Only default redis username is sent when using --redis_cluster_connection_urls

[henriduflot]

I tried to connect oauth2-proxy to redis cluster by providing username and password inside the redis_cluster_connection_urls parameter. But I can't use specific username.

config.cfg

### REDIS CONFIG ###
session_store_type="redis"
redis_use_cluster=true
redis_cluster_connection_urls="redis://username:password@cluster-hostname:7000"

Expected Behavior

oauth2-proxy should authenticate on redis with provided username and password

Current Behavior

Instead of 'username' the authentification is done with 'default'

Note : username:password configuration works well when using with redis_connection_url (non cluster mode)

The only way to make it work is to use redis_password parameter, but I can't use a specific username (default is used) :

### REDIS CONFIG ###
session_store_type="redis"
redis_use_cluster=true
redis_cluster_connection_urls="redis://cluster-hostname:7000"
redis_password="password"

Steps to Reproduce (for bugs)

Use a redis cluster and provide username/password inside the redis_cluster_connection_urls

Context

Your Environment

• oauth2-proy: v7.4.0.linux-amd64
• Redis : 6.0.14

[henriduflot]

I'm not very comfortable with the go language. Would it be enough to simply add Username parameter here ?

oauth2-proxy/pkg/sessions/redis/redis_store.go

Lines 118 to 136 in fd50a35

	// buildClusterClient makes a redis.Client that is Redis Cluster aware
	func buildClusterClient(opts options.RedisStoreOptions) (Client, error) {
	addrs, opt, err := parseRedisURLs(opts.ClusterConnectionURLs)
	if err != nil {
	return nil, fmt.Errorf("could not parse redis urls: %v", err)
	}
	if err := setupTLSConfig(opts, opt); err != nil {
	return nil, err
	}
	client := redis.NewClusterClient(&redis.ClusterOptions{
	Addrs: addrs,
	Password: opts.Password,
	TLSConfig: opt.TLSConfig,
	ConnMaxIdleTime: time.Duration(opts.IdleTimeout) * time.Second,
	})
	return newClusterClient(client), nil
	}

For information here is how it is done for the standalone mode. I think opt already contains username paremeter parsed from connection_url :

oauth2-proxy/pkg/sessions/redis/redis_store.go

Lines 138 to 158 in fd50a35

	// buildStandaloneClient makes a redis.Client that connects to a simple
	// Redis node
	func buildStandaloneClient(opts options.RedisStoreOptions) (Client, error) {
	opt, err := redis.ParseURL(opts.ConnectionURL)
	if err != nil {
	return nil, fmt.Errorf("unable to parse redis url: %s", err)
	}
	if opts.Password != "" {
	opt.Password = opts.Password
	}
	if err := setupTLSConfig(opts, opt); err != nil {
	return nil, err
	}
	opt.ConnMaxIdleTime = time.Duration(opts.IdleTimeout) * time.Second
	client := redis.NewClient(opt)
	return newClient(client), nil
	}

[JoelSpeed]

Looks like it, the go-redis struct (https://pkg.go.dev/github.com/go-redis/redis/v9#ClusterOptions) has a username field, so we would need to pass something through to that

[henriduflot]

I builded app with this fix :

	if opts.Password != "" {
		opt.Password = opts.Password
	}

	client := redis.NewClusterClient(&redis.ClusterOptions{
		Addrs:           addrs,
		Password:        opt.Password,
		Username:        opt.Username,
		TLSConfig:       opt.TLSConfig,
		ConnMaxIdleTime: time.Duration(opts.IdleTimeout) * time.Second,
	})
	return newClusterClient(client), nil

I checked with different case of configuration :

• With username and password in url : 🆗

redis_use_cluster=true
redis_cluster_connection_urls="redis://default:secret@redis-cluster"

• With username in url and password as variable : 🆗

redis_use_cluster=true
redis_cluster_connection_urls="redis://default@redis-cluster"
redis_password="secret"

• With password in variable but without username : 🆗

redis_use_cluster=true
redis_cluster_connection_urls="redis://redis-cluster"
redis_password="secret"

Given above tests, it should not have a negative impact. But like I said I'm not a developper
Do you think I can submit Pull Request with the fix ?

[github-actions]

This issue has been inactive for 60 days. If the issue is still relevant please comment to re-activate the issue. If no action is taken within 7 days, the issue will be marked closed.

[github-actions]

This issue has been inactive for 60 days. If the issue is still relevant please comment to re-activate the issue. If no action is taken within 7 days, the issue will be marked closed.