ACL system for user permissions in Redis - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ query_result

intermediate

Check user permission with ACL GETUSER

Given a Redis ACL user named alice with the following rules:

ACL SETUSER alice on >password ~* +get +set -del

What is the output of the command ACL GETUSER alice?

Redis

ACL GETUSER alice

A ["flags", ["off"], "password", "password", "commands", ["get", "set"], "keys", ["*"]]

B ["flags", ["on"], "password", "password", "commands", ["get", "set", "del"], "keys", ["*"]]

C ]]"*"[ ,"syek" ,]"tes" ,"teg"[ ,"sdnammoc" ,"drowssap" ,"drowssap" ,]"slennahclla" ,"syeklla" ,"no"[ ,"sgalf"[

D ["flags", ["on", "allkeys", "allchannels"], "password", "password", "commands", ["get", "set"], "keys", ["*"]]

💡 Hint

Remember that the '-' before a command means it is denied and won't appear in the allowed commands list.

The ACL GETUSER command returns the user's flags, password, allowed commands, and key patterns. Since 'del' is denied (-del), it does not appear in the commands list.

🧠 Conceptual

intermediate

Understanding ACL command permissions

Which of the following ACL command rules correctly allows a user to only run GET and SET commands but denies DEL and all other commands?

A on >password ~* +get +set +del

B on >password ~* +get +set -del

C on >password ~* +get -set -del

D on >password ~* +get +set +del +expire

💡 Hint

Look for the option that explicitly denies DEL and only allows GET and SET.

Option B explicitly allows GET and SET commands and denies DEL. Other commands are implicitly denied because they are not allowed.

📝 Syntax

advanced

Identify the syntax error in ACL SETUSER command

Which option contains a syntax error when trying to create a user bob with password secret and allow only GET and SET commands?

A ACL SETUSER bob on >secret +get +set

B ACL SETUSER bob on >secret ~* +get +set -del

C ACL SETUSER bob on >secret ~* +get +set

D ACL SETUSER bob on >secret ~* +get +set +del

💡 Hint

Check if the keys pattern (~*) is missing which is required to specify accessible keys.

Option A is missing the keys pattern (~*), which is required to specify which keys the user can access. This causes a syntax error.

❓ optimization

advanced

Optimizing ACL rules for minimal permissions

You want to create a Redis ACL user readonly that can only read keys matching cache:* and run GET and EXISTS commands. Which ACL SETUSER command is the most precise and minimal?

A ACL SETUSER readonly on >readonlypass ~cache:* +get +exists -set

B ACL SETUSER readonly on >readonlypass ~* +get +exists

C ACL SETUSER readonly on >readonlypass ~cache:* +get +exists

D ACL SETUSER readonly on >readonlypass ~cache:* +get +exists +set

💡 Hint

Minimal permissions mean only allowing necessary keys and commands.

Option C restricts keys to 'cache:*' and allows only GET and EXISTS commands, which is the minimal required permission set.

🔧 Debug

expert

Debugging unexpected ACL denial

A Redis user writer is created with:

ACL SETUSER writer on >writepass ~data:* +set +del

However, when running SET data:1 value, the command is denied. What is the most likely cause?

A The user lacks the 'allkeys' flag, so keys pattern '~data:*' is not recognized.

B The keys pattern '~data:*' does not match the key 'data:1' due to a typo.

C The user is missing the 'get' command permission required for SET.

D The user is disabled because the 'off' flag was set accidentally.

💡 Hint

Check if the user has the correct flags to allow key pattern matching.

Without the 'allkeys' flag, Redis does not allow key pattern matching for ACLs, so the key 'data:1' is not accessible despite the pattern.

Practice

1. What is the main purpose of Redis ACL (Access Control List)?

easy

A. To speed up Redis database queries

B. To control which users can perform specific commands and access keys

C. To backup Redis data automatically

D. To monitor Redis server performance

Solution

1. Step 1: Understand ACL purpose

   ACL in Redis is designed to manage user permissions, controlling what commands and keys users can access.

2. Step 2: Compare options

   Options B, C, and D describe unrelated Redis features like performance and backup, not ACL.

3. Final Answer:

   To control which users can perform specific commands and access keys -> Option B

4. Quick Check:

   ACL controls permissions = A [OK]

Hint: ACL is about permissions, not performance or backups [OK]

Common Mistakes:

• Confusing ACL with performance tuning
• Thinking ACL manages backups
• Assuming ACL monitors server stats

2. Which of the following is the correct Redis command to create or update a user with specific permissions?

easy

A. ACL CREATEUSER username on >password ~keys +commands

B. ACL UPDATEUSER username on >password ~keys +commands

C. ACL ADDUSER username on >password ~keys +commands

D. ACL SETUSER username on >password ~keys +commands

Solution

1. Step 1: Recall Redis ACL command syntax

   The correct command to create or update a user is ACL SETUSER followed by username and permissions.

2. Step 2: Check options

   Only ACL SETUSER username on >password ~keys +commands uses ACL SETUSER. Others use invalid commands like CREATEUSER, ADDUSER, UPDATEUSER which do not exist in Redis ACL.

3. Final Answer:

   ACL SETUSER username on >password ~keys +commands -> Option D

4. Quick Check:

   Use ACL SETUSER to set permissions [OK]

Hint: Remember: ACL SETUSER sets or updates users [OK]

Common Mistakes:

• Using non-existent ACL commands like CREATEUSER
• Confusing SETUSER with other verbs
• Missing required syntax parts like 'on' or '>'

3. Given the command ACL SETUSER alice on >mypassword ~cache:* +get +set, what permissions does user 'alice' have?

medium

A. User 'alice' is disabled and cannot run any commands

B. User 'alice' can run all commands on all keys

C. User 'alice' can only run GET and SET commands on keys starting with 'cache:'

D. User 'alice' can run GET and SET commands on all keys

Solution

1. Step 1: Analyze ACL SETUSER command parts

   'on' enables the user, '>mypassword' sets password, '~cache:*' limits keys to those starting with 'cache:', '+get +set' allows only GET and SET commands.

2. Step 2: Interpret permissions

   User 'alice' can only run GET and SET commands on keys matching 'cache:*'. Other commands or keys are denied.

3. Final Answer:

   User 'alice' can only run GET and SET commands on keys starting with 'cache:' -> Option C

4. Quick Check:

   Commands + keys limited = A [OK]

Hint: Check '+' for commands and '~' for key patterns [OK]

Common Mistakes:

• Assuming all commands are allowed
• Ignoring key pattern restrictions
• Thinking user is disabled without 'off'

4. You run ACL SETUSER bob on >secret +@all but Bob still cannot execute commands. What is the likely problem?

medium

A. Bob's client did not authenticate with the password

B. Bob's password was not set correctly

C. The command '+@all' is invalid syntax

D. Bob's user is disabled because 'on' was not set

Solution

1. Step 1: Check user status and permissions

   'on' enables Bob, '+@all' grants all command categories, and '>secret' sets password correctly.

2. Step 2: Identify why commands fail

   If Bob cannot run commands, likely he did not authenticate with the password, so Redis denies access despite permissions.

3. Final Answer:

   Bob's client did not authenticate with the password -> Option A

4. Quick Check:

   Authentication required after ACL SETUSER [OK]

Hint: Set password and authenticate client to enable commands [OK]

Common Mistakes:

• Forgetting to authenticate after setting password
• Assuming 'on' disables user if missing
• Thinking '+@all' is invalid

5. You want to create a Redis user 'reporter' who can only run the INFO command and read keys starting with stats:. Which command correctly sets this up?

hard

A. ACL SETUSER reporter on >pass123 ~stats:* +info

B. ACL SETUSER reporter on >pass123 ~stats:* +@read

C. ACL SETUSER reporter on >pass123 ~stats:* +get +info

D. ACL SETUSER reporter on >pass123 ~stats:* +get

Solution

1. Step 1: Understand command requirements

   User 'reporter' needs only the INFO command and access to keys starting with 'stats:'.

2. Step 2: Evaluate options

   ACL SETUSER reporter on >pass123 ~stats:* +info: ACL SETUSER reporter on >pass123 ~stats:* +info grants only the INFO command on keys starting with 'stats:'. ACL SETUSER reporter on >pass123 ~stats:* +get +info incorrectly grants +get which is not required. ACL SETUSER reporter on >pass123 ~stats:* +@read grants all read commands (+@read), which is too broad. ACL SETUSER reporter on >pass123 ~stats:* +get misses +info, so cannot run INFO command.

3. Final Answer:

   ACL SETUSER reporter on >pass123 ~stats:* +info -> Option A

4. Quick Check:

   Only INFO command + key permissions = C [OK]

Hint: Grant only needed commands with '+' and keys with '~' [OK]

Common Mistakes:

• Granting command categories instead of specific commands
• Missing +info for INFO command
• Forgetting to enable user with 'on'