Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[redis 6] Authenticate with userpass from ACL #61

Open
kodumbeats opened this issue Feb 7, 2022 · 1 comment
Open

[redis 6] Authenticate with userpass from ACL #61

kodumbeats opened this issue Feb 7, 2022 · 1 comment

Comments

@kodumbeats
Copy link

Redis 6 introduced userpass authentication with ACLs, which is used with managed Redis services offered by e.g. DigitalOcean. Though, I cannot authenticate workers because the username is not used for authentication:

// $user is not used, only $password

Expected Behavior

phpredis supports a variety of data structures to authenticate with a username and password, so I expected the username from my DSN connection string would be used:

list($host, $port, $dsnDatabase, $user, $password, $options) = self::parseDsn($server);

Current Behavior

if ($password){
$this->driver->auth($password);
}

Possible Solution

I put together the necessary patches for colinmollenhour/credis to test a very crude implementation, which I have on a fork here (please don't mind the whitespace 😅):

develop...kodumbeats:tls_connections

Context

Trying to hook up Appwrite to a Managed Redis database cluster provided by DigitalOcean but cannot due to this limitation.

@danhunsaker
Copy link
Member

The current code was written long before managed Redis was even a thing, so yes, it strips the username as Redis didn't have any use for it at the time. It literally just submits the password, because Redis itself didn't have a way to specify a user. The fact it hasn't kept pace with changes like these is part of why a refactor is planned to disconnect the hard reliance on Credis so folks can use whatever (compatible) library they want for the latest features.

Planned isn't implemented, though, so alas, we're stuck with Credis for now. I'll happily merge a PR that can pass the username as well, even if it has to retarget to a more recent Credis until we get that refactor done.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants