Skip to content

[NEW] Database-level ACL #8099

@ipmb

Description

@ipmb

The problem/use-case that the feature addresses

Extend ACL to include a way to restrict users to a specific database. This would make it possible to assign individual databases to a user, opening the possibiity for a single Redis instance to be multi-tenant.

Description of the feature

Craft an ACL that only allows a user to connect/select a specific database.

Alternatives you've considered

I tried the suggestion in #7368, but it does not work in all scenarios:

  1. Create user

    127.0.0.1:6379> ACL SETUSER alice on >password +@all ~* -select +select|5
    OK
    
  2. Authenticating as that user and then selecting a database does work as expected:

    127.0.0.1:6379> AUTH alice password
    OK
    127.0.0.1:6379> select 1
    (error) NOPERM this user has no permissions to run the 'select' command or its subcommand
    127.0.0.1:6379> select 5
    OK
    127.0.0.1:6379[5]> SET test 1
    OK
    
  3. It does not seem to work, however, when connecting via the CLI:

    $ redis-cli --user alice --pass password -n 1
    Warning: Using a password with '-a' or '-u' option on the command line interface may not be safe.
    127.0.0.1:6379[1]> SET test 1
    OK
    

Additional information

Currently the only way to do this is to spin up multiple Redis instances which isn't always desirable/feasible, especially when using a hosted solution that bills per instance. My use case is for ephemeral non-production web applications that need access to a single Redis database. Ideally these could get full access to a database on a single instance similar to how you might manage multiple tenants on MySQL or Postgres.

Metadata

Metadata

Assignees

No one assigned

    Labels

    state:to-be-closedrequesting the core team to close the issue

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions