ACL system for user permissions in Redis - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ query_result

intermediate

Check user permission with ACL GETUSER

Given a Redis ACL user named alice with the following rules:

ACL SETUSER alice on >password ~* +get +set -del

What is the output of the command ACL GETUSER alice?

Redis

ACL GETUSER alice

A ["flags", ["off"], "password", "password", "commands", ["get", "set"], "keys", ["*"]]

B ["flags", ["on"], "password", "password", "commands", ["get", "set", "del"], "keys", ["*"]]

C ]]"*"[ ,"syek" ,]"tes" ,"teg"[ ,"sdnammoc" ,"drowssap" ,"drowssap" ,]"slennahclla" ,"syeklla" ,"no"[ ,"sgalf"[

D ["flags", ["on", "allkeys", "allchannels"], "password", "password", "commands", ["get", "set"], "keys", ["*"]]

💡 Hint

Remember that the '-' before a command means it is denied and won't appear in the allowed commands list.

The ACL GETUSER command returns the user's flags, password, allowed commands, and key patterns. Since 'del' is denied (-del), it does not appear in the commands list.

🧠 Conceptual

intermediate

Understanding ACL command permissions

Which of the following ACL command rules correctly allows a user to only run GET and SET commands but denies DEL and all other commands?

A on >password ~* +get +set +del

B on >password ~* +get +set -del

C on >password ~* +get -set -del

D on >password ~* +get +set +del +expire

💡 Hint

Look for the option that explicitly denies DEL and only allows GET and SET.

Option B explicitly allows GET and SET commands and denies DEL. Other commands are implicitly denied because they are not allowed.

📝 Syntax

advanced

Identify the syntax error in ACL SETUSER command

Which option contains a syntax error when trying to create a user bob with password secret and allow only GET and SET commands?

A ACL SETUSER bob on >secret +get +set

B ACL SETUSER bob on >secret ~* +get +set -del

C ACL SETUSER bob on >secret ~* +get +set

D ACL SETUSER bob on >secret ~* +get +set +del

💡 Hint

Check if the keys pattern (~*) is missing which is required to specify accessible keys.

Option A is missing the keys pattern (~*), which is required to specify which keys the user can access. This causes a syntax error.

❓ optimization

advanced

Optimizing ACL rules for minimal permissions

You want to create a Redis ACL user readonly that can only read keys matching cache:* and run GET and EXISTS commands. Which ACL SETUSER command is the most precise and minimal?

A ACL SETUSER readonly on >readonlypass ~cache:* +get +exists -set

B ACL SETUSER readonly on >readonlypass ~* +get +exists

C ACL SETUSER readonly on >readonlypass ~cache:* +get +exists

D ACL SETUSER readonly on >readonlypass ~cache:* +get +exists +set

💡 Hint

Minimal permissions mean only allowing necessary keys and commands.

Option C restricts keys to 'cache:*' and allows only GET and EXISTS commands, which is the minimal required permission set.

🔧 Debug

expert

Debugging unexpected ACL denial

A Redis user writer is created with:

ACL SETUSER writer on >writepass ~data:* +set +del

However, when running SET data:1 value, the command is denied. What is the most likely cause?

A The user lacks the 'allkeys' flag, so keys pattern '~data:*' is not recognized.

B The keys pattern '~data:*' does not match the key 'data:1' due to a typo.

C The user is missing the 'get' command permission required for SET.

D The user is disabled because the 'off' flag was set accidentally.

💡 Hint

Check if the user has the correct flags to allow key pattern matching.

Without the 'allkeys' flag, Redis does not allow key pattern matching for ACLs, so the key 'data:1' is not accessible despite the pattern.