Authorization

There are two authorization methods:

• Using X.509 certificates.
• Using a username and password.

You can use both X.509 certificates and passwords at the same time. Note that passwords have a higher priority than certificates. The table below describes different ways to use a certificate and password simultaneously during authorization.

Certificate	Password	Authorization
Invalid	Invalid	Authorization fails.
Invalid	Correct	Authorization is successful.
Correct	Invalid	Authorization fails.
Correct	Correct	Authorization using a username and password is successful.
Correct, but for a different device	Correct	Authorization is performed on behalf of the device whose ID is specified in the username.

Authorization using certificates

When logging in with X.509 certificates, private keys and certificates stored as .pem files are used. They are stored on a device or in a registry.

• For a private key, you specify the path to the .pem file when sending messages or subscribing to receive messages.
• You add the certificate to the device or registry and specify the path to the .pem file with the certificate when sending messages or subscribing to receive messages.

Authorization using a username and password

When logging in with your username and password:

• The username is the ID of the device or registry.
• The password is a combination of characters that you specify. You can also generate your password via the YC CLI.
  • Minimum password length is 14 characters.
  • The password must contain 3 out of 4 groups of characters: lowercase Latin letters, uppercase Latin letters, numbers, and special characters.

See also

• Relationship between service resources.
• Create a certificate.
• Managing device certificates.
• Managing registry certificates.
• Managing device passwords.
• Managing registry passwords.