EMQX has several auth modules. We use the Mnesia auth module with HTTP API client id provisioning. They also have NanoMQ, a MQTT broker for IoT edge (on resource constrained devices). The documentation is also quite decent compared to this.

https://www.emqx.io/docs/en/latest/access-control/authn/auth...

They have a community edition available as a docker image or packages for popular Linux distros.

https://www.emqx.com/en/try?product=broker

RabbitMQ?

https://www.rabbitmq.com/oauth2.html

You should check out Solace's multi-protocol broker (free version: https://solace.com/downloads/) with support for MQTT, AMQP, SMF, REST, Websocket

It supports integration with OAuth, LDAP, Radius, ,...

Shameless plug since i'm a contributor but VerneMQ [1] is a pretty programmable one. You have options from using webhooks to writting your plugins in Lua or Erlang/Elixir.

* https://github.com/vernemq/vernemq

Not sure about multi-tenancy, but I’ve been using VerneMQ with the Postgesql auth backend.

Have a look at Apache Artemis