Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow Redis usage with username #1065

Merged
merged 2 commits into from
May 29, 2024
Merged

Conversation

ZakarFin
Copy link
Member

@ZakarFin ZakarFin commented May 29, 2024

Also adds credentials handling for the redis-session profile and cache syncing for clustered environments. After this it's possible to configure one or both as Redis credentials on oskari-ext.properties:

redis.user=user
redis.password=passwd

If these properties are not defined the code will work like without credentials. If you have the keys with empty values, things will probably not work.

Previously a password could be configured the basic Redis connectivity, but it wasn't used for storing/accessing session information on the redis-session profile (this didn't work at all for redis-server that requires credentials resulting in exception like NOPERM this user has no permissions to access one of the keys used as arguments.) or for the pub/sub functionality that the caching uses for syncing changes between servers. Password can be configured on Redis versions <6 and the user can be used on 6+.

https://redis.io/docs/latest/operate/oss_and_stack/management/security/acl/

This allows for example creating a user named user with password passwd on redis-cli:

ACL SETUSER user on >passwd ~* +@all

With ~* meaning access to all keys and +@all means access to all commands. On Redis 6.2 there is also &* which means pub/sub for anything and it might be required for the cache syncing.

@ZakarFin ZakarFin added this to the 2.13.1 milestone May 29, 2024
@ZakarFin ZakarFin merged commit 00363bb into oskariorg:develop May 29, 2024
2 checks passed
@ZakarFin ZakarFin deleted the redis-creds branch May 29, 2024 15:57
@ZakarFin
Copy link
Member Author

Looks like &* is not required for cluster communication even on Redis 6.2.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant