Password Rotation support - Add a CredentialProvider interface/class and set your own provider

[oridool]

Hello,

Feature Request

Is your feature request related to a problem? Please describe

I'm using AWS SecretsManager to fetch my Redis credentials and provide them to Lettuce upon startup
However, in case I rotate the password (in Redis and in SecretsManager), I must restart my application.
Because, if the connection to Redis is lost, it will use the previous old password rather than the current one.

Describe the solution you'd like

Instead of providing a simple pair of username+password, I'd like to provide my own class, implementing a CredentialsProvider interface, and have Lettuce call it whenever a new connection is created.
This way, I will be able to always fetch the current password in my provider.
This interface just implements getUserName() / getPassword() .
Similar example for RabbitMQ:
https://github.com/rabbitmq/rabbitmq-java-client/blob/master/src/main/java/com/rabbitmq/client/impl/CredentialsProvider.java

Describe alternatives you've considered

I know Redis 6 with ACL can support multiple passwords.
However, the Lettuce client doesn't support that either as far as I know.
In addition, even if multiple passwords are supported by Lettuce - I will need to know ahead all the passwords for the near future.
This is not the most convenient and secured solution.

Thank you

[mp911de]

Thanks for your feature request. Are you interested in submitting a pull request? While such a change can touch a lot of places, I think it makes absolutely sense to introduce a CredentialsProvider. I'm not sure we want refresh() methods in the actual interface. Representing username/password as Credentials object makes more sense in terms of a consistent username/password pair than individual calls to CredentialsProvider.getUsername/getPassword.

[oridool]

@mp911de , I think that refresh() is indeed not required. Only getUsername/getPassword should be enough.
Unfortunately, I'm not really familiar with the internals of Lettuce and I think such a change (as you wrote) can affect a lot of places.
Any chance someone else who is more familiar with Lettuce can take it?

[oridool]

@mp911de , since you self-assigned this, does it mean the task is on progress?
If so, I'd implement a DefaultCredentialsProvider (implementing interface CredentialsProvider) that contains the regular username/password pair as today.

[mp911de]

since you self-assigned this, does it mean the task is on progress?

As per your request.

Any chance someone else who is more familiar with Lettuce can take it?

I haven't started yet and probably it will take another week or two until I get there.

Feel free to submit a pull request.

[oridool]

Hi @mp911de ,
I don't seem to have the time and enough knowledge of Lettuce project to handle this at the moment.
Please take ownership back if possible.
Thanks.

[oridool]

@mp911de ,
Is this feature under development ?

[mp911de]

No, it's not. I don't have the bandwidth for features right now. Likely will have more time at the end of this year.