-
Notifications
You must be signed in to change notification settings - Fork 24.5k
Description
The problem/use-case that the feature addresses
Extend ACL to include a way to restrict users to a specific database. This would make it possible to assign individual databases to a user, opening the possibiity for a single Redis instance to be multi-tenant.
Description of the feature
Craft an ACL that only allows a user to connect/select a specific database.
Alternatives you've considered
I tried the suggestion in #7368, but it does not work in all scenarios:
-
Create user
127.0.0.1:6379> ACL SETUSER alice on >password +@all ~* -select +select|5 OK -
Authenticating as that user and then selecting a database does work as expected:
127.0.0.1:6379> AUTH alice password OK 127.0.0.1:6379> select 1 (error) NOPERM this user has no permissions to run the 'select' command or its subcommand 127.0.0.1:6379> select 5 OK 127.0.0.1:6379[5]> SET test 1 OK -
It does not seem to work, however, when connecting via the CLI:
$ redis-cli --user alice --pass password -n 1 Warning: Using a password with '-a' or '-u' option on the command line interface may not be safe. 127.0.0.1:6379[1]> SET test 1 OK
Additional information
Currently the only way to do this is to spin up multiple Redis instances which isn't always desirable/feasible, especially when using a hosted solution that bills per instance. My use case is for ephemeral non-production web applications that need access to a single Redis database. Ideally these could get full access to a database on a single instance similar to how you might manage multiple tenants on MySQL or Postgres.