# Implementing JWT authentication with a HiveMQ Cloud broker (Starter Plan) for remote equipment access **URL:** \ **Category:** Tools\ **Tags:** security\ **Created:** [July 27, 2024, 2:57am UTC](https://accelerated-discovery.org/t/implementing-jwt-authentication-with-a-hivemq-cloud-broker-starter-plan-for-remote-equipment-access/256 "2024-07-27T02:57:52Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![sgbaird](https://yyz1.discourse-cdn.com/flex003/user_avatar/accelerated-discovery.org/sgbaird/32/341_2.png) [@sgbaird](https://accelerated-discovery.org/u/sgbaird)\ **Post date:** [July 27, 2024, 2:57am UTC](https://accelerated-discovery.org/t/implementing-jwt-authentication-with-a-hivemq-cloud-broker-starter-plan-for-remote-equipment-access/256/1 "2024-07-27T02:57:52Z")
I’m diving a bit deeper into an implementation of [temporary credentials for remote access to equipment](https://accelerated-discovery.org/t/assigning-temporary-credentials-for-remote-access-to-equipment/241/4), carrying on from [this comment](https://accelerated-discovery.org/t/assigning-temporary-credentials-for-remote-access-to-equipment/241/4): > I will try the JWT tokens issued by [Auth0](https://auth0.com/) and passed to a HiveMQ “Starter Plan” broker. Still figuring out the details, such as the web app for requesting a token (perhaps [a Streamlit Web App in Hugging Face Spaces](https://huggingface.co/spaces/AccelerationConsortium/digital-pipette) [[2](https://chatgpt.com/share/131b6bdf-373e-4b85-83ae-212ce368e42c)] or a [Flask App in PythonAnywhere](https://help.pythonanywhere.com/pages/Flask/)), since it seems like I can’t host that natively in Auth0. > > See also a somewhat lengthy [ChatGPT transcript](https://chatgpt.com/share/641f3f73-3fa7-431d-b2c1-dbcc43b1bab3). > > Aside: By switching to JWT for the broker, it disables the typical username/password authentication I’ve been used to with HiveMQ. Some observations: 1. Hugging Face Spaces with Gradio has [a very easy “login with Hugging Face” button](https://www.gradio.app/guides/sharing-your-app#o-auth-login-via-hugging-face) (also [possible but more involved](https://huggingface.co/docs/hub/en/spaces-oauth) to do with e.g., streamlit), which would address the concern of having some kind of firewall or barrier for people to request access, but may be redundant since I still need a JWKS endpoint to give to HiveMQ for JWT generation. 2. [GitHub - conradbez/streamlit-auth0](https://github.com/conradbez/streamlit-auth0) is another option that might speed up that “first pass” authentication 3. Redis was mentioned as a potential solution for queue management [[transcript](https://chatgpt.com/share/463e7616-44b0-4765-a3ad-771e85c2a92f)] 4. When trying to use Auth0 within a streamlit app, I’m confused on what to put for REDIRECT\_URL [[transcript](https://chatgpt.com/share/131b6bdf-373e-4b85-83ae-212ce368e42c)] ---
**Author:** ![sgbaird](https://yyz1.discourse-cdn.com/flex003/user_avatar/accelerated-discovery.org/sgbaird/32/341_2.png) [@sgbaird](https://accelerated-discovery.org/u/sgbaird)\ **Post date:** [August 24, 2024, 1:23am UTC](https://accelerated-discovery.org/t/implementing-jwt-authentication-with-a-hivemq-cloud-broker-starter-plan-for-remote-equipment-access/256/2 "2024-08-24T01:23:06Z")
There are simpler, less robust options: > **[Simple Authentication for Streamlit Apps](https://discuss.streamlit.io/t/simple-authentication-for-streamlit-apps/16455?u=sgbaird)** > > Hi, Some of you may know I’m into authentication/identity and have implemented a Streamlit component for Auth0 identity integration with Streamlit apps. That’s quite an involved solution and can be intimidating for some. On the other end of the... Would be worth going through this tutorial. - [Auth0 Python SDK Quickstarts: Login](https://auth0.com/docs/quickstart/webapp/python/01-login) Following isn’t maintained, but the example is pretty simple and could likely be copied/modified. Apparently latest branch might be OK. - [GitHub - conradbez/streamlit-auth0](https://github.com/conradbez/streamlit-auth0) - [Error message after successful login · Issue #27 · conradbez/streamlit-auth0 · GitHub](https://github.com/conradbez/streamlit-auth0/issues/27) Easy gradio login button: - [app.py · templates/gradio-oauth at main](https://huggingface.co/spaces/templates/gradio-oauth/blob/main/app.py) Overall I think it will be important to get each of the MWEs working, then get slightly more complex. 1. Local Flask + Auth0 2. Local Streamlit + Auth0 3. Deployed Streamlit + Auth0 4. Hugging Face Spaces + Auth0 5. Login with Hugging Face button (gradio) 6. Login with Hugging Face button (streamlit) 7. HiveMQ Starter + Auth0 (HiveMQ JWT tutorial, just plain issuing keys) 8. Flask + HiveMQ Starter + Auth0 9. HiveMQ Starter + Hugging Face + Streamlit + Auth0 (HiveMQ JWT tutorial) ---
**Author:** ![sgbaird](https://yyz1.discourse-cdn.com/flex003/user_avatar/accelerated-discovery.org/sgbaird/32/341_2.png) [@sgbaird](https://accelerated-discovery.org/u/sgbaird)\ **Post date:** [September 4, 2024, 2:46pm UTC](https://accelerated-discovery.org/t/implementing-jwt-authentication-with-a-hivemq-cloud-broker-starter-plan-for-remote-equipment-access/256/3 "2024-09-04T14:46:57Z")
Thanks to @kenzo exploring this in depth, it seems like more effort than it’s worth at the given point, and comes with certain limitations. In particular, JWTs through Auth0 have a max expiration of 30 days. > > **[Persistent access tokens](https://community.auth0.com/t/persistent-access-tokens/107698/5)** > > In regards to PAT, this might be useful: Cheers! There may be a workaround to the expiration, but it seems somewhat involved and might not work well with HiveMQ: > **[Refresh Tokens](https://auth0.com/docs/secure/tokens/refresh-tokens#for-web-apps)** > > Describes how refresh tokens work to allow the application to ask Auth0 to issue a new access token or ID token without having to re-authenticate the user. JWTs seem to be geared more towards “sessions” rather than long-term access. Even getting Auth0 and HiveMQ connected with each other wasn’t very fruitful. Tutorials in this regard are limited or outdated. @kenzo’s suggested alternative is to use the HiveMQ API (still required to have the paid Starter Plan) to generate random passwords and remove the old ones when the new password is generated. We’ve switched the broker back from “JWT authentication” to “Access credentials” (i.e., username/password combinations). Later, we can work on adding some kind of “bot attack prevention” (i.e., a login interface or captcha verification). Some potential resources: - [GitHub - mkhorasani/Streamlit-Authenticator: A secure authentication module to manage user access in a Streamlit application.](https://github.com/mkhorasani/Streamlit-Authenticator) - [Adding Simple Authentication to Your Streamlit App | by Charan H U | Medium](https://charanhu.medium.com/adding-simple-authentication-to-your-streamlit-app-1779e849b983) - [GitHub - asehmi/auth-simple-for-streamlit: A simple username/password database authentication solution for Streamlit](https://github.com/asehmi/auth-simple-for-streamlit) - [Data-Science-Meetup-Oxford/StreamlitComponent at master · asehmi/Data-Science-Meetup-Oxford · GitHub](https://github.com/asehmi/Data-Science-Meetup-Oxford/tree/master/StreamlitComponent) In particular, the easiest (and least secure, yet still meaningful) approach is to put a single, shared/global password for all users behind some kind of wall.