git.iko.soy/typeable/oauth2-proxy
on master help sign in
Add ability to configure username for Redis cluster connections (#2381)

* Initial attempt. * Add CHANGELOG entry. * Drop commented-out Sentinel test. --------- Co-authored-by: Joel Speed <Joel.speed@hotmail.co.uk>

commitf3dbca600f4a96b35da3c71d5e9352f33ba1d00a authorRoss Golder <ross@golder.org> dateSun 21 Jan 2024, 03:00 (3 years ago) parent4c2bf5a
5 files changed+76−3
compare with master
unifiedsplit
CHANGELOG.md+1 pkg/apis/options/options.go+4−3 pkg/apis/options/sessions.go+1 pkg/sessions/redis/redis_store.go+19 pkg/sessions/redis/redis_store_test.go+51
CHANGELOG.md+1
@@ -8,6 +8,7 @@
88
99## Changes since v7.5.1
1010
11+- [#2381](https://github.com/oauth2-proxy/oauth2-proxy/pull/2381) Allow username authentication to Redis cluster (@rossigee)
1112- [#2345](https://github.com/oauth2-proxy/oauth2-proxy/pull/2345) Log error details when failed loading CSRF cookie (@charvadzo)
1213- [#2128](https://github.com/oauth2-proxy/oauth2-proxy/pull/2128) Update dependencies (@vllvll)
1314- [#2269](https://github.com/oauth2-proxy/oauth2-proxy/pull/2269) Added Azure China (and other air gaped cloud) support (@mblaschke)
pkg/apis/options/options.go+4−3
@@ -144,16 +144,17 @@ func NewFlagSet() *pflag.FlagSet {
144144 flagSet.String("ready-path", "/ready", "the ready endpoint that can be used for deep health checks")
145145 flagSet.String("session-store-type", "cookie", "the session storage provider to use")
146146 flagSet.Bool("session-cookie-minimal", false, "strip OAuth tokens from cookie session stores if they aren't needed (cookie session store only)")
147− flagSet.String("redis-connection-url", "", "URL of redis server for redis session storage (eg: redis://HOST[:PORT])")
147+ flagSet.String("redis-connection-url", "", "URL of redis server for redis session storage (eg: redis://[USER[:PASSWORD]@]HOST[:PORT])")
148+ flagSet.String("redis-username", "", "Redis username. Applicable for Redis configurations where ACL has been configured. Will override any username set in `--redis-connection-url`")
148149 flagSet.String("redis-password", "", "Redis password. Applicable for all Redis configurations. Will override any password set in `--redis-connection-url`")
149150 flagSet.Bool("redis-use-sentinel", false, "Connect to redis via sentinels. Must set --redis-sentinel-master-name and --redis-sentinel-connection-urls to use this feature")
150151 flagSet.String("redis-sentinel-password", "", "Redis sentinel password. Used only for sentinel connection; any redis node passwords need to use `--redis-password`")
151152 flagSet.String("redis-sentinel-master-name", "", "Redis sentinel master name. Used in conjunction with --redis-use-sentinel")
152153 flagSet.String("redis-ca-path", "", "Redis custom CA path")
153154 flagSet.Bool("redis-insecure-skip-tls-verify", false, "Use insecure TLS connection to redis")
154− flagSet.StringSlice("redis-sentinel-connection-urls", []string{}, "List of Redis sentinel connection URLs (eg redis://HOST[:PORT]). Used in conjunction with --redis-use-sentinel")
155+ flagSet.StringSlice("redis-sentinel-connection-urls", []string{}, "List of Redis sentinel connection URLs (eg redis://[USER[:PASSWORD]@]HOST[:PORT]). Used in conjunction with --redis-use-sentinel")
155156 flagSet.Bool("redis-use-cluster", false, "Connect to redis cluster. Must set --redis-cluster-connection-urls to use this feature")
156− flagSet.StringSlice("redis-cluster-connection-urls", []string{}, "List of Redis cluster connection URLs (eg redis://HOST[:PORT]). Used in conjunction with --redis-use-cluster")
157+ flagSet.StringSlice("redis-cluster-connection-urls", []string{}, "List of Redis cluster connection URLs (eg redis://[USER[:PASSWORD]@]HOST[:PORT]). Used in conjunction with --redis-use-cluster")
157158 flagSet.Int("redis-connection-idle-timeout", 0, "Redis connection idle timeout seconds, if Redis timeout option is non-zero, the --redis-connection-idle-timeout must be less then Redis timeout option")
158159 flagSet.String("signature-key", "", "GAP-Signature request signature key (algorithm:secretkey)")
159160 flagSet.Bool("gcp-healthchecks", false, "Enable GCP/GKE healthcheck endpoints")
pkg/apis/options/sessions.go+1
@@ -23,6 +23,7 @@ type CookieStoreOptions struct {
2323// RedisStoreOptions contains configuration options for the RedisSessionStore.
2424type RedisStoreOptions struct {
2525 ConnectionURL string `flag:"redis-connection-url" cfg:"redis_connection_url"`
26+ Username string `flag:"redis-username" cfg:"redis_username"`
2627 Password string `flag:"redis-password" cfg:"redis_password"`
2728 UseSentinel bool `flag:"redis-use-sentinel" cfg:"redis_use_sentinel"`
2829 SentinelPassword string `flag:"redis-sentinel-password" cfg:"redis_sentinel_password"`
pkg/sessions/redis/redis_store.go+19
@@ -100,6 +100,13 @@ func buildSentinelClient(opts options.RedisStoreOptions) (Client, error) {
100100 return nil, fmt.Errorf("could not parse redis urls: %v", err)
101101 }
102102
103+ if opts.Password != "" {
104+ opt.Password = opts.Password
105+ }
106+ if opts.Username != "" {
107+ opt.Username = opts.Username
108+ }
109+
103110 if err := setupTLSConfig(opts, opt); err != nil {
104111 return nil, err
105112 }
@@ -108,6 +115,7 @@ func buildSentinelClient(opts options.RedisStoreOptions) (Client, error) {
108115 MasterName: opts.SentinelMasterName,
109116 SentinelAddrs: addrs,
110117 SentinelPassword: opts.SentinelPassword,
118+ Username: opts.Username,
111119 Password: opts.Password,
112120 TLSConfig: opt.TLSConfig,
113121 ConnMaxIdleTime: time.Duration(opts.IdleTimeout) * time.Second,
@@ -122,12 +130,20 @@ func buildClusterClient(opts options.RedisStoreOptions) (Client, error) {
122130 return nil, fmt.Errorf("could not parse redis urls: %v", err)
123131 }
124132
133+ if opts.Password != "" {
134+ opt.Password = opts.Password
135+ }
136+ if opts.Username != "" {
137+ opt.Username = opts.Username
138+ }
139+
125140 if err := setupTLSConfig(opts, opt); err != nil {
126141 return nil, err
127142 }
128143
129144 client := redis.NewClusterClient(&redis.ClusterOptions{
130145 Addrs: addrs,
146+ Username: opts.Username,
131147 Password: opts.Password,
132148 TLSConfig: opt.TLSConfig,
133149 ConnMaxIdleTime: time.Duration(opts.IdleTimeout) * time.Second,
@@ -146,6 +162,9 @@ func buildStandaloneClient(opts options.RedisStoreOptions) (Client, error) {
146162 if opts.Password != "" {
147163 opt.Password = opts.Password
148164 }
165+ if opts.Username != "" {
166+ opt.Username = opts.Username
167+ }
149168
150169 if err := setupTLSConfig(opts, opt); err != nil {
151170 return nil, err
pkg/sessions/redis/redis_store_test.go+51
@@ -18,6 +18,7 @@ import (
1818 . "github.com/onsi/gomega"
1919)
2020
21+const redisUsername = "testuser"
2122const redisPassword = "0123456789abcdefghijklmnopqrstuv"
2223
2324var (
@@ -231,6 +232,56 @@ var _ = Describe("Redis SessionStore Tests", func() {
231232 })
232233 })
233234
235+ Context("with a redis username and password", func() {
236+ BeforeEach(func() {
237+ mr.RequireUserAuth(redisUsername, redisPassword)
238+ })
239+
240+ AfterEach(func() {
241+ mr.RequireUserAuth("", "")
242+ })
243+
244+ tests.RunSessionStoreTests(
245+ func(opts *options.SessionOptions, cookieOpts *options.Cookie) (sessionsapi.SessionStore, error) {
246+ // Set the connection URL
247+ opts.Type = options.RedisSessionStoreType
248+ opts.Redis.ConnectionURL = "redis://" + redisUsername + "@" + mr.Addr()
249+ opts.Redis.Password = redisPassword
250+
251+ // Capture the session store so that we can close the client
252+ var err error
253+ ss, err = NewRedisSessionStore(opts, cookieOpts)
254+ return ss, err
255+ },
256+ func(d time.Duration) error {
257+ mr.FastForward(d)
258+ return nil
259+ },
260+ )
261+
262+ Context("with cluster", func() {
263+ tests.RunSessionStoreTests(
264+ func(opts *options.SessionOptions, cookieOpts *options.Cookie) (sessionsapi.SessionStore, error) {
265+ clusterAddr := "redis://" + redisUsername + "@" + mr.Addr()
266+ opts.Type = options.RedisSessionStoreType
267+ opts.Redis.ClusterConnectionURLs = []string{clusterAddr}
268+ opts.Redis.UseCluster = true
269+ opts.Redis.Username = redisUsername
270+ opts.Redis.Password = redisPassword
271+
272+ // Capture the session store so that we can close the client
273+ var err error
274+ ss, err = NewRedisSessionStore(opts, cookieOpts)
275+ return ss, err
276+ },
277+ func(d time.Duration) error {
278+ mr.FastForward(d)
279+ return nil
280+ },
281+ )
282+ })
283+ })
284+
234285 Context("with TLS connection", func() {
235286 BeforeEach(func() {
236287 mr.Close()