HiveMQ Edge 2026.12 is Released

What's New in HiveMQ Edge 2026.12

HiveMQ Edge 2026.12 introduces Single Sign-On through any standard OpenID Connect Identity Provider, bringing Edge deployments into the identity infrastructure organizations already operate. The release also includes fixes and dependency updates across the platform.

Single Sign-On for HiveMQ Edge

What It Is

HiveMQ Edge now supports Single Sign-On (SSO) through any standard OpenID Connect Identity Provider. Instead of managing a separate set of usernames and passwords on every Edge instance, operators can let their existing Identity Provider — Keycloak, Microsoft Entra ID, Okta, Auth0, or any OIDC-compliant IdP — handle login for the Edge admin UI and REST API.

For fleets of Edge nodes at the industrial edge, this is a meaningful shift. Access is governed centrally: a user is provisioned, granted a role, or offboarded once, in the Identity Provider, and that decision applies everywhere. There is no longer a local credential store to keep in sync across dozens or hundreds of gateways, and no local password to rotate or leak per node.

How It Works

When SSO is enabled, the Edge login page offers a Login with SSO button alongside the usual form. Clicking it hands the user to their Identity Provider for authentication — including any MFA or conditional-access policy the organization already enforces there. On success, the Identity Provider returns the user's identity to Edge, which reads the user's roles and issues its own short-lived token for the session. The Edge backend stays fully stateless: it holds no server-side sessions, so the design scales cleanly and adds no new persistent state to operate.

Roles stay in the Identity Provider. Edge maps the roles your Identity Provider already emits onto its three permission levels — admin, super, and user — through a role-mapping block in the configuration. Your IdP keeps using its own group or role names; Edge translates them. That means the question "who can administer this gateway?" is answered by the same directory that answers it for the rest of your infrastructure.

SSO is turned on with a single <oidc-authentication> stanza in the Edge configuration. Edge discovers the Identity Provider's endpoints automatically from its OIDC discovery document, so an operator supplies little more than the issuer URL, the client credentials, the redirect URI, and the role mappings:

    <oidc-authentication>
    <enabled>true</enabled>
    <issuer-uri>https://idp.example.com/realms/acme</issuer-uri>
    <client-id>hivemq-edge</client-id>
    <client-secret>your-client-secret</client-secret>
    <redirect-uri>https://edge.example.com/api/v1/auth/oidc/callback</redirect-uri>
    <role-mappings>
        <role-mapping>
            <idp-role>edge-admin</idp-role>
            <edge-role>admin</edge-role>
        </role-mapping>
    </role-mappings>
</oidc-authentication>
  

Local username and password login remains fully supported. It can run alongside SSO or be switched off entirely — the choice is the operator's.

For the full configuration reference — issuer, scopes, role mapping, identity-token signing algorithms, and the Identity Provider truststore — see the HiveMQ Edge Admin API authentication documentation.

How It Helps

• Central identity governance. Provisioning, role changes, and offboarding happen once in the Identity Provider and apply across the entire Edge fleet.
• No per-node credentials. Removing the local credential store from each gateway removes a class of operational drift and a per-node secret to protect.
• Existing security policy applies. MFA, conditional access, and session policy already enforced by the Identity Provider now cover Edge access too.
• Simpler audits. Access questions are answered from the same directory that governs the rest of the infrastructure.

Additional Improvements

Bug Fixes

• Data Hub listings now show all items, not just the first 50. The Data Hub lists of scripts, data policies, behavior policies, and schemas are served by a cursor-paginated API, but the UI fetched only the first page and never followed the pagination cursor. Beyond the default page size of 50, newly created items became invisible in the UI — and deleting items back under the limit made them reappear. The four list views now follow the cursor and load every page, so all items are shown regardless of how many exist.

Improvements

• Updated dependencies across the platform. Many libraries have been updated, including Logback, BouncyCastle, and the GitHub Actions build toolchain, mitigating potential security risks.

Get Started Today

Use the download link to get HiveMQ Edge 2026.12, or find us on GitHub and Docker:

Get started by running

    docker run --name hivemq-edge --pull=always -d -p 1883:1883 -p 8080:8080 hivemq/hivemq-edge
  

Or clone our repository

    git clone git@github.com:hivemq/hivemq-edge.git
  

You may also try out our Helm Chart

    helm repo add hivemq https://hivemq.github.io/helm-charts && helm repo update