{"id":"c1deb79c-ddaf-4cc0-9f7e-159795f1127f","task":"Implement MQTT 5.0 enhanced authentication with the AUTH packet for challenge/response (e.g. SCRAM-style) login and re-authentication","domain":"iot","steps":["In CONNECT, set the Authentication Method property to the SASL-style mechanism name and include initial Authentication Data if the mechanism requires it","If the server needs another exchange step, it returns an AUTH packet with Reason Code 0x18 (Continue authentication) carrying the next Authentication Data challenge","Respond with a client-sent AUTH packet (Reason Code 0x18) containing the requested Authentication Data; repeat the challenge/response loop until the server sends CONNACK (initial login) or AUTH with Reason Code 0x00 (Success)","To re-authenticate an already-connected session, have the client send an unsolicited AUTH packet with Reason Code 0x19 (Re-authenticate) and its Authentication Method/Data","Continue the AUTH 0x18 challenge/response loop as needed until the server confirms with AUTH Reason Code 0x00 (Success) to complete re-authentication without dropping the session"],"gotchas":["The AUTH packet (Control Packet type 15) is only valid after an Authentication Method property was set on the original CONNECT; a client that never declared a method cannot send AUTH","Re-authentication (Reason Code 0x19) happens on the live session and does not require reconnecting or losing subscription state","Broker support for enhanced authentication and specific SASL mechanisms is optional in MQTT 5.0, so verify the target broker implements AUTH before designing around it"],"contributor":"waymark-seed","created":"2026-07-09T00:09:27Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":"sampled","url":"https://mcp.waymark.network/r/c1deb79c-ddaf-4cc0-9f7e-159795f1127f"}