOT allow devices of a disabled tenant to connect and MUST NOT accept data published by such devices.   minimum-message-size no number The minimum message size in bytes. If it is set then the payload size of the telemetry, event and command messages are calculated in accordance with the configured value and then reported to the metrics. See Metrics for more details.   resource-limits no object Any resource limits that should be enforced for the tenant, e.g. the maximum number of concurrent connections and the maximum data volume for a given period. Refer to Resource Limits Configuration Format for details.   tenant-id yes string The ID of the tenant.   tracing no object A set of options regarding the tracing of messages for the tenant. See Tracing Format for a definition of the content model of the object.   trusted-ca no object The trusted certificate authority to use for validating certificates presented by devices of the tenant for authentication purposes. See Trusted Certificate Authority Format for a definition of the content model of the object.    The JSON object MAY contain an arbitrary number of additional members with arbitrary names which can be of a scalar or a complex type. This allows for future well-known additions and also allows to add further information which might be relevant to a custom adapter only.\nExamples\nThe JSON structure below contains example information for tenant TEST_TENANT. Note that the structure contains some custom properties at both the root level (customer) as well as the adapter configuration level (deployment) and also defines a default TTL for downstream messages.\n{ \u0026quot;tenant-id\u0026quot; : \u0026quot;TEST_TENANT\u0026quot;, \u0026quot;defaults\u0026quot;: { \u0026quot;ttl\u0026quot;: 30 }, \u0026quot;enabled\u0026quot; : true, \u0026quot;customer\u0026quot;: \u0026quot;ACME Inc.\u0026quot;, \u0026quot;resource-limits\u0026quot;: { \u0026quot;max-connections\u0026quot;: 100000, \u0026quot;data-volume\u0026quot;: { \u0026quot;max-bytes\u0026quot;: 2147483648, \u0026quot;period-in-days\u0026quot;: 30, \u0026quot;effective-since\u0026quot;: \u0026quot;2019-04-27\u0026quot; } }, \u0026quot;adapters\u0026quot; : [ { \u0026quot;type\u0026quot; : \u0026quot;hono-mqtt\u0026quot;, \u0026quot;enabled\u0026quot; : true, \u0026quot;device-authentication-required\u0026quot; : true }, { \u0026quot;type\u0026quot; : \u0026quot;hono-http\u0026quot;, \u0026quot;enabled\u0026quot; : true, \u0026quot;device-authentication-required\u0026quot; : true, \u0026quot;deployment\u0026quot;: { \u0026quot;maxInstances\u0026quot;: 4 } } ] }  Tracing Format The table below provides an overview of the members defined for the tracing JSON object:\n   Name Mandatory Type Default Value Description     sampling-mode no string default Defines in how far OpenTracing spans created when processing messages for this tenant shall be recorded (sampled) by the tracing system. The value default lets the default sampling mechanism be used. The value all marks the spans related to this tenant so that they should all be sampled. The value none marks the spans as not to be sampled. The mode defined here may be overridden for a particular auth-id by means of the sampling-mode-per-auth-id property.   sampling-mode-per-auth-id no object  Defines in how far OpenTracing spans created when processing messages for this tenant and a particular auth-id shall be recorded (sampled) by the tracing system. The child properties have the auth-id as name. A child property value of default lets the default sampling mechanism be used. The child property value all marks the spans related to this tenant and the auth-id so that they should all be sampled. The child property value none marks the spans as not to be sampled. The mode defined for a particular auth-id has precedence over the value defined by the sampling-mode property.    Trusted CA Format The table below provides an overview of the members defined for the trusted-ca JSON object:\n   Name Mandatory Type Default Value Description     subject-dn yes string  The subject DN of the trusted root certificate in the format defined by RFC 2253.   cert no string  The Base64 encoded binary DER encoding of the trusted root X.509 certificate.   public-key no string  The Base64 encoded binary DER encoding of the trusted root certificate\u0026rsquo;s public key.   algorithm no string RSA The name of the public key algorithm. Supported values are RSA and EC. This property is ignored if the cert property is used to store a certificate.     The subject-dn MUST be unique among all registered tenants. Either the cert or the public-key MUST be set.  Adapter Configuration Format The table below contains the properties which are used to configure a Hono protocol adapter:\n   Name Mandatory JSON Type Default Value Description     type yes string - The type of the adapter which this configuration belongs to.   enabled no boolean false If set to false the tenant is not allowed to receive / send data utilizing the given adapter.   device-authentication-required no boolean true If set to false, devices are not required to authenticate with the adapter before sending / receiving data.    Protocol adapters SHOULD use the configuration properties set for a tenant when interacting with devices of that tenant, e.g. in order to make authorization decisions etc.\nThe JSON object MAY contain an arbitrary number of additional members with arbitrary names of either scalar or complex type. This allows for future well-known additions and also allows to add further information which might be relevant to a custom adapter only.\nResource Limits Configuration Format The table below contains the properties which are used to configure a tenant\u0026rsquo;s resource limits:\n   Name Mandatory JSON Type Default Value Description     max-connections no number -1 The maximum number of concurrent connections allowed from devices of this tenant. The default value -1 indicates that no limit is set.   data-volume no object - The maximum data volume allowed for the given tenant. Refer to Data Volume Configuration Format for details.    Protocol adapters SHOULD use the max-connections property to determine if a device\u0026rsquo;s connection request should be accepted or rejected.\nThe JSON object MAY contain an arbitrary number of additional members with arbitrary names of either scalar or complex type. This allows for future well-known additions and also allows to add further information which might be relevant to a custom adapter only.\nData Volume Configuration Format The table below contains the properties which are used to configure a tenant\u0026rsquo;s data volume limit:\n   Name Mandatory JSON Type Default Value Description     max-bytes no number -1 The maximum number of bytes allowed for the tenant for each accounting period. MUST be an integer. A negative value indicates that no limit is set.   period-in-days no number 30 The length of an accounting period, i.e. the number of days over which the data usage is to be limited. MUST be a positive integer.   effective-since yes string - The point in time at which the current settings became effective, i.e. the start of the first accounting period based on these settings. The value MUST be an ISO 8601 compliant combined date and time representation in extended format.    Protocol adapters SHOULD use this information to determine if a message originating from or destined to a device should be accepted for processing.\nDelivery States used by the Tenant API A Tenant service implementation uses the following AMQP message delivery states when receiving request messages from clients:\n   Delivery State Description     ACCEPTED Indicates that the request message has been received and accepted for processing.   REJECTED Indicates that the request message has been received but cannot be processed. The disposition frame\u0026rsquo;s error field contains information regarding the reason why. Clients should not try to re-send the request using the same message properties and payload in this case.   "
},
{
	"uri": "https://www.eclipse.org/hono/docs/api/device-connection/",
	"title": "Device Connection API Specification",
	"tags": [],
	"description": "",
	"content": "The Device Connection API is used by Protocol Adapters to set and retrieve information about the connections from devices or gateways to the protocol adapters.\nThe Device Connection API is defined by means of AMQP 1.0 message exchanges, i.e. a client needs to connect to Hono using an AMQP 1.0 client in order to invoke operations of the API as described in the following sections.\n\nPreconditions for invoking the Device Connection API  Client has established an AMQP connection with the Device Connection service. Client has established an AMQP link in role sender on the connection using target address device_con/${tenant_id}. This link is used by the client to send commands concerning device connections to Hono. Client has established an AMQP link in role receiver on the connection using source address device_con/${tenant_id}/${reply-to} where reply-to may be any arbitrary string chosen by the client. This link is used by the client to receive responses to the requests it has sent to the Device Connection service. This link\u0026rsquo;s source address is also referred to as the reply-to address for the request messages.    Client connecting to Device Connection service   Set last known Gateway for Device Clients use this command to set the gateway that last acted on behalf of a given device.\nAs this operation is invoked frequently by Hono\u0026rsquo;s components, implementors may choose to keep this information in memory. This API doesn\u0026rsquo;t mandate checks on the validity of the given device or gateway IDs in order not to introduce a dependency on the Device Registration API. However, implementations of this API may choose to perform such checks or impose a restriction on the overall amount of data that can be stored per tenant in order to protect against malicious requests.\nMessage Flow\n  Client sets the last known gateway for a device   Request Message Format\nThe following table provides an overview of the properties a client needs to set on a message to set the last known gateway for a device in addition to the Standard Request Properties.\n   Name Mandatory Location AMQP Type Description     subject yes properties string MUST be set to set-last-gw.   gateway_id yes application-properties string The identifier of the gateway that last acted on behalf of the device identified by the device_id property. If a device connects directly instead of through a gateway, the device\u0026rsquo;s identifier MUST be specified here.    The body of the message SHOULD be empty and will be ignored if it is not.\nResponse Message Format\nA response to a set last known gateway for device request contains the Standard Response Properties.\nThe response message\u0026rsquo;s status property may contain the following codes:\n   Code Description     204 OK, the last known gateway for the device has been updated.   400 Bad Request, the last known gateway has not been updated due to invalid or missing data in the request.    Implementors of this API may return a 404 status code in order to indicate that no device and/or gateway with the given identifier exists for the given tenant. However, performing such a check is optional.\nFor status codes indicating an error (codes in the 400 - 499 range) the message body MAY contain a detailed description of the error that occurred.\nGet last known Gateway for Device Clients use this command to retrieve the gateway that last acted on behalf of a given device.\nMessage Flow\n  Client retrieving the last known gateway for a device   Request Message Format\nThe following table provides an overview of the properties a client needs to set on a message to retrieve the last known gateway for a device in addition to the Standard Request Properties.\n   Name Mandatory Location AMQP Type Description     subject yes properties string MUST be set to get-last-gw.    The body of the message SHOULD be empty and will be ignored if it is not.\nResponse Message Format\nA response to a get last known gateway for device request contains the Standard Response Properties as well as the properties shown in the following table:\n   Name Mandatory Location AMQP Type Description     content-type no properties string MUST be set to application/json if the invocation of the operation was successful and the body of the response message contains payload as described below.    The result of a successful invocation is carried in a single Data section of the response message as a UTF-8 encoded string representation of a single JSON object. It is an error to include payload that is not of this type.\nThe response message JSON object has the following properties:\n   Name Mandatory JSON Type Description     gateway-id yes string The ID of the last known gateway for the device.   last-updated no string The date that the information about the last known gateway for the device was last updated. The value MUST be an ISO 8601 compliant combined date and time representation in extended format.    The response message\u0026rsquo;s status property may contain the following codes:\n   Code Description     200 OK, the payload contains the gateway ID.   400 Bad Request, the request message does not contain all required information/properties.   404 Not Found, there is no last known gateway assigned to the device.    Implementors of this API may return a 404 status code in order to indicate that no device with the given identifier exists for the given tenant. However, performing such a check is optional.\nFor status codes indicating an error (codes in the 400 - 499 range) the message body MAY contain a detailed description of the error that occurred.\nStandard Message Properties Due to the nature of the request/response message pattern of the operations of the Device Connection API, there are some standard properties shared by all of the request and response messages exchanged as part of the operations.\nStandard Request Properties The following table provides an overview of the properties shared by all request messages regardless of the particular operation being invoked.\n   Name Mandatory Location AMQP Type Description     subject yes properties string MUST be set to the value defined by the particular operation being invoked.   correlation-id no properties message-id MAY contain an ID used to correlate a response message to the original request. If set, it is used as the correlation-id property in the response, otherwise the value of the message-id property is used. Either this or the message-id property MUST be set.   message-id no properties string MAY contain an identifier that uniquely identifies the message at the sender side. Either this or the correlation-id property MUST be set.   reply-to yes properties string MUST contain the source address that the client wants to received response messages from. This address MUST be the same as the source address used for establishing the client\u0026rsquo;s receive link (see Preconditions).   device_id yes application-properties string MUST contain the ID of the device that is subject to the operation.    Standard Response Properties The following table provides an overview of the properties shared by all response messages regardless of the particular operation being invoked.\n   Name Mandatory Location AMQP Type Description     correlation-id yes properties message-id Contains the message-id (or the correlation-id, if specified) of the request message that this message is the response to.   status yes application-properties int Contains the status code indicating the outcome of the operation. Concrete values and their semantics are defined for each particular operation.   cache_control no application-properties string Contains an RFC 2616 compliant cache directive. The directive contained in the property MUST be obeyed by clients that are caching responses.    Delivery States Hono uses the following AMQP message delivery states when receiving request messages from clients:\n   Delivery State Description     ACCEPTED Indicates that the request message has been received and accepted for processing.   REJECTED Indicates that Hono has received the request but was not able to process it. The error field contains information regarding the reason why. Clients should not try to re-send the request using the same message properties in this case.   "
},
{
	"uri": "https://www.eclipse.org/hono/docs/api/device-registration/",
	"title": "Device Registration API Specification",
	"tags": [],
	"description": "",
	"content": "The Device Registration API is used by Hono\u0026rsquo;s protocol adapters to get information about devices connecting to the adapters.\nThe Device Registration API is defined by means of AMQP 1.0 message exchanges, i.e. a client needs to connect to Hono using an AMQP 1.0 client in order to invoke operations of the API as described in the following sections.\n\nPreconditions for invoking the Device Registration API  Client has established an AMQP connection with the Device Registration service. Client has established an AMQP link in role sender on the connection using target address registration/${tenant_id}. This link is used by the client to send request messages to the Device Registration service. Client has established an AMQP link in role receiver on the connection using source address registration/${tenant_id}/${reply-to} where reply-to may be any arbitrary string chosen by the client. This link is used by the client to receive responses to the requests it has sent to the Device Registration service. This link\u0026rsquo;s source address is also referred to as the reply-to address for the request messages.    Client connecting to Device Registration service   Assert Device Registration Clients use this command to verify that a device is registered for a particular tenant and is enabled.\nMessage Flow\nThe following sequence diagram illustrates the flow of messages involved in a Client asserting a device\u0026rsquo;s registration status.\n  Client asserting a device\u0026#39;s registration status   Request Message Format\nThe following table provides an overview of the properties a client needs to set on a message to assert a device\u0026rsquo;s registration status:\n   Name Mandatory Location AMQP Type Description     correlation-id no properties message-id MAY contain an ID used to correlate a response message to the original request. If set, it is used as the correlation-id property in the response, otherwise the value of the message-id property is used. Either this or the message-id property MUST be set.   device_id yes application-properties string MUST contain the ID of the device that is subject to the operation.   gateway_id no application-properties string The identifier of the gateway that wants to get an assertion on behalf of another device (given in the device_id property).\nAn implementation SHOULD verify that the gateway exists, is enabled and is authorized to get an assertion for, and thus send data on behalf of, the device.   message-id no properties string MAY contain an identifier that uniquely identifies the message at the sender side. Either this or the correlation-id property MUST be set.   reply-to yes properties string MUST contain the source address that the client wants to received response messages from. This address MUST be the same as the source address used for establishing the client\u0026rsquo;s receive link (see Preconditions).   subject yes properties string MUST be set to assert.    The body of the message SHOULD be empty and will be ignored if it is not.\nResponse Message Format\nThe following table provides an overview of the properties contained in a response message to an assert request:\n   Name Mandatory Location AMQP Type Description     correlation-id yes properties message-id Contains the message-id (or the correlation-id, if specified) of the request message that this message is the response to.   content-type no properties string MUST be set to application/json if the invocation of the operation was successful and the body of the response message contains payload as described below.   status yes application-properties int Contains the status code indicating the outcome of the operation. Concrete values and their semantics are defined below.   cache_control no application-properties string Contains an RFC 2616 compliant cache directive. The directive contained in the property MUST be obeyed by clients that are caching responses.    In case of a successful invocation of the operation, the body of the response message consists of a single Data section containing a UTF-8 encoded string representation of a single JSON object having the following properties:\n   Name Mandatory JSON Type Description     device-id yes string The ID of the device that is subject of the assertion.   via no array The IDs (JSON strings) of gateways which may act on behalf of the device. This property MUST be set if any gateways are registered for the device. If the assertion request contained a gateway_id property and the response\u0026rsquo;s status property has value 200 (indicating a successful assertion) then the array MUST at least contain the gateway ID from the request.   defaults no object Default values to be used by protocol adapters for augmenting messages from devices with missing information like a content type. It is up to the discretion of a protocol adapter if and how to use the given default values when processing messages published by the device.    Below is an example for a payload of a response to an assert request for device 4711 which also includes a default content-type:\n{ \u0026quot;device-id\u0026quot; : \u0026quot;4711\u0026quot;, \u0026quot;via\u0026quot;: [\u0026quot;4712\u0026quot;], \u0026quot;defaults\u0026quot;: { \u0026quot;content-type\u0026quot;: \u0026quot;application/vnd.acme+json\u0026quot; } }  The response message\u0026rsquo;s status property may contain the following codes:\n   Code Description     200 OK, the device is registered for the given tenant and is enabled. The response message body contains the asserted device\u0026rsquo;s registration status.   400 Bad Request, the request message did not contain all mandatory properties.   403 Forbidden, the gateway with the given gateway id either does not exist, is not enabled or is not authorized to get an assertion for the device with the given device id.   404 Not Found, there is no device registered with the given device id within the given tenant id or the device is not enabled.    For status codes indicating an error (codes in the 400 - 499 range) the message body MAY contain a detailed description of the error that occurred. In this case, the response message\u0026rsquo;s content-type property SHOULD be set accordingly.\nDelivery States The Device Registration service uses the following AMQP message delivery states when receiving request messages from clients:\n   Delivery State Description     ACCEPTED Indicates that the request message has been received and accepted for processing.   REJECTED Indicates that the request message has been received but cannot be processed. The disposition frame\u0026rsquo;s error field contains information regarding the reason why. Clients should not try to re-send the request using the same message properties in this case.   "
},
{
	"uri": "https://www.eclipse.org/hono/docs/api/credentials/",
	"title": "Credentials API Specification",
	"tags": [],
	"description": "",
	"content": "The Credentials API is used by Protocol Adapters to retrieve credentials used to authenticate Devices connecting to the adapter. In particular, the API supports the look up shared secrets which are often used by IoT devices by means of username/password based authentication schemes.\nCredentials are of a certain type which indicates which authentication mechanism the credentials can be used with. Each set of credentials also contains an authentication identity which is the identity claimed by the device during authentication. This authentication identity is usually different from the device-id the device has been registered under. A device may have multiple sets of credentials, using arbitrary authentication identities.\nThe Credentials API is defined by means of AMQP 1.0 message exchanges, i.e. a client needs to connect to Hono using an AMQP 1.0 client in order to invoke operations of the API as described in the following sections.\n\nPreconditions for invoking the Credentials API  Client has established an AMQP connection with the Credentials service. Client has established an AMQP link in role sender on the connection using target address credentials/${tenant_id}. This link is used by the client to send commands to the Credentials service. Client has established an AMQP link in role receiver on the connection using source address credentials/${tenant_id}/${reply-to} where reply-to may be any arbitrary string chosen by the client. This link is used by the client to receive responses to the requests it has sent to the Credentials service. This link\u0026rsquo;s source address is also referred to as the reply-to address for the request messages.    Client connecting to Credentials service   Get Credentials Protocol adapters use this command to look up credentials of a particular type for a device identity.\nMessage Flow\n  Client looking up credentials for a device   Request Message Format\nThe following table provides an overview of the properties a client needs to set on an get credentials message.\n   Name Mandatory Location AMQP Type Description     correlation-id no properties message-id MAY contain an ID used to correlate a response message to the original request. If set, it is used as the correlation-id property in the response, otherwise the value of the message-id property is used. Either this or the message-id property MUST be set.   message-id no properties string MAY contain an identifier that uniquely identifies the message at the sender side. Either this or the correlation-id property MUST be set.   reply-to yes properties string MUST contain the source address that the client wants to receive response messages from. This address MUST be the same as the source address used for establishing the client\u0026rsquo;s receive link (see Preconditions).   subject yes properties string MUST contain the value get.    The body of the request MUST consist of a single Data section containing a UTF-8 encoded string representation of a single JSON object having the following members:\n   Name Mandatory JSON Type Description     type yes string The type of credentials to look up. Potential values include (but are not limited to) psk, x509-cert, hashed-password etc.   auth-id yes string The authentication identifier to look up credentials for.    Additionally, the body MAY contain arbitrary properties that service implementations can use to determine a device\u0026rsquo;s identity.\nThe following request payload may be used to look up the hashed password for a device with the authentication identifier sensor1:\n{ \u0026quot;type\u0026quot;: \u0026quot;hashed-password\u0026quot;, \u0026quot;auth-id\u0026quot;: \u0026quot;sensor1\u0026quot; }  Response Message Format\nA response to a get credentials request contains the following properties:\n   Name Mandatory Location AMQP Type Description     correlation-id yes properties message-id Contains the message-id (or the correlation-id, if specified) of the request message that this message is the response to.   content-type no properties string MUST be set to application/json if the invocation of the operation was successful and the body of the response message contains payload as described below.   status yes application-properties int Contains the status code indicating the outcome of the operation. Concrete values and their semantics are defined below.   cache_control no application-properties string Contains an RFC 2616 compliant cache directive. The directive contained in the property MUST be obeyed by clients that are caching responses.    The response message payload MUST contain credential information as defined in Credentials Format if the status is 200.\nThe response message\u0026rsquo;s status property may contain the following codes:\n   Code Description     200 OK, the payload contains the credentials for the authentication identifier.   400 Bad Request, the request message did not contain all mandatory properties.   404 Not Found, there are no credentials registered matching the criteria.    For status codes indicating an error (codes in the 400 - 499 range) the message body MAY contain a detailed description of the error that occurred. In this case, the response message\u0026rsquo;s content-type property SHOULD be set accordingly.\nDelivery States The Credentials service uses the following AMQP message delivery states when receiving request messages from clients:\n   Delivery State Description     ACCEPTED Indicates that the request message has been received and accepted for processing.   REJECTED Indicates that the request message has been received but cannot be processed. The disposition frame\u0026rsquo;s error field contains information regarding the reason why. Clients should not try to re-send the request using the same message properties in this case.    Credentials Format Credential data is carried in the body of an AMQP message as part of a single Data section. The message\u0026rsquo;s content-type property must be set to application/json.\nThe credential data is contained in the Data section as a UTF-8 encoded string representation of a single JSON object. It is an error to include payload that is not of this type.\nThe table below provides an overview of the standard members defined for the JSON object:\n   Name Mandatory JSON Type Default Value Description     device-id yes string  The ID of the device to which the credentials belong.   type yes string  The credential type name. The value may be arbitrarily chosen by clients but SHOULD reflect the particular type of authentication mechanism the credentials are to be used with. Possible values include (but are not limited to) psk, x509-cert, hashed-password etc.   auth-id yes string  The identity that the device should be authenticated as.   enabled no boolean true If set to false the credentials are not supposed to be used to authenticate devices any longer. This may e.g. be used to disable a particular mechanism for authenticating the device. NB It is the responsibility of the protocol adapter to make use of this information.   secrets yes array  A list of secrets scoped to a particular time period. See Secrets Format for details. NB This array must contain at least one element - an empty array is considered an error.    For each set of credentials the combination of auth-id and type MUST be unique within a tenant.\nThe device registry may choose to not return information which is not suitable for authentication a device. This includes for example the enabled property. If set to false, then the device registry may choose to treat this request as if no credentials would be found. For secrets for example, this could mean that the device registry does not return secrets which are not valid at the current point in time.\nNB Care needs to be taken that the value for the authentication identifier is compliant with the authentication mechanism(s) it is supposed to be used with. For example, when using standard HTTP Basic authentication, the username part of the Basic Authorization header value (which corresponds to the auth-id) MUST not contain any colon (:) characters, because the colon character is used as the separator between username and password. Similar constraints may exist for other authentication mechanisms, so the authentication identifier needs to be chosen with the anticipated mechanism(s) being used in mind. Otherwise, devices may fail to authenticate with protocol adapters, even if the credentials provided by the device match the credentials registered for the device. In general, using only characters from the [a-zA-Z0-9_-] range for the authentication identifier should be compatible with most mechanisms.\nSecrets Format Each set of credentials may contain arbitrary secrets scoped to a particular validity period during which the secrets may be used for authenticating a device. The validity periods MAY overlap in order to support the process of changing a secret on a device that itself doesn\u0026rsquo;t support the definition of multiple secrets for gapless authentication across adjacent validity periods.\nThe table below contains the properties used to define the validity period of a single secret:\n   Name Mandatory JSON Type Default Value Description     not-before no string null The point in time from which on the secret may be used to authenticate devices. If not null, the value MUST be an ISO 8601 compliant combined date and time representation in extended format. NB It is up to the discretion of the protocol adapter to make use of this information.   not-after no string null The point in time until which the secret may be used to authenticate devices. If not null, the value MUST be an ISO 8601 compliant combined date and time representation in extended format. NB It is up to the discretion of the protocol adapter to make use of this information.    Examples Below is an example for a payload containing a hashed password for device 4711 with auth-id sensor1 using SHA512 as the hashing function with a 4 byte salt (Base64 encoding of 0x32AEF017). Note that the payload does not contain a not-before property, thus it may be used immediately up until X-mas eve 2017.\n{ \u0026quot;device-id\u0026quot;: \u0026quot;4711\u0026quot;, \u0026quot;type\u0026quot;: \u0026quot;hashed-password\u0026quot;, \u0026quot;auth-id\u0026quot;: \u0026quot;sensor1\u0026quot;, \u0026quot;enabled\u0026quot;: true, \u0026quot;secrets\u0026quot;: [{ \u0026quot;not-after\u0026quot;: \u0026quot;2017-12-24T19:00:00+0100\u0026quot;, \u0026quot;pwd-hash\u0026quot;: \u0026quot;AQIDBAUGBwg=\u0026quot;, \u0026quot;salt\u0026quot;: \u0026quot;Mq7wFw==\u0026quot;, \u0026quot;hash-function\u0026quot;: \u0026quot;sha-512\u0026quot; }] }  The next example contains two pre-shared keys with overlapping validity periods for device myDevice with PSK identity little-sensor2.\n{ \u0026quot;device-id\u0026quot;: \u0026quot;myDevice\u0026quot;, \u0026quot;type\u0026quot;: \u0026quot;psk\u0026quot;, \u0026quot;auth-id\u0026quot;: \u0026quot;little-sensor2\u0026quot;, \u0026quot;enabled\u0026quot;: true, \u0026quot;secrets\u0026quot;: [{ \u0026quot;not-after\u0026quot;: \u0026quot;2017-07-01T00:00:00+0100\u0026quot;, \u0026quot;key\u0026quot;: \u0026quot;cGFzc3dvcmRfb2xk\u0026quot; },{ \u0026quot;not-before\u0026quot;: \u0026quot;2017-06-29T00:00:00+0100\u0026quot;, \u0026quot;key\u0026quot;: \u0026quot;cGFzc3dvcmRfbmV3\u0026quot; }] }  Credential Verification Protocol Adapters are responsible for authenticating devices when they connect. The Credentials API provides the Get Credentials operation to support Protocol Adapters in doing so as illustrated below:\nThe following sequence diagram illustrates the flow of messages involved in a Protocol Adapter authenticating a device. This is shown for the MQTT Protocol Adapter as example how a device authenticates with a username and a hashed-password. The mechanism can be transferred to other protocols in a similar manner.\n  MQTT Adapter authenticates device using the Credentials service   Protocol adapters MUST comply with the following rules when verifying credentials presented by a device:\n Credentials that have their enabled property set to false MUST NOT be used for authentication. Adapters MUST only consider secrets for authentication which\n have their not-before property set to either null or the current or a past point in time and have their not-after property set to either null or the current or a future point in time.   Standard Credential Types The following sections define some standard credential types and their properties. Applications are encouraged to make use of these types. However, the types are not enforced anywhere in Hono and clients may of course add application specific properties to the credential types.\nCommon Properties All credential types used with Hono MUST contain device-id, type, auth-id, enabled and secrets properties as defined in Credentials Format.\nHashed Password A credential type for storing a (hashed) password for a device.\nExample:\n{ \u0026quot;device-id\u0026quot;: \u0026quot;4711\u0026quot;, \u0026quot;type\u0026quot;: \u0026quot;hashed-password\u0026quot;, \u0026quot;auth-id\u0026quot;: \u0026quot;sensor1\u0026quot;, \u0026quot;secrets\u0026quot;: [{ \u0026quot;pwd-hash\u0026quot;: \u0026quot;AQIDBAUGBwg=\u0026quot;, \u0026quot;salt\u0026quot;: \u0026quot;Mq7wFw==\u0026quot;, \u0026quot;hash-function\u0026quot;: \u0026quot;sha-512\u0026quot; }] }     Name Mandatory JSON Type Default Description     type yes string  The credential type name, always hashed-password.   auth-id yes string  The identity that the device should be authenticated as.   pwd-hash yes string  The password hash (see table below for details).   salt no string  The Base64 encoding of the salt used in the password hash (see table below for details).   hash-function no string sha-256 The name of the hash function used to create the password hash. The hash functions supported by Hono are described in the table below.    NB It is strongly recommended to use salted password hashes only. Furthermore, the salt should be unique per user and password, so no lookup table or rainbow table attacks can be used to crack the salt-hashed password. Whenever a password is updated for a user, the salt should change as well.\nNB The example above does not contain any of the not-before, not-after and enabled properties, thus the credentials can be used at any time according to the rules defined in Credential Verification.\nThe table below describes the hash functions supported by Hono and how they map to the secret structure.\n   Name Salt Usage Salt Location Password Hash Format     sha-256 optional salt field The Base64 encoding of the bytes resulting from applying the sha-256 hash function to the byte array consisting of the salt bytes (if a salt is used) and the UTF-8 encoding of the clear text password.   sha-512 optional salt field The Base64 encoding of the bytes resulting from applying the sha-512 hash function to the byte array consisting of the salt bytes (if a salt is used) and the UTF-8 encoding of the clear text password.   bcrypt mandatory pwd-hash value The output of applying the Bcrypt hash function to the clear text password. The salt is contained in the password hash.\nNB Hono (currently) uses Spring Security for matching clear text passwords against Bcrypt hashes. However, this library only supports hashes containing the $2a$ prefix (see https://github.com/fpirsch/twin-bcrypt#about-prefixes) so Hono will fail to verify any passwords for which the corresponding Bcrypt hashes returned by the Credentials service contain e.g. the $2y$ prefix.    Pre-Shared Key A credential type for storing a Pre-shared Key as used in TLS handshakes.\nExample:\n{ \u0026quot;device-id\u0026quot;: \u0026quot;4711\u0026quot;, \u0026quot;type\u0026quot;: \u0026quot;psk\u0026quot;, \u0026quot;auth-id\u0026quot;: \u0026quot;little-sensor2\u0026quot;, \u0026quot;secrets\u0026quot;: [{ \u0026quot;key\u0026quot;: \u0026quot;AQIDBAUGBwg=\u0026quot; }] }     Name Mandatory JSON Type Description     type yes string The credential type name, always psk.   auth-id yes string The PSK identity.   key yes string The Base64 encoded bytes representing the shared (secret) key.    NB The example above does not contain any of the not-before, not-after and enabled properties, thus the credentials can be used at any time according to the rules defined in Credential Verification.\nX.509 Certificate A credential type for storing the RFC 2253 formatted subject DN of a client certificate that is used to authenticate the device as part of a TLS handshake.\nExample:\n{ \u0026quot;device-id\u0026quot;: \u0026quot;4711\u0026quot;, \u0026quot;type\u0026quot;: \u0026quot;x509-cert\u0026quot;, \u0026quot;auth-id\u0026quot;: \u0026quot;CN=device-1,O=ACME Corporation\u0026quot;, \u0026quot;secrets\u0026quot;: [{}] }     Name Mandatory JSON Type Description     type yes string The credential type name, always x509-cert.   auth-id yes string The subject DN of the client certificate in the format defined by RFC 2253.    NB The example above does not contain any of the not-before, not-after and enabled properties. The not-before and not-after properties should be omitted if the validity period is the same as the period indicated by the client certificate\u0026rsquo;s corresponding properties. It is still necessary to provide a (empty) JSON object in the secrets array, though.\n"
},
{
	"uri": "https://www.eclipse.org/hono/docs/api/authentication/",
	"title": "Authentication API Specification",
	"tags": [],
	"description": "",
	"content": "The Authentication API is used to retrieve a token asserting a subject\u0026rsquo;s identity and granted authorities. Other service implementations use such a token to make authorization decisions on a client\u0026rsquo;s request to read or write from/to a resource or to invoke a certain operation.\nThe Authentication API is defined by means of AMQP 1.0 message exchanges, i.e. a client needs to connect to an Authentication service using an AMQP 1.0 client in order to invoke operations of the API as described in the following sections.\nNote that a component implementing this API will most likely need to also provide means to add, alter or remove identities and authorities as well. However, Hono itself does not require this kind of functionality, thus this kind of functionality is considered out of scope of this API.\nIn a real world environment there will often already be an identity management system in place. In such cases it can make sense to just implement a facade exposing the Authentication API operations and mapping them to the underlying existing system\u0026rsquo;s functionality.\nGet Token Clients use this operation to\n verify a set of credentials and retrieve a token asserting the authenticated subject\u0026rsquo;s identity and granted authorities.  Message Flow\nThe following sequence diagram illustrates the flow of messages involved in a Client retrieving a token.\n  Get Token message flow    The Client and Authentication service have agreed to use the SASL PLAIN mechanism for authenticating the client. The Client therefore sends the credentials of the identity it wants to retrieve a token for. The Authentication service successfully verifies the credentials and establishes the authorization ID.  The Authentication service completes the SASL exchange with a successful outcome (SASL OK).  The Client continues by opening an AMQP connection with the Authentication service. The Authentication service creates a token asserting the authorization ID and authorities established during the SASL exchange and associates it with the connection. The Client opens a receiving link using source address cbs.  The Authentication service opens the link and sends the token associated with the connection to the Client.  The Client closes the connection.  Token Message Format\nOn successful establishment of the receiving link with the client as described above, the server sends a message to the client containing a token asserting the identity and authorities of the client that has been authenticated as part of establishing the underlying AMQP connection.\nThe following table provides an overview of the properties of the message sent to the client.\n   Name Location Type Value     type application-properties string amqp:jwt    The message\u0026rsquo;s body consists of a single AMQP 1.0 AmqpValue section which contains the UTF-8 representation of a JSON Web Token as defined in Token Format.\nToken Format The token returned by the get Token operation is a cryptographically signed JSON Web Token as defined by RFC 7519.\nThe token contains the following mandatory claims:\n   Name Type Value     sub RFC 7519, Section 4.1.2 The authorization ID of the authenticated client. This represents the asserted identity.   exp RFC 7519, Section 4.1.4 The point in time after which the claims contained in this token must be considered no longer valid. Clients MUST NOT use any information from a token that has expired.    The subject\u0026rsquo;s authorities on resources and operations are represented by additional JWT claims with a name identifying the resource or operation and a value containing the activities the subject is allowed to perform. The following activities are supported:\n READ - The client is allowed to establish a receiving link using the resource\u0026rsquo;s node address as the link\u0026rsquo;s source address. WRITE - The client is allowed to establish a sending link using the resource\u0026rsquo;s node address as the link\u0026rsquo;s target address. EXECUTE - The client is allowed to invoke an operation on an endpoint, i.e. send a message over a link with a subject representing the operation name and the link\u0026rsquo;s target address representing the API endpoint\u0026rsquo;s node address.  The allowed activities are encoded in a claim\u0026rsquo;s value by means of simply concatenating the activities\u0026rsquo; initial characters (R, W, E).\nThe token may contain any number of additional claims which may be ignored by clients that do not understand their meaning.\nResource Authorities A client\u0026rsquo;s authority on a resource is represented by a JWT claim with a name containing the resource node address prefixed with r: and a value containing the activities the client is allowed to perform on the resource. The node address MAY contain one or more wildcard (*) characters to represent any string.\nExample:\nAssuming a client which is allowed to\n send and consume events for tenant my-tenant and consume telemetry data for all tenants  the corresponding claims (in the token\u0026rsquo;s JSON representation) would look like this:\n{ ... \u0026quot;r:event/my-tenant\u0026quot;: \u0026quot;RW\u0026quot;, \u0026quot;r:telemetry/*\u0026quot;: \u0026quot;R\u0026quot;, ... }  Operation Authorities A client\u0026rsquo;s authority to invoke an endpoint\u0026rsquo;s operation(s) is represented by a JWT claim with a name containing the endpoint\u0026rsquo;s node address and operation identifier prefixed with o: and a value of E (for EXECUTE). The endpoint node address MAY contain one or more wildcard (*) characters to represent any string. The operation identifier is the subject value defined by the corresponding API for the operation. The operation identifier MAY be set to * to represent any operation of the endpoint.\nExample:\nAssuming a client which is allowed to\n invoke the Device Registration API\u0026rsquo;s assert Registration operation for any tenant and invoke all methods of the Credentials API for tenant my-tenant  the corresponding claims (in the token\u0026rsquo;s JSON representation) would look like this:\n{ ... \u0026quot;o:registration/*:assert\u0026quot;: \u0026quot;E\u0026quot;, \u0026quot;o:credentials/my-tenant:*\u0026quot;: \u0026quot;E\u0026quot;, ... } "
},
{
	"uri": "https://www.eclipse.org/hono/docs/api/management/",
	"title": "Device Registry Management API Specification",
	"tags": [],
	"description": "",
	"content": "  window.onload = function() { const ui = SwaggerUIBundle({ url: \"device-registry-v1.yaml\", dom_id: '#swagger-ui', deepLinking: true, presets: [ SwaggerUIBundle.presets.apis, SwaggerUIStandalonePreset ], plugins: [ SwaggerUIBundle.plugins.DownloadUrl ], layout: \"StandaloneLayout\", docExpansion: \"none\", defaultModelRendering: \"model\", defaultModelExpandDepth: 0, defaultModelsExpandDepth: -1, validatorUrl: null }) window.ui = ui }  "
},
{
	"uri": "https://www.eclipse.org/hono/docs/api/metrics/",
	"title": "Metrics",
	"tags": [],
	"description": "",
	"content": "Eclipse Hono\u0026trade;\u0026rsquo;s components report several metrics which may be used to gain some insight into the running system. For instance, the HTTP adapter reports the number of successfully processed telemetry messages. Some of these metrics are considered part of Hono\u0026rsquo;s external interface. This section describes the semantics and format of the metrics, how they can be retrieved and how to interpret actual values.\nReported Metrics Hono uses Micrometer in combination with Spring Boot to internally collect metrics. Those metrics can be exported to different back ends. Please refer to Configuring Metrics for details.\nThe example deployment by default uses Prometheus as the metrics back end.\nWhen deploying to Kubernetes/OpenShift, the metrics reported by Hono may contain environment specific tags (like the pod name) which are added by the Prometheus scraper. However, those tags are not part of the Hono metrics definition.\nHono applications may report other metrics in addition to the ones defined here. In particular, all components report metrics regarding the JVM\u0026rsquo;s internal state, e.g. memory consumption and garbage collection status. Those metrics are not considered part of Hono\u0026rsquo;s official metrics definition. However, all those metrics will still contain tags as described below.\nCommon Metrics Tags for common metrics are:\n   Tag Value Description     host string The name of the host that the component reporting the metric is running on   component-type adapter, service The type of component reporting the metric   component-name string The name of the component reporting the metric.    The names of Hono\u0026rsquo;s standard components are as follows:\n   Component component-name     Auth Server hono-auth   Device Registry hono-registry   AMQP adapter hono-amqp   CoAP adapter hono-coap   HTTP adapter hono-http   Kura adapter hono-kura-mqtt   MQTT adapter hono-mqtt    Protocol Adapter Metrics Additional tags for protocol adapters are:\n   Name Value Description     direction one-way, request, response The direction in which a Command \u0026amp; Control message is being sent:\none-way indicates a command sent to a device for which the sending application doesn\u0026rsquo;t expect to receive a response.\nrequest indicates a command request message sent to a device.\nresponse indicates a command response received from a device.   qos 0, 1, unknown The quality of service used for a telemetry or event message.\n0 indicates at most once,\n1 indicates at least once and\nnone indicates unknown delivery semantics.   status forwarded, unprocessable, undeliverable The processing status of a message.\nforwarded indicates that the message has been forwarded to a downstream consumer\nunprocessable indicates that the message has not been processed not forwarded, e.g. because the message was malformed\nundeliverable indicates that the message could not be forwarded, e.g. because there is no downstream consumer or due to an infrastructure problem   tenant string The identifier of the tenant that the metric is being reported for   ttd command, expired, none A status indicating the outcome of processing a TTD value contained in a message received from a device.\ncommand indicates that a command for the device has been included in the response to the device\u0026rsquo;s request for uploading the message.\nexpired indicates that a response without a command has been sent to the device.\nnone indicates that either no TTD value has been specified by the device or that the protocol adapter does not support it.   type telemetry, event The type of (downstream) message that the metric is being reported for.    Metrics provided by the protocol adapters are:\n   Metric Type Tags Description     hono.commands.received Timer host, component-type, component-name, tenant, type, status, direction The time it took to process a message conveying a command or a response to a command.   hono.commands.payload DistributionSummary host, component-type, component-name, tenant, type, status, direction The number of bytes conveyed in the payload of a command message.   hono.connections.authenticated Gauge host, component-type, component-name, tenant Current number of connected, authenticated devices.  NB This metric is only supported by protocol adapters that maintain connection state with authenticated devices. In particular, the HTTP adapter does not support this metric.   hono.connections.unauthenticated Gauge host, component-type, component-name Current number of connected, unauthenticated devices.  NB This metric is only supported by protocol adapters that maintain connection state with authenticated devices. In particular, the HTTP adapter does not support this metric.   hono.messages.received Timer host, component-type, component-name, tenant, type, status, qos, ttd The time it took to process a message conveying telemetry data or an event.   hono.messages.payload DistributionSummary host, component-type, component-name, tenant, type, status The number of bytes conveyed in the payload of a telemetry or event message.    Minimum Message Size If a minimum message size is configured for a tenant, then the payload size of the telemetry, event and command messages are calculated in accordance with the configured value and then reported to the metrics by the AMQP, HTTP and MQTT protocol adapters. If minimum message size is not configured for a tenant then the actual message payload size is reported.\nAssume that the minimum message size for a tenant is configured as 4096 bytes (4KB). The payload size of an incoming message with size 1KB is calculated as 4KB by the protocol adapters and reported to the metrics system. For an incoming message of size 10KB, it is reported as 12KB.\nService Metrics Hono\u0026rsquo;s service components do not report any metrics at the moment.\nLegacy Metrics  Deprecated This metrics configuration is still supported in Hono, but is considered deprecated and will be removed in a future version of Hono.\nThe legacy metrics support needs to be enabled explicitly. See Legacy support for more information.\n  Enabling the legacy support sets up internal support for exporting the metrics in the pre-0.8 format, using the Graphite Micrometer backend, but with a custom (legacy) naming scheme. It still is possible to use the InfluxDB Micrometer backend as well, however this will export metrics in the new format, and not on the legacy format.\nSome users have started to build custom dash boards on top of the names of the metrics and associated tags that end up in the example InfluxDB. Hono will try to support such users by allowing future versions of Hono to be configured to report metrics to InfluxDB resulting in the same database structure as created by InfluxDB\u0026rsquo;s Graphite Input.\nNB This does not necessarily mean that future versions of Hono will always support metrics being reported using the Graphite wire format. It only means that there will be a way to transmit metrics to InfluxDB resulting in the same database structure.\nTags The InfluxDB configuration file used for the example deployment contains templates for extracting the following tags from metric names transmitted via the Graphite reporter.\n   Tag Description     host The name of the host that the component reporting the metric is running on.   type The type of message that the metric is being reported for (either telemetry or event)   tenant The name of the tenant that the metric is being reported for.   protocol The transport protocol that has been used to send the message for which the metric is being reported (http or mqtt).    The following sections describe which of these tags are extracted for which metrics specifically.\nCommon Metrics The following table contains metrics that are collected for all protocol adapters (if applicable to the underlying transport protocol).\n   Metric Tags Description     counter.hono.connections.authenticated.count host, tenant, protocol Current number of connections with authenticated devices. NB This metric is only supported by protocol adapters that maintain connection state with authenticated devices. In particular, the HTTP adapter does not support this metric.   counter.hono.connections.unauthenticated.count host, protocol Current number of connections with unauthenticated devices. NB This metric is only supported by protocol adapters that maintain connection state with unauthenticated devices. In particular, the HTTP adapter does not support this metric.   meter.hono.commands.device.delivered.count host, tenant, protocol Commands delivered to devices. Total count since application start.   meter.hono.commands.device.delivered.m1_rate host, tenant, protocol Commands delivered to devices. One minute, exponentially weighted, moving average.   meter.hono.commands.device.delivered.m5_rate host, tenant, protocol Commands delivered to devices. Five minute, exponentially weighted, moving average.   meter.hono.commands.device.delivered.m15_rate host, tenant, protocol Commands delivered to devices. Fifteen minute, exponentially weighted, moving average.   meter.hono.commands.device.delivered.mean_rate host, tenant, protocol Commands delivered to devices. Mean rate of messages since application start.   meter.hono.commands.response.delivered.count host, tenant, protocol Command responses delivered to applications. Total count since application startup.   meter.hono.commands.response.delivered.m1_rate host, tenant, protocol Command responses delivered to applications. One minute, exponentially weighted, moving average.   meter.hono.commands.response.delivered.m5_rate host, tenant, protocol Command responses delivered to applications. Five minute, exponentially weighted, moving average.   meter.hono.commands.response.delivered.m15_rate host, tenant, protocol Command responses delivered to applications. Fifteen minute, exponentially weighted, moving average.   meter.hono.commands.response.delivered.mean_rate host, tenant, protocol Command responses delivered to applications. Mean rate of messages since the application start.   meter.hono.commands.ttd.expired.count host, tenant, protocol Messages containing a TTD that expired with no pending command(s). Total count since application startup.   meter.hono.commands.ttd.expired.m1_rate host, tenant, protocol Messages containing a TTD that expired with no pending command(s). One minute, exponentially weighted, moving average.   meter.hono.commands.ttd.expired.m5_rate host, tenant, protocol Messages containing a TTD that expired with no pending command(s). Five minute, exponentially weighted, moving average.   meter.hono.commands.ttd.expired.m15_rate host, tenant, protocol Messages containing a TTD that expired with no pending command(s). Fifteen minute, exponentially weighted, moving average.   meter.hono.commands.ttd.expired.mean_rate host, tenant, protocol Messages containing a TTD that expired with no pending command(s). Mean rate of messages since the application start.    HTTP Metrics The following table contains metrics that are collected specifically for the HTTP protocol adapter.\n   Metric Tags Description     counter.hono.http.messages.undeliverable.count host, tenant, type Messages which could not be processed by the HTTP protocol adapter. Total count since application startup.   meter.hono.http.messages.processed.count host, tenant, type Messages processed by the HTTP protocol adapter. Total count since application startup.   meter.hono.http.messages.processed.m1_rate host, tenant, type Messages processed by the HTTP protocol adapter. One minute, exponentially weighted, moving average.   meter.hono.http.messages.processed.m5_rate host, tenant, type Messages processed by the HTTP protocol adapter. Five minute, exponentially weighted, moving average.   meter.hono.http.messages.processed.m15_rate host, tenant, type Messages processed by the HTTP protocol adapter. Fifteen minute, exponentially weighted, moving average.   meter.hono.http.messages.processed.mean_rate host, tenant, type Messages processed by the HTTP protocol adapter. Mean rate of messages since the application start.    MQTT Metrics The following table contains metrics that are collected specifically for the MQTT protocol adapter.\n   Metric Tags Description     counter.hono.mqtt.messages.undeliverable.count host, tenant, type Messages which could not be processed by the MQTT protocol adapter- Total count since application startup.   meter.hono.mqtt.messages.processed.count host, tenant, type Messages processed by the MQTT protocol adapter. Total count since application startup.   meter.hono.mqtt.messages.processed.m1_rate host, tenant, type Messages processed by the MQTT protocol adapter. One minute, exponentially weighted, moving average.   meter.hono.mqtt.messages.processed.m5_rate host, tenant, type Messages processed by the MQTT protocol adapter. Five minute, exponentially weighted, moving average.   meter.hono.mqtt.messages.processed.m15_rate host, tenant, type Messages processed by the MQTT protocol adapter. Fifteen minute, exponentially weighted, moving average.   meter.hono.mqtt.messages.processed.mean_rate host, tenant, type Messages processed by the MQTT protocol adapter. Mean rate of messages since the application start.   "
},
{
	"uri": "https://www.eclipse.org/hono/docs/deployment/",
	"title": "Deployment",
	"tags": [],
	"description": "",
	"content": " Deployment Learn how to deploy Hono\u0026trade; to different container orchestration platforms.\n"
},
{
	"uri": "https://www.eclipse.org/hono/docs/deployment/helm-based-deployment/",
	"title": "Helm based Deployment",
	"tags": [],
	"description": "",
	"content": "Eclipse Hono\u0026trade;\u0026rsquo;s components are provided as container images which can be run on arbitrary container orchestration platforms. This page describes the steps necessary to deploy Hono to a Kubernetes cluster using the Helm package manager.\n Note The example configuration that comes with Hono and which is used in this guide is supposed to be used for evaluation and development purposes only.  Prerequisites Kubernetes Cluster The most basic requirement is, of course, a Kubernetes cluster to deploy to. The Kubernetes setup guide describes options available for setting up a cluster.\nHelm Helm is a tool for managing (complex) Kubernetes applications. In this guide it is used to deploy Hono to the cluster. Helm\u0026rsquo;s installation instructions provide more details.\nKubectl The kubectl tool is used to manage a Kubernetes cluster from the command line. In this guide it is used to retrieve information about Hono\u0026rsquo;s service endpoints from the cluster. The installation guide provides instructions for setting up kubectl locally.\nHono Helm Chart The Helm chart is contained in the Hono archive that is available from Hono\u0026rsquo;s download page. After the archive has been extracted, the chart can be found in the eclipse-hono-$VERSION/deploy/helm/eclipse-hono folder.\nHono Command Line Client The Hono command line client is available from the download page. The command line client requires a Java 11 runtime environment to run.\nDeploying Hono The recommended way of deploying Hono is by means of using Helm\u0026rsquo;s Tiller service running on the Kubernetes cluster:\n# in directory: eclipse-hono-$VERSION/deploy/helm helm install --dep-up --name hono --namespace hono eclipse-hono/  This will create namespace hono in the cluster and install all the components to that namespace. The name of the Helm release will be hono.\nThe status of the deployment can be checked using any of the following commands:\nhelm list helm status hono helm get hono  Deploying Hono using kubectl In cases where installation of Helm\u0026rsquo;s Tiller service into the cluster is not an option, the Kubernetes resource descriptors created by Helm can be deployed manually using the kubectl command line tool.\nThe following commands generate the resource descriptors:\n# in directory: eclipse-hono-$VERSION/deploy/ helm dep update helm/ helm template --name hono --namespace hono --output-dir . helm/  This will create an eclipse-hono folder containing all the resource descriptors which can then be deployed to the cluster using kubectl:\n# in directory: eclipse-hono-$VERSION/deploy/ kubectl create namespace hono kubectl config set-context $(kubectl config current-context) --namespace=hono find . -path \u0026quot;./eclipse-hono/*\u0026quot; -name crd*.yaml -exec kubectl apply -f {} \\; kubectl apply -f ./eclipse-hono -R  Verifying the Installation Once deployment has completed, Hono\u0026rsquo;s external API endpoints are exposed via corresponding Kubernetes Services. The following command lists all services and their endpoints (replace hono with the namespace that you have deployed to):\nkubectl get service -n hono NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) hono-adapter-amqp-vertx LoadBalancer 10.109.123.153 10.109.123.153 5672:32672/TCP,5671:32671/TCP hono-adapter-amqp-vertx-headless ClusterIP None \u0026lt;none\u0026gt; \u0026lt;none\u0026gt; hono-adapter-http-vertx LoadBalancer 10.99.180.137 10.99.180.137 8080:30080/TCP,8443:30443/TCP hono-adapter-http-vertx-headless ClusterIP None \u0026lt;none\u0026gt; \u0026lt;none\u0026gt; hono-adapter-mqtt-vertx LoadBalancer 10.102.204.69 10.102.204.69 1883:31883/TCP,8883:30883/TCP hono-adapter-mqtt-vertx-headless ClusterIP None \u0026lt;none\u0026gt; \u0026lt;none\u0026gt; hono-artemis ClusterIP 10.97.31.154 \u0026lt;none\u0026gt; 5671/TCP hono-dispatch-router ClusterIP 10.98.111.236 \u0026lt;none\u0026gt; 5673/TCP hono-dispatch-router-ext LoadBalancer 10.109.220.100 10.109.220.100 15671:30671/TCP,15672:30672/TCP hono-grafana ClusterIP 10.110.61.181 \u0026lt;none\u0026gt; 3000/TCP hono-prometheus-server ClusterIP 10.96.70.135 \u0026lt;none\u0026gt; 9090/TCP hono-service-auth ClusterIP 10.109.97.44 \u0026lt;none\u0026gt; 5671/TCP hono-service-auth-headless ClusterIP None \u0026lt;none\u0026gt; \u0026lt;none\u0026gt; hono-service-device-registry ClusterIP 10.105.190.233 \u0026lt;none\u0026gt; 5671/TCP hono-service-device-registry-ext LoadBalancer 10.101.42.99 10.101.42.99 28080:31080/TCP,28443:31443/TCP hono-service-device-registry-headless ClusterIP None \u0026lt;none\u0026gt; \u0026lt;none\u0026gt;  The listing above has been retrieved from a Minikube cluster that emulates a load balancer via the minikube tunnel command (refer to the Minikube Networking docs for details). The service endpoints can be accessed at the EXTERNAL-IP addresses and corresponding PORT(S), e.g. 8080 for the HTTP adapter (hono-adapter-http-vertx) and 28080 for the device registry (hono-service-device-registry).\nThe following command assigns the IP address of the device registry service to the REGISTRY_IP environment variable so that they can easily be used from the command line:\nexport REGISTRY_IP=$(kubectl get service hono-service-device-registry-ext --output='jsonpath={.status.loadBalancer.ingress[0].ip}' -n hono)  The following command can then be used to check for the existence of the DEFAULT_TENANT which is created as part of the installation:\ncurl -sIX GET http://$REGISTRY_IP:28080/v1/tenants/DEFAULT_TENANT HTTP/1.1 200 OK etag: 89d40d26-5956-4cc6-b978-b15fda5d1823 content-type: application/json; charset=utf-8 content-length: 260  \nAccessing the Grafana Dashboard Hono comes with an example Grafana dashboard which provides some insight into the messages flowing through the protocol adapters. The following command needs to be run first in order to forward the Grafana service\u0026rsquo;s endpoint to the local host:\nkubectl port-forward service/hono-grafana 3000 -n hono  Then the dashboard can be opened by pointing a browser to http://localhost:3000 using credentials admin:admin.\nUndeploying Hono A Hono instance that has been deployed using Helm\u0026rsquo;s Tiller service can be undeployed by running\nhelm delete --purge hono  A Hono instance that has been deployed manually using the resource files can be undeployed by running\n# in directory: eclipse-hono-$VERSION/deploy/ kubectl delete -f ./eclipse-hono -R  Deploying custom Container Images The sections above describe how Hono\u0026rsquo;s pre-built container images can be deployed using Helm. In some cases it might be desirable to build Hono from source, e.g. in order to use a different metrics back end or to use Jaeger tracing. In these cases, the Helm templates contained in the source tree can be used instead of the Helm chart from the download page.\nThe container images created as part of the build process need to be made available to the Kubernetes cluster that Hono should be deployed to. This usually requires the images to be pushed to a (private) container registry that the cluster has pull access to. Please refer to the documentation of the employed Kubernetes service provider for details regarding the setup and configuration of a private container registry.\nDeploying via a private Registry The first step is getting the source code of Hono. Please refer to Building from Source for details. Once the source code has been retrieved, the build process can be started using the following command:\n# in base directory of Hono working tree: mvn clean install -Pbuild-docker-image,metrics-prometheus  After the build process has finished, the custom container images need to be pushed to the registry so that the Kubernetes cluster can pull them from there during deployment. Assuming that the images should be tagged with 1.0-CUSTOM and the container registry name is my.registry.io, the following command can be used to tag the locally built images and push them to the registry:\n# in base directory of Hono working tree: ./push_hono_images.sh 1.0-CUSTOM my.registry.io   Note You may need to log in to the (private) container registry before pushing the images.  Once the images have been pushed, the deployment can be done using Helm:\n# in Hono working tree directory: hono/deploy helm install --dep-up --name hono --namespace hono --set deviceRegistry.imageName=my.registry.io/eclipse/hono-service-device-registry:1.0-CUSTOM,authServer.imageName=my.registry.io/eclipse/hono-service-auth:1.0-CUSTOM,deviceConnectionService.imageName=my.registry.io/eclipse/hono-service-device-connection:1.0-CUSTOM,adapters.amqp.imageName=my.registry.io/eclipse/hono-adapter-amqp-vertx:1.0-CUSTOM,adapters.mqtt.imageName=my.registry.io/eclipse/hono-adapter-mqtt-vertx:1.0-CUSTOM,adapters.http.imageName=my.registry.io/eclipse/hono-adapter-http-vertx:1.0-CUSTOM target/deploy/helm/eclipse-hono/  Deploying to Minikube When using Minikube as the deployment target, things are a little easier. Minikube comes with an embedded Docker daemon which can be used to build the container images instead of using a local Docker daemon, thus eliminating the need to push the images to a registry altogether. In order to use Minikube\u0026rsquo;s Docker daemon, the following command needs to be run:\neval $(minikube docker-env)  This will set the Docker environment variables to point to Minikube\u0026rsquo;s Docker daemon which can then be used for building the container images and storing them locally in the Minikube VM.\nIn any case the build process can be started using the following command:\n# in base directory of Hono working tree: mvn clean install -Pbuild-docker-image,metrics-prometheus  The newly built images can then be deployed using Helm:\n# in Hono working tree directory: hono/deploy helm install --dep-up --name hono --namespace hono target/deploy/helm/eclipse-hono/  Using the Device Connection Service Hono\u0026rsquo;s example Device Registry component contains a simple in-memory implementation of the Device Connection API. This example implementation is used by default when the example registry is deployed.\nHono also contains a production ready, data grid based implementation of the Device Connection API which can be deployed and used instead of the example implementation. The component can be deployed by means of setting the deviceConnectionService.enabled property to true when running Helm:\n# in directory: eclipse-hono-$VERSION/deploy/ helm install --dep-up --name hono --namespace hono --set deviceConnectionService.enabled=true helm/eclipse-hono/  This will deploy the Device Connection service and configure all protocol adapters to use it instead of the example Device Registry implementation. However, the service requires a connection to a data grid in order to store the device connection data. The Helm chart supports deployment of a simple data grid which can be used for experimenting by means of setting the dataGridDeployExample property to true when running Helm:\n# in directory: eclipse-hono-$VERSION/deploy/ helm install --dep-up --name hono --namespace hono --set deviceConnectionService.enabled=true --set dataGridDeployExample=true helm/eclipse-hono/  This will deploy the data grid and configure the Device Connection service to use it for storing the connection data.\nThe Device Connection service can also be configured to connect to an already existing data grid. Please refer to the admin guide for details regarding the corresponding configuration properties.\nUsing Jaeger Tracing Hono\u0026rsquo;s components are instrumented using OpenTracing to allow tracking of the distributed processing of messages flowing through the system. The Hono chart can be configured to report tracing information to the Jaeger tracing system. The Spans reported by the components can then be viewed in a web browser.\nIn order for Hono\u0026rsquo;s components to use the Jaeger client for reporting tracing information, the container images need to be built with the jaeger Maven profile. Please refer to Monitoring \u0026amp; Tracing for details.\nThe chart can be configured to deploy and use an example Jaeger back end by means of setting the jaegerBackendDeployExample property to true when running Helm:\n# in Hono working tree directory: hono/deploy helm install --dep-up --name hono --namespace hono --set jaegerBackendDeployExample=true target/deploy/helm/eclipse-hono/  This will create a Jaeger back end instance suitable for testing purposes and will configure all deployed Hono components to use the Jaeger back end.\nThe following command can then be used to return the IP address with which the Jaeger UI can be accessed in a browser (ensure minikube tunnel is running when using minikube):\nkubectl get service hono-jaeger-query --output='jsonpath={.status.loadBalancer.ingress[0].ip}' -n hono  If no example Jaeger back end should be deployed but instead an existing Jaeger installation should be used, the chart\u0026rsquo;s jaegerAgentConf property can be set to environment variables which are passed in to the Jaeger Agent that is deployed with each of Hono\u0026rsquo;s components.\n# in Hono working tree directory: hono/deploy helm install --dep-up --name hono --namespace hono --set jaegerAgentConf.REPORTER_TYPE=tchannel --set jaegerAgentConf.REPORTER_TCHANNEL_HOST_PORT=my-jaeger-collector:14267 target/deploy/helm/eclipse-hono/  Deploying optional Adapters The Helm chart supports deployment of additional protocol adapters which are still considered experimental or have been deprecated. The following table provides an overview of the corresponding configuration properties that need to be set on deployment.\n   Property Default Description     adapters.kura.enabled false Indicates if the deprecated Kura protocol adapter should be deployed.    The following command will deploy the Kura adapter along with Hono\u0026rsquo;s standard adapters:\n# in directory: eclipse-hono-$VERSION/deploy/ helm install --dep-up --name hono --namespace hono --set adapters.kura.enabled=true helm/eclipse-hono/ "
},
{
	"uri": "https://www.eclipse.org/hono/docs/deployment/openshift/",
	"title": "OpenShift / OKD",
	"tags": [],
	"description": "",
	"content": "This guide describes how Eclipse Hono™ can be deployed on OpenShift with EnMasse, using the source-to-image (S2I) way. Using this approach, it is possible to customize and refresh the base images where Hono runs in. It also uses a more complex, multi-project setup and separates EnMasse and Grafana from the core Hono project.\n Use for demos only While this deployment model is closer to a production-ready deployment it still is missing some important aspects, so please do use this only as a base for your setup or as a demo setup. The following topics are currently not covered by this example deployment:\n Integration between EnMasse and Hono authentication Use your own versions of the device registry and authorization service  These are all subjects to current and future developments in this area. This document will be updated accordingly with the progress.\n  Prerequisites In order to work through this example deployment you will need the OpenShift client tools installed. Please align the version of the client tools with the version of your OpenShift cluster. This guide was tested with OpenShift 3.11.0. It might work with older or newer versions as well, but that is untested.\nAssumptions This tutorial makes the following assumptions about your environment, if those assumptions are not true in your specific environment you will need to adapt the following instructions:\n The admin URL of your OpenShift cluster is: https://my-cluster:8443 The name of your OpenShift user is developer All scripts and paths are relative to the folder deploy/src/main/deploy/openshift Some parts of this tutorial may need cluster admin privileges. When cluster admin privileges are required, the tutorial will indicate this by the command oc login -u admin. It will indicate the end of a section requiring cluster admin privileges by the command oc login -u developer.   Note: Those command may be different on your installation. They only act as an example.\nLinux like environment The deployment guide assumes that you have a Linux like environment with things like bash, curl, git, … Mac OS X 10.13+ works as well, Windows with some kind of Unix tooling should also be possible.\nOpenShift Origin client tools The client tools can be downloaded from the OpenShift Origin project repository. Simply download the archive, unpack it and drop it into a directory where it can be found by the local PATH lookup.\nMinishift This tutorial is targeted towards running Hono on a production-ready OpenShift cluster. However it still is possible and useful to run the same setup on a local test cluster with \u0026ldquo;minishift\u0026rdquo;.\nMinishift is a tool that helps you run OpenShift locally by running a single-node OpenShift cluster inside a VM. Follow this guide for installing and having Minishift up and running.\nThe default resource limits for Minishift however are to small, so please ensure that you are running Minishift with the following settings:\nminishift start --cpus 4 --memory 16GB --disk-size 40GB   Resource limits Once you created your Minishift cluster instance with minishift start the resource arguments (like --cpus) are ignored in future calls to minishift start as the virtual machine has already been created. You will need to destroy the instance using minishift delete before it will accept the new resource limits.  When using minishift you can find your cluster URL by executing the following command:\nminishift console --url  Some of the operations may require cluster admin privileges. For minishift an admin user can be created by executing the following commands, having a running minishift instance:\nminishift addons apply admin-user  This will create a user named admin, with a password of admin, that has cluster admin privileges.\nOperator Lifecycle Manager A simple way to install additional operators in your cluster is via the Operator Lifecycle Manager (aka OLM). It can be enabled in OpenShift 3.11+ by setting openshift_enable_olm=true in the Ansible inventory file.\nFor Minishift, it can be enabled by execute the following commands as cluster admin:\ngit clone https://github.com/operator-framework/operator-lifecycle-manager cd operator-lifecycle-manager oc login -u admin oc new-project operator-lifecycle-manager oc create -f deploy/okd/manifests/latest/ oc login -u developer  See also: https://github.com/operator-framework/operator-lifecycle-manager/blob/master/Documentation/install/install.md\nThis guide will use OLM in order to install the optional Prometheus Operator, which enables the aggregation of metrics from different Hono components.\nPersistent volumes You will need two persistent volumes for this deployment. The default required volumes are:\n   Name Size Purpose     hono-pv 128 Mi Storing device registry information   grafana-pv 1 Gi Grafana configuration database    In the folder admin/storage you will find a set of sub folders containing YAML files for setting up the persistent volumes (PVs). As there are multiple storage providers available you need to choose only one and must modify it to match your OpenShift setup (see the following subsections).\nIt may also be possible that your cluster supports automatic provisioning of storage, in this case you don\u0026rsquo;t need to create PVs explicitly.\nThe PVs can be created by executing the following command with a user that has cluster wide privileges:\noc create -f admin/storage/\u0026lt;type\u0026gt;/grafana-pv.yml oc create -f admin/storage/\u0026lt;type\u0026gt;/hono-pv.yml  Minishift When you are running minishift, then you have automatic provisioning for PVs available. There is no need to create any PVs manually.\nLocal In the admin/storage/local folder you will find YAML files for setting up local storage volumes. Those volumes will be kept available when pods are restarted, but are only available on he local disk of a node. So pods can only run on this single node and not be migrated throughout a cluster.\nIf you have a single node cluster anyway, it might still be an easy option.\nYou will need to change the field .spec.hostPath.path to point to an existing directory which grants all access to \u0026ldquo;other\u0026rdquo; (chmod a+rwx .).\nThe storage capacity will only be used for matching PVs with PVCs and is not being enforced with this storage type.\nNFS The folder admin/storage/nfs contains a set of YAML files for setting up NFS based PVs. For this to work you will need a running NFS server and set up proper exports. It is possible to re-use the NFS server of your OpenShift installation if you already have one.\nYou will need to change the following fields:\n .spec.nfs.server – Hostname of the NFS server .spec.nfs.path – The name of the exported path   Don\u0026#39;t use in production Applications running of top of NFS may have issues with things like file locking behavior, …. So it isn\u0026rsquo;t recommended to use NFS without proper testing and ensuring that it works the way you expect it. If you accept the risk of corrupted data, it might still be a simple setup for testing a multi-node setup.  Also see: https://docs.openshift.org/latest/install_config/persistent_storage/persistent_storage_nfs.html\nAbility to create new projects The following guide requires three projects in the OpenShift cluster. It still is possible to modify the deployment to deploy to a single project, however this guide focuses on a setup having multiple projects.\nIf you don\u0026rsquo;t have permissions to create new projects yourself, then you will need to request three projects. The guide expects the projects names to be:\n enmasse – Hosting the EnMasse components. hono – For running Eclipse Hono. grafana – For running an instance of Grafana. Primarily for showing Hono dashboards.  Those projects must be allowed to perform internal communication.\nIf projects will be created for you, then you can ignore the calls to oc new-project in the following sections.\nCertificates Certificates are a difficult topic, as every components brings in its own concept about how certificates are handled. This deployment guide tries to align everything with OpenShifts capabilities of managing certificates. That means that internal communication tries to use cluster generated certificates, signed by the cluster CA. And externally it tries to re-use the OpenShift router certificates, which are provided during the installation of OpenShift. One exception to that are the AMQP and MQTT protocols. As those currently cannot be re-encrypted.\nIf you deploy OpenShift without proper certificates, then you will automatically have self-signed certificates. In this case it is required to disable e.g. hostname validation later on. This deployment guide assumes that you have proper certificates set up, and will try to assist if that is not the case.\n Let\u0026#39;s encrypt As Let\u0026rsquo;s encrypt now supports wildcard certificates, having proper certificates may only be a few commands away for you.  In general, curl commands require the parameter --insecure in order to work with self-signed certificates.\n Mac OS X 10.13\u0026#43; The curl binary on Mac OS X before 10.13 suffers from an issue with TLS SNI. Also see: https://github.com/curl/curl/issues/1533\nAs the use of SNI is required for Kubernetes/OpenShift, when it comes to routing requests to services, it is not possible to use the provided version of curl on Mac OS X before 10.13.\nYou can install a working curl version using in those Mac OS X released with the following commands:\nbrew install curl --with-openssl  Or upgrade your existing installation using:\nbrew reinstall curl --with-openssl  Or use proper certificates.\n  Clone the Hono repository In order to have access to some of the requires scripts and resource of this deployment guide, you will need to clone the Hono repository to your local machine. You can do this with the following command:\ngit clone https://github.com/eclipse/hono.git  Or if you want to check out a specific branch (e.g. 0.9.x):\ngit clone -b 0.9.x https://github.com/eclipse/hono.git   Different branches This deployment description is based on the master branch of Hono. However this branch is also the current development and may be unstable at times.\nIf you experience any problems, it is recommended to switch to a release branch (e.g. 0.9.x) instead of using the default master branch. However this documentation is only published from the master branch, so there may be inconsistencies between the repository content and the documentation. In this case you can read through index.md file, checked out from the branch you cloned. The file is located in the directory hono-site/content/deployment/openshift.\n  Setting up EnMasse This section describes how to install EnMasse, the messaging layer which Hono is based on.\nStart by downloading and unpacking EnMasse:\ncurl -LO https://github.com/EnMasseProject/enmasse/releases/download/0.25.0/enmasse-0.25.0.tgz tar xzf enmasse-0.25.0.tgz   Other versions Other versions of EnMasse might work as well, but are untested by this deployment guide. Unless you explicitly want to try out a different version, it is recommended to use to the version documented in this tutorial.  First switch to a user with cluster admin privileges, e.g.:\noc login -u admin  Then create a new project:\noc new-project enmasse-infra --display-name='EnMasse'  And perform the deployment:\noc apply -f enmasse-0.25.0/install/bundles/enmasse-with-standard-authservice  Wait for the admin console to completely start up. You can check this with the following command:\noc get deploy/api-server deploy/keycloak  Verify that the \u0026ldquo;AVAILABLE\u0026rdquo; column shows \u0026ldquo;1\u0026rdquo;:\nNAME DESIRED CURRENT UP-TO-DATE AVAILABLE AGE api-server 1 1 1 1 1m keycloak 1 1 1 1 1m  Finally switch back to your normal application user:\noc login -u developer  Setting up Hono Start by creating a new project using:\noc new-project hono --display-name='Eclipse Hono™'  Then create the EnMasse address space to use:\noc create -f hono-address-space.yml  Before proceeding to the next step, ensure that the address space has been created and is ready. Executing the following command should contain Is Ready: true in the status section:\noc describe addressspace/default  You can also quickly check for isReady with a JSON path query:\noc get addressspace/default -o jsonpath='{.status.isReady}'  Then process and execute the main Hono template in order to deploy the Hono services:\noc process -f hono-template.yml | oc create -f -  OpenShift templates allow to use parameters which can customize provided templates. If you want to specify template parameters from the command line use the following syntax:\noc process -f hono-template.yml \\ -p GIT_REPOSITORY=https://github.com/your/hono.git \\ -p GIT_BRANCH=0.9.x| oc create -f -   Align branches By default the Hono template uses the master branch for deploying Hono. As this branch might be unstable this may not be what you are looking for, but it also is the default branch of the Hono Git repository where you checked out the deployment template.\nIt is recommended that when you execute the guide from an alternate branch (e.g. 0.9.x) that you also pass the same branch as GIT_BRANCH to the template.\n  And register the template for creating new Hono tenants. This only registers the template, but does not create a new tenant yet:\noc create -f hono-tenant-template.yml  Next you will need to create a tenant, execute the following command to create the default tenant:\noc process hono-tenant HONO_TENANT_NAME=DEFAULT_TENANT RESOURCE_NAME=defaulttenant CONSUMER_USER_NAME=consumer CONSUMER_USER_PASSWORD=\u0026quot;$(echo -n verysecret | base64)\u0026quot;| oc create -f -   Creating tenants Creating a new tenant using the template currently only creates the necessary resources in EnMasse for the tenant. It does not create the tenant in the Hono device registry.  Enabling metrics The default OpenShift deployment of Hono does support the use of Prometheus as a metrics backend. However it is still required to deploy an instance of Prometheus and Grafana to your installation in order to actually gather and visualize the metrics.\nAdding Prometheus support This section will explain how to set up Prometheus via the OLM and the Prometheus Operator. This is only an example, it is possible to install Prometheus in different ways. Or skip the installation of Prometheus, if you want to use a different metrics backend.\nRun the following commands to register the prometheus operator and create a new instance:\noc project hono oc create -f ../resource-descriptors/prometheus/operator.yml oc create -f ../resource-descriptors/prometheus/instance.yml  Setting up Grafana Start by creating a new project using:\noc new-project grafana --display-name='Grafana Dashboard'  Create the config resources:\noc create configmap grafana-provisioning-dashboards --from-file=../../config/grafana/provisioning/dashboards oc create configmap grafana-dashboard-defs --from-file=../../config/grafana/dashboard-definitions oc label configmap grafana-provisioning-dashboards app=hono-metrics oc label configmap grafana-dashboard-defs app=hono-metrics  Then deploy the Grafana instance using:\noc process -f grafana-template.yml \\ -p ADMIN_PASSWORD=admin | oc create -f -  OpenShift templates allow to use parameters which can customize provided templates. If you want to specify template parameters from the command line use the following syntax:\noc process -f grafana-template.yml \\ -p ADMIN_PASSWORD=admin \\ -p HONO_NAMESPACE=hono \\ -p GIT_REPOSITORY=https://github.com/your/hono.git \\ -p GIT_BRANCH=0.9.x| oc create -f -  Configuring the installation The default installation of Hono can be tweaked in a few ways. The following sub-sections describe a few aspects that can be modified.\nConfigure maximum number of devices per tenant The default settings for the example Hono device registry limit the number of devices to 100 per tenant. If this is not enough for your setup you can change the setting by executing the following command, which will increase the number to 10.000 devices per tenant:\noc set env -n hono dc/hono-service-device-registry HONO_REGISTRY_SVC_MAX_DEVICES_PER_TENANT=10000  Adding Jaeger support By default Hono has the capability to work with OpenTracing, and it also provides a build profile for enabling the \u0026ldquo;Jaeger\u0026rdquo; implementation of OpenTracing.\nThere are a few manual steps required to modify the default Hono deployment for OpenShift in order to enable this profile.\nEnable the build profile The Hono profile needs to be enabled, to include the Jaeger components in the S2I builds.\nModify the Hono templates to add the jaeger profile in the builds. e.g.:\nname: fabric8-s2i-java-custom:2.3 env: - name: MAVEN_ARGS_APPEND - value: -B -pl org.eclipse.hono:hono-adapter-mqtt-vertx --also-make -Pnetty-tcnative + value: -B -pl org.eclipse.hono:hono-adapter-mqtt-vertx --also-make -Pnetty-tcnative -Pjaeger - name: ARTIFACT_DIR value: adapters/mqtt-vertx/target - name: ARTIFACT_COPY_ARGS  Be sure to trigger new builds if you already built the container images before.\nAdd the Jaeger agent sidecar In order to add capture output from the Jaeger client and forward it to the main Jaeger application, a Jaeger agent is required. This will be deployed alongside each Hono service, as a dedicated container, but in the same pod (aka sidecar).\nThis requires a new image stream:\nkind: ImageStream apiVersion: v1 metadata: name: jaeger-agent spec: lookupPolicy: local: false tags: - name: \u0026quot;latest\u0026quot; from: kind: DockerImage name: docker.io/jaegertracing/jaeger-agent:latest importPolicy: scheduled: true referencePolicy: type: Source  Then you need to modify the deployment configuration for each Hono service that should use the Jaeger agent:\n- kind: DeploymentConfig apiVersion: v1 metadata: name: hono-adapter-mqtt-vertx labels: app: hono-adapter deploymentconfig: hono-adapter-mqtt-vertx spec: replicas: 1 selector: app: hono-adapter deploymentconfig: hono-adapter-mqtt-vertx strategy: type: Rolling rollingParams: timeoutSeconds: 3600 triggers: - type: ConfigChange - type: ImageChange imageChangeParams: automatic: true containerNames: - eclipsehono-hono-adapter-mqtt-vertx from: kind: ImageStreamTag name: hono-adapter-mqtt-vertx:latest + - type: ImageChange + imageChangeParams: + automatic: true + containerNames: + - jaeger-agent + from: + kind: ImageStreamTag + name: jaeger-agent:latest template: metadata: labels: app: hono-adapter deploymentconfig: hono-adapter-mqtt-vertx spec: containers: - name: eclipsehono-hono-adapter-mqtt-vertx image: hono-adapter-mqtt-vertx imagePullPolicy: Always env: - name: SPRING_CONFIG_LOCATION value: file:///etc/config/ - name: SPRING_PROFILES_ACTIVE value: - name: LOGGING_CONFIG value: file:///etc/config/logback-spring.xml - name: KUBERNETES_NAMESPACE valueFrom: fieldRef: fieldPath: metadata.namespace - name: HONO_MESSAGING_HOST valueFrom: configMapKeyRef: name: hono-configuration key: downstream.host - name: HONO_MESSAGING_PORT valueFrom: configMapKeyRef: name: hono-configuration key: downstream.port - name: HONO_COMMAND_HOST valueFrom: configMapKeyRef: name: hono-configuration key: downstream.host - name: HONO_COMMAND_PORT valueFrom: configMapKeyRef: name: hono-configuration key: downstream.port - name: HONO_REGISTRATION_HOST value: hono-service-device-registry.$(KUBERNETES_NAMESPACE).svc - name: HONO_CREDENTIALS_HOST value: hono-service-device-registry.$(KUBERNETES_NAMESPACE).svc - name: HONO_TENANT_HOST value: hono-service-device-registry.$(KUBERNETES_NAMESPACE).svc - name: MANAGEMENT_METRICS_EXPORT_GRAPHITE_HOST value: influxdb.$(KUBERNETES_NAMESPACE).svc - name: AB_JOLOKIA_USER value: jolokia - name: AB_JOLOKIA_PASSWORD_RANDOM value: \u0026quot;false\u0026quot; - name: AB_JOLOKIA_PASSWORD valueFrom: secretKeyRef: name: hono-secrets key: jolokia.password readinessProbe: httpGet: path: /readiness port: 8088 scheme: HTTPS initialDelaySeconds: 10 livenessProbe: httpGet: path: /liveness port: 8088 scheme: HTTPS initialDelaySeconds: 180 resources: limits: memory: 512Mi ports: - containerPort: 8778 name: jolokia - containerPort: 8088 name: radan-http protocol: TCP - containerPort: 8883 name: secure-mqtt protocol: TCP - containerPort: 1883 name: mqtt protocol: TCP securityContext: privileged: false volumeMounts: - mountPath: /etc/config name: conf - mountPath: /etc/secrets name: secrets readOnly: true - mountPath: /etc/tls name: tls readOnly: true + - image: jaeger-agent + name: jaeger-agent + ports: + - containerPort: 5775 + protocol: UDP + - containerPort: 5778 + - containerPort: 6831 + protocol: UDP + - containerPort: 6832 + protocol: UDP + command: + - \u0026quot;/go/bin/agent-linux\u0026quot; + - \u0026quot;--collector.host-port=jaeger-collector.jaeger.svc:14267\u0026quot; + env: + - name: JAEGER_SERVICE_NAME + value: hono-adapter-mqtt volumes: - name: conf configMap: name: hono-adapter-mqtt-vertx-config - name: secrets secret: secretName: hono-mqtt-secrets - name: tls secret: secretName: hono-adapter-mqtt-vertx-tls  The important parts are only the modifications, which add a new image stream trigger, and also add the additional agent container to the deployment. This example assumes that the Jaeger collector will be available at the hostname jaeger-collector.jaeger.svc. This will be true if you follow the next section on deploying a development-only Jaeger cluster. Should you deploy Jaeger differently, then this hostname and/or port may be different.\nDeploy Jaeger Setting up a full Jaeger cluster is a complicated task. However there is a good tutorial at the Jaeger repository at: https://github.com/jaegertracing/jaeger-openshift\nA simple deployment, for testing purposes only, can be performed by running the development setup template of Jaeger for OpenShift:\noc new-project jaeger oc process -f https://raw.githubusercontent.com/jaegertracing/jaeger-openshift/master/all-in-one/jaeger-all-in-one-template.yml | oc create -f -  Please be aware of the official note in the documentation:\n This template uses an in-memory storage with a limited functionality for local testing and development. Do not use this template in production environments.\n Using the installation All following examples make use of the running Hono instance. They pretty much follow the other examples. Please note that, compared to the more simple OpenShift deployment, in this case we need to take care of different project names when looking up route host names via oc get. You can use the command line argument -n \u0026lt;project\u0026gt; to specify the project name without changing the default selected project.\nAll examples in the following sub-sections assume that you are located in the cli directory.\nExtract certificates In order to connect the external consumer to Enmasse, we need to extract the certificate which messaging endpoint of EnMasse uses. This allows to validate the connection to the endpoint and encrypt the communication using TLS.\nThe following command extracts the certificate of the endpoint (not the key):\noc -n hono get addressspace default -o jsonpath={.status.endpointStatuses[?(@.name==\\'messaging\\')].cert} | base64 -d \u0026gt; target/config/hono-demo-certs-jar/tls.crt  This will retrieve the certificate, decode the base64 encoded string and store it in the file target/config/hono-demo-certs-jar/tls.crt. Although the file is a \u0026ldquo;demo cert\u0026rdquo; as the path might indicate, it still is stored in the same location in order to align the with the other example commands of the Hono documentation.\nRunning consumer As described in the Getting Started guide, data produced by devices is usually consumed by downstream applications which connect directly to the router network service. You can start the client from the cli folder as follows:\nmvn spring-boot:run -Dspring-boot.run.arguments=--hono.client.host=$(oc -n hono get addressspace default -o jsonpath={.status.endpointStatuses[?(@.name==\\'messaging\\')].externalHost}),--hono.client.port=443,--hono.client.username=consumer,--hono.client.password=verysecret,--hono.client.trustStorePath=target/config/hono-demo-certs-jar/tls.crt  Register device In order to upload telemetry data to Hono, the device needs to be registered with the system. You can register the device using the Device Registry by running the following command (i.e. for a device with ID 4711):\ncurl -X POST -i -H 'Content-Type: application/json' -d '{\u0026quot;device-id\u0026quot;: \u0026quot;4711\u0026quot;}' https://$(oc get -n hono route hono-service-device-registry-https --template='{{.spec.host}}')/registration/DEFAULT_TENANT  Uploading Telemetry with HTTP After having the device registered, uploading telemetry is just a simple HTTP POST command to the HTTP Adapter:\ncurl -X POST -i -u sensor1@DEFAULT_TENANT:hono-secret -H 'Content-Type: application/json' --data-binary '{\u0026quot;temp\u0026quot;: 5}' https://$(oc -n hono get route hono-adapter-http-vertx-sec --template='{{.spec.host}}')/telemetry "
},
{
	"uri": "https://www.eclipse.org/hono/docs/deployment/create-kubernetes-cluster/",
	"title": "Setting up a Kubernetes Cluster",
	"tags": [],
	"description": "",
	"content": "This guide describes how to set up a Kubernetes cluster which can be used to run Eclipse Hono.\nHono can be deployed to any Kubernetes cluster running version 1.11 or newer. This includes OpenShift (Origin) which is built on top of Kubernetes.\nThe Kubernetes web site provides instructions for setting up a (local) cluster on bare metal and/or virtual infrastructure from scratch or for provisioning a managed Kubernetes cluster from one of the popular cloud providers.\n\nSetting up a local Development Environment The easiest option is to set up a single-node cluster running on a local VM using the Minikube project. This kind of setup is sufficient for evaluation and development purposes. Please refer to Kubernetes\u0026rsquo; Minikube setup guide for instructions on how to set up a cluster locally.\nThe recommended settings for a Minikube VM used for running Hono\u0026rsquo;s example setup are as follows:\n cpus: 2 memory: 8192 (MB)  The command to start the VM will look something like this:\nminikube start --cpus 2 --memory 8192  After the Minikube VM has started successfully, the minikube tunnel command should be run in order to support Hono\u0026rsquo;s services being deployed using the LoadBalancer type. Please refer to the Minikube Networking docs for details.\n Supported Kubernetes Versions Minikube will use the most recent Kubernetes version that was available when it has been compiled by default. Hono should run on any version of Kubernetes starting with 1.13.6. However, it has been tested with several specific versions only so if you experience any issues with running Hono on a more recent version, please try to deploy to 1.13.6 before raising an issue. You can use Minikube\u0026rsquo;s --kubernetes-version command line switch to set a particular version.  Setting up a Production Environment Setting up a multi-node Kubernetes cluster is a more advanced topic. Please follow the corresponding links provided in the Kubernetes documentation.\nSetting up a Cluster using Azure Kubernetes Service The following sections provide step-by-step instructions for setting up a Kubernetes cluster on Microsoft Azure that can be used to run Hono.\nPrepare Environment At this step we expect you have clean Ubuntu VM or PC (tested on Ubuntu 18.04.2 LTS (GNU/Linux 4.18.0-1013-azure x86_64))\nInstall azure cli sudo apt-get update sudo apt-get install curl apt-transport-https lsb-release gpg curl -sL https://packages.microsoft.com/keys/microsoft.asc | \\ gpg --dearmor | \\ sudo tee /etc/apt/trusted.gpg.d/microsoft.asc.gpg \u0026gt; /dev/null AZ_REPO=$(lsb_release -cs) echo \u0026quot;deb [arch=amd64] https://packages.microsoft.com/repos/azure-cli/ $AZ_REPO main\u0026quot; | \\ sudo tee /etc/apt/sources.list.d/azure-cli.list sudo apt-get update sudo apt-get install azure-cli  Install Kubectl The kubectl tool is used to manage a Kubernetes cluster from the command line. Follow the installation guide in order to set up kubectl on your local machine.\nLog in to Azure Type\naz login  and follow instructions on screen.\nA result of successful log in will be a JSON output with subscription details. Run the following command, using the subscription id from the JSON structure:\naz account set -s \u0026quot;{YOUR SUBSCRIPTION ID}\u0026quot;  Before we continue, let\u0026rsquo;s setup some variables, that will be used to create resources on Azure:\n# Name of your Resource Group, where all services will be deployed AKS_RESOURCE_GROUP={YOUR-RG-NAME} # Name of your AKS cluster AKS_CLUSTER_NAME={YOUR-AKS-NAME} # Name of your private container registry (should match ^[a-zA-Z0-9]*$) ACR_NAME={YOUR-ACR-NAME}  Create Resource Group for Hono Deployment az group create --name $AKS_RESOURCE_GROUP --location westeurope  Create private Container Registry on Azure az acr create --resource-group $AKS_RESOURCE_GROUP --name $ACR_NAME --sku Basic  The full name of the private container registry will be $ACR_NAME.azurecr.io. This name needs to be used with the docker push command when pushing container images to the registry.\nLog in to Container Registry sudo az acr login --name $ACR_NAME  Create Azure Kubernetes Service Cluster Now it\u0026rsquo;s time to create the AKS cluster.\nCreate Service Principal az ad sp create-for-rbac --skip-assignment  If successful, appId and password will be displayed.\nCreate Cluster # It is recommended to use kubernetes 1.12.5 or higher # To list available versions run: # az aks get-versions --location westeurope --output table az aks create --name $AKS_CLUSTER_NAME --resource-group $AKS_RESOURCE_GROUP --node-count 3 --generate-ssh-keys --service-principal \u0026quot;{appId}\u0026quot; --client-secret \u0026quot;{password}\u0026quot; --enable-addons monitoring --kubernetes-version 1.13.5  Set Cluster as current Context for kubectl az aks get-credentials --resource-group $AKS_RESOURCE_GROUP --name $AKS_CLUSTER_NAME  Create ClusterRoleBinding for Kubernetes dashboard # By default, AKS is deployed with RBAC enabled. Refer to this doc: https://docs.microsoft.com/en-us/azure/aks/kubernetes-dashboard kubectl create clusterrolebinding kubernetes-dashboard --clusterrole=cluster-admin --serviceaccount=kube-system:kubernetes-dashboard  Deploy Helm\u0026rsquo;s Tiller Service kubectl create serviceaccount --namespace kube-system tiller kubectl create clusterrolebinding tiller-cluster-rule --clusterrole=cluster-admin --serviceaccount=kube-system:tiller helm init --service-account tiller  Grant AKS Cluster access to Container Registry # Get the id of the service principal configured for AKS CLIENT_ID=$(az aks show --resource-group $AKS_RESOURCE_GROUP --name $AKS_CLUSTER_NAME --query \u0026quot;servicePrincipalProfile.clientId\u0026quot; --output tsv) # Get the ACR registry resource id ACR_ID=$(az acr show --name $ACR_NAME --resource-group $AKS_RESOURCE_GROUP --query \u0026quot;id\u0026quot; --output tsv) # Create role assignment az role assignment create --assignee $CLIENT_ID --role acrpull --scope $ACR_ID  (Optional) Create retain StorageClass for the Device Registry With the reclaim policy retain AKS ensures that your storage persists even through Hono redeployments.\nCreate a file managed-premium-retain.yaml with the following content.\nkind: StorageClass apiVersion: storage.k8s.io/v1 metadata: name: managed-premium-retain provisioner: kubernetes.io/azure-disk reclaimPolicy: Retain parameters: storageaccounttype: Premium_LRS kind: Managed  Now apply to your AKS cluster:\nkubectl apply -f managed-premium-retain.yaml  Note: in your helm deployment later you have to set the value deviceRegistry.storageClass=managed-premium-retain.\nMonitoring You can monitor your cluster using Azure Monitor Insights.\nNavigate to https://portal.azure.com -\u0026gt; your resource group -\u0026gt; your kubernetes cluster\nOn an overview tab you fill find an information about your cluster (status, location, version, etc.). Also, here you will find a \u0026ldquo;Monitor Containers\u0026rdquo; link. Navigate to \u0026ldquo;Monitor Containers\u0026rdquo; and explore metrics and statuses of your Cluster, Nodes, Controllers and Containers.\nAnother option is to use the kubernetes dashboard. To do this, run:\naz aks browse --resource-group $AKS_RESOURCE_GROUP --name $AKS_CLUSTER_NAME  This will create a port forward for Kubernetes\u0026rsquo; dashboard on your local port 8001. Open http://127.0.0.1:8001 in your browser and select Namespace hono, check status of your services, pods, etc.\nCleaning up Use the following command to delete all created resources (incl. the Kubernetes cluster and the private container registry) once they are no longer needed:\naz group delete --name $AKS_RESOURCE_GROUP --yes --no-wait  Links  Azure CLI Azure Kubernetes Service Azure Container Registry "
},
{
	"uri": "https://www.eclipse.org/hono/docs/deployment/resource-limitation/",
	"title": "Limiting Resource Usage",
	"tags": [],
	"description": "",
	"content": "Deploying Eclipse Hono\u0026trade; to a container orchestration platform is easy thanks to the provided Docker images. This page provides some guidance for configuring the resource consumption of these containers in order to make sure that they get enough memory and CPU to run properly, but to also make sure that individual containers do not use up all the resources causing other containers to starve.\nDocker itself provides means to limit a container\u0026rsquo;s consumption of memory and CPU resources by means of command line options that can be set when starting up a container. Both Kubernetes and OpenShift leverage this mechanism when defining resource limits of a pod. Please refer to the corresponding documentation of Docker, Kubernetes and OpenShift for details regarding the particular syntax to be used.\nJava\u0026rsquo;s View of the World Hono\u0026rsquo;s service components are implemented in Java. When the corresponding Docker container for such a service is started, the only process being run inside the container is therefore a Java virtual machine (JVM). On startup, the JVM tries to determine the amount of memory and the number of CPU cores that it can use to execute workloads. By default the JVM queries the operating system for the corresponding parameters and adjusts its runtime parameters accordingly, e.g. it will by default limit the size of its heap memory to a quarter of the total memory available in order to leave enough memory for other processes running on the same system.\nThis is a reasonable approach when running on bare metal or a VM where other processes are expected to be running on the same machine, thus competing for the same computing resources. However, containers are usually configured to run a single process only so that it makes more sense to dedicate almost all of the available resources to running that process, leaving the (small) rest for the operating system itself.\nAs described above, a Docker container can easily be configured with a limit for memory and CPU resources that it may use during runtime. These limits are set and enforced using Linux CGroups. When a Java VM is run inside of such a Docker container which has been configured with a memory limit, then the result of the JVM\u0026rsquo;s attempt to determine the available resources during startup will not reflect the memory limit imposed on the container. That is because the JVM by default does not consider the CGroup limit but instead queries the operating system for the overall amount of memory available. The same is true for the way that the JVM determines the number of available CPU cores.\nAs described above, a Docker container can easily be configured with a limit for memory and CPU resources that it may use during runtime. These limits are set and enforced using Linux CGroups. When a pre version 9 Java VM is run inside of such a Docker container which has been configured with a memory limit, then the result of the JVM\u0026rsquo;s attempt to determine the available resources during startup will not reflect the memory limit imposed on the container. That is because the JVM by default does not consider the CGroup limit but instead queries the operating system for the overall amount of memory available. The same is true for the way that the JVM determines the number of available CPU cores. Starting with version 9 Java correctly determines the amount of memory and CPUs available when running in a container.\nLimiting a Container\u0026rsquo;s Memory Consumption Java 8 OpenJDK 8 has introduced the experimental -XX:+UseCGroupMemoryLimitForHeap option to make the JVM consider CGroup limits when determining the amount of available memory. Using this option, it is possible to explicitly configure a Java 8 VM\u0026rsquo;s memory consumption within the boundaries of the container\u0026rsquo;s (limited) resources. However, the JVM will still only allocate a quarter of the (limited) amount of memory, thus leaving a lot of the memory available to the container unused.\nEither of the following JVM options can be used in Java 8 in order to change this behavior:\n -XX:MaxRAMFraction can be used to set the fraction of total memory that may be allocated for the heap. The default value is 4 (meaning that up to a quarter of the memory will be allocated), so in order to increase the amount of memory, the value can be set to 2 (using up to 50% of the memory) or 1 (using up to 100% of the memory). Setting the option to 1 is strongly discouraged because it would leave no memory left for the JVM\u0026rsquo;s other memory areas nor any additional processes run by the operating system. -Xmx can be used to explicitly set the maximum amount of memory used for the heap. As a rule of thumb, setting this value to 60-70% of the container\u0026rsquo;s (limited) amount of memory should usually work. Based on the application\u0026rsquo;s memory usage characteristics, increasing the value to 80 or even 90% might also work.  Java 9 and later Starting with Java 9, the JVM will correctly determine the total memory and number of CPUs available when running inside of a container. All of the Docker images provided by Hono run with OpenJDK 11 by default, thus ensuring that the JVM considers any memory limits configured for the container when configuring its heap during startup. However, the default algorithm will still only allocate a quarter of the (limited) amount of memory, thus leaving a lot of memory available to the container unused.\nThe following JVM options can be used in Java 9 and later in order to change this behavior:\n -XX:MinRAMPercentage, -XX:MaxRAMPercentage and -XX:InitialRAMPercentage can be used to set the (minimum, maximum and initial) percentage of total memory that may be allocated for the heap. A value of 70-80% should work if no other processes are running in the same container.  Kubernetes In Kubernetes (and OpenShift) the resource limits for a pod, and thus the container(s) that are part of the pod, can be configured in the corresponding PodSpec. The following example from the HTTP adapter\u0026rsquo;s Kubernetes Deployment resource descriptor illustrates the mechanism:\napiVersion: apps/v1beta1 kind: Deployment metadata: name: hono-adapter-http-vertx spec: template: metadata: labels: app: hono-adapter-http-vertx version: \u0026quot;${project.version}\u0026quot; group: ${project.groupId} spec: containers: - image: eclipse/hono-adapter-http-vertx:${project.version} name: eclipse-hono-adapter-http-vertx resources: limits: memory: \u0026quot;256Mi\u0026quot; ports: - containerPort: 8080 protocol: TCP env: - name: SPRING_CONFIG_LOCATION value: file:///etc/hono/ - name: SPRING_PROFILES_ACTIVE value: dev - name: LOGGING_CONFIG value: classpath:logback-spring.xml - name: _JAVA_OPTIONS value: \u0026quot;-XX:MinRAMPercentage=80 -XX:MaxRAMPercentage=80\u0026quot; volumeMounts: - mountPath: /etc/hono name: conf readOnly: true volumes: - name: conf secret: secretName: hono-adapter-http-vertx-conf  The resources property defines the overall limit of 256 MB of memory that the pod may use. The _JAVA_OPTIONS environment variable is again used to configure the JVM to use 80% of the total memory for its heap.\nLimiting the Number of Device Connections Hono supports limiting the overall number of simultaneously connected devices per tenant. Please refer to the connections limit concept for more information. The limit needs to be configured at the tenant level using the resource-limits configuration property. Please refer to the Tenant API for configuration details.\nLimiting the Number of Messages Hono supports limiting the number of messages that devices of a tenant can publish to Hono during a given time interval. Please refer to the messages limit concept for more information. The limit needs to be configured at the tenant level using the resource-limits configuration property. Please refer to the Tenant API for configuration details.\n"
},
{
	"uri": "https://www.eclipse.org/hono/docs/architecture/",
	"title": "Architecture",
	"tags": [],
	"description": "",
	"content": " Architecture Get an overview over Hono\u0026rsquo;s architecture.\n"
},
{
	"uri": "https://www.eclipse.org/hono/docs/architecture/component-view/component-view/",
	"title": "Component View",
	"tags": [],
	"description": "",
	"content": "This page describes the high level components constituting an Eclipse Hono\u0026trade; instance and their relations to each other.\nTop Level The diagram below provides an overview of the top level logical components.\n  The MQTT and HTTP Adapters use the Device Registry to authenticate Devices connecting to the adapters and asserting their registration status. The adapters then forward the telemetry data and events received from the devices to the AMQP 1.0 Messaging Network for delivery to Business Applications. Business applications also use the messaging network to send commands to connected devices.\nThe Device Registry uses the Auth Server to authenticate the protocol adapters during connection establishment.\nAll interactions between the components are based on AMQP 1.0 message exchanges as defined by the\n Credentials API, Tenant API, Device Registration API, Command \u0026amp; Control API, Telemetry API and Event API.  Device Registry The diagram below provides an overview of the Device Registry component\u0026rsquo;s internal structure.\n  The Device Registry component implements the Credentials API, Tenant API and Device Registration API. Clients opening a connection to SimpleDeviceRegistryServer are authenticated by means of an external service accessed via the Auth port. The FileBasedCredentialsService, FileBasedTenantService and FileBasedRegistrationService store all data in the local file system. The Device Registry is therefore not recommended to be used in production environments because the component cannot easily scale out horizontally. It is mainly intended to be used for demonstration purposes and PoCs. In real world scenarios, a more sophisticated implementation should be used that is designed to scale out, e.g. using a persistent store for keeping device registration information that can be shared by multiple instances.\nAMQP 1.0 Messaging Network The AMQP 1.0 Messaging Network is not per se a component being developed as part of Hono. Instead, Hono comes with a default implementation of the messaging network relying on artifacts provided by other open source projects. The default implementation currently consists of a single Apache Qpid Dispatch Router instance connected to a single Apache Artemis broker instance. Note that this setup is useful for development purposes but will probably not meet requirements regarding e.g. scalability of real world use cases.\nThe diagram below provides an overview of the default implementation of the Messaging Network component used with Hono.\n  Scaling out messaging infrastructure is a not a trivial task. Hono does not provide an out-of-the-box solution to this problem but instead integrates with the EnMasse project which aims at providing Messaging as a Service infrastructure.\n"
},
{
	"uri": "https://www.eclipse.org/hono/docs/architecture/auth/auth/",
	"title": "Authentication/Authorization",
	"tags": [],
	"description": "",
	"content": "This page describes how authentication and authorization of devices, consumers (back end applications) and system components works in Hono.\nRequirements  Devices are authenticated and authorized when they connect to a protocol adapter. Consumers are authenticated and authorized when they connect to a Dispatch Router instance. System components are authenticated and authorized when they connect to each other. Credentials and authorization rules can be managed centrally, i.e. credentials and rules do not need to be configured manually on each component.  How it works today The following diagram provides an overview of the components involved in use cases requiring authentication and authorization.\n  Device Auth Both the HTTP adapter as well as the MQTT adapter require devices to authenticate during connection establishment by default. Both rely on the Credentials API to help in verifying credentials provided by a device. Please refer to Device Authentication for a general overview of Hono\u0026rsquo;s approach to authenticating devices and to the protocol adapter user guides for specifics regarding how devices can authenticate to the corresponding protocol adapters.\nSystem Component Auth Client components opening an AMQP connection to a server component are authenticated using SASL PLAIN as specified in RFC 4422. The server component takes the authentication information provided by the client component and opens a connection to the Auth Server, using the credentials provided by the client in its SASL PLAIN exchange with the server component. On successful authentication the Auth Server issues a JSON Web Token (JWT) asserting the client\u0026rsquo;s identity and its granted authorities to the server component. The server component then attaches this token to its AMQP connection with the client and from then on uses it to make authorization decisions regarding the client\u0026rsquo;s requests. See Authentication API for details regarding the authentication process and the format of the tokens issued by the Auth Server.\nBased on the components shown above, the following sequence diagram shows how the MQTT Adapter connects to the Device Registry and gets authenticated transparently using the Auth Server.\n  Client components are authorized whenever they open a new AMQP link on an existing connection to the server. When a client tries to open a receiver link, the server checks if the client is authorized to read from the source address the client has specified in its AMQP attach frame. Analogously, when a client tries to open a sender link, the server checks if the client is authorized to write to the target address from the client\u0026rsquo;s attach frame.\nService implementations may additionally authorize individual (request) messages received from the client, e.g. based on the message\u0026rsquo;s subject property which is used by Hono\u0026rsquo;s AMQP 1.0 based APIs to indicate the operation to invoke. In such a case the server checks if the client is authorized to execute the operation indicated by the message subject on the link\u0026rsquo;s target address.\nApplication Auth Business Applications connect to the AMQP 1.0 Messaging Network in order to consume telemetry data and events and send commands to devices. It is therefore the responsibility of the AMQP Network to properly authenticate and authorize the application.\nThe Apache Qpid Dispatch Router which is used in Hono\u0026rsquo;s example deployment can be configured to authenticate consumers using arbitrary SASL mechanisms. Access to addresses for receiving messages can be restricted to certain identities. The Dispatch Router instance which is used in the example deployment is configured to delegate authentication of clients to the Auth Server by means of its Auth Service Plugin mechanism. This mechanism works in a very similar way as described above for the authentication of system components. The main difference is that the clients\u0026rsquo; authorities are not transferred by means of a JSON Web Token but instead are carried in a property of the Auth Server\u0026rsquo;s AMQP open frame.\nManagement of Identities and Authorities The identities and corresponding authorities that the Auth Server uses for verifying credentials and issuing tokens are defined in a configuration file (services/auth/src/main/resources/permissions.json) read in during start-up of the Auth Server. These authorities are used for authenticating and authorizing system components as well as Business Applications.\nPlease refer to the Dispatch Router documentation for details regarding configuration of Dispatch Router security.\nFuture Approach In the long run Hono will still use tokens for authenticating clients but will use a policy based approach for authorizing requests, i.e. authorization decisions will be made by a central policy enforcement component. Hono services will pass in the client\u0026rsquo;s token, the resource being accessed and the intended action along with potentially other attributes to the policy enforcement component which will then make the authorization decision based on the configured rules (policy) and return the outcome to the component.\n"
},
{
	"uri": "https://www.eclipse.org/hono/docs/categories/",
	"title": "Categories",
	"tags": [],
	"description": "",
	"content": ""
},
{
	"uri": "https://www.eclipse.org/hono/docs/tags/",
	"title": "Tags",
	"tags": [],
	"description": "",
	"content": ""
}]