CONNACK 5 (0x05) — Connection Refused: not authorized

Credentials were understood and rejected, or the client is not permitted to connect at all. Code 4 is the narrower bad-username-or-password case.

Start free MQTT / Sparkplug B → canonical

Diagnosis

When you hit this

Wrong credentials, or credentials valid on a different broker in the same estate.
An access control list that permits the user but not from that client id or IP.
TLS client-certificate authentication where the certificate is valid but the derived identity has no ACL entry.

Resolution

How to fix it

Separate authentication from authorization
Broker logs distinguish a bad password from a valid user with no permission. Code 5 is usually the latter.
Check the ACL keyed by client id
Many brokers bind permissions to a client-id pattern as well as a username. Changing the id can break a working credential.
Verify the certificate's derived identity
With mutual TLS the username often comes from the certificate CN, which may not be what you assume.

Normalization

What Forge does about it

This is a configuration or addressing mistake on the wire, upstream of anything Forge sees. Where Forge helps is the step after you fix it: once the point returns data, its vendor tag name maps to a canonical field automatically, so you do not also have to hand-maintain a name table for every point you just re-addressed.