Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ACL support with Microsoft Entra tokens #377

Closed
msft-paddy14 opened this issue May 12, 2024 · 0 comments · Fixed by #378
Closed

ACL support with Microsoft Entra tokens #377

msft-paddy14 opened this issue May 12, 2024 · 0 comments · Fixed by #378
Assignees
Labels
enhancement New feature or request

Comments

@msft-paddy14
Copy link
Contributor

Feature request type

enhancement

Is your feature request related to a problem? Please describe

Today the authentication methods include password and Microsoft Entra, however when paired with ACL, only passwords can be used. Rotation of passwords can be cumbersome and pose security risks while we manage them.
Azure Cache for Redis already supports Microsoft Entra+ ACL in non Enterprise tiers - Azure Redis.

Describe the solution you'd like

Based on this, I recommend a similar approach which at it's core will continue to use ACL based auth but will allow a configurable authenticator which can be ACL based. For parity with Azure Redis, it might make sense to use Oid as username with token as password.

User = Object ID of your managed identity or service principal
Password = Microsoft Entra token that you acquired using MSAL

At code level:
Currently ACL auth by default does username and password validation with ACL entries. We compose it with an IGarnetAuthenticator instance to inject authentication behavior of username and password and then just validate the permissions against the ACL list of the user. This approach is more favorable as it minimizes changes and avoids redundant code needed to combine behaviors of AclAuthenticator and AADAuthenticator. Rather than inheriting these behavior, we compose AclAuthenticator with an IGarnetAuthenticator.

Describe alternatives you've considered

No response

Additional context

No response

@msft-paddy14 msft-paddy14 self-assigned this May 12, 2024
@msft-paddy14 msft-paddy14 linked a pull request May 12, 2024 that will close this issue
@darrenge darrenge added the enhancement New feature or request label May 15, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants