ACL system for user permissions in Redis - Step-by-Step Execution

Concept Flow - ACL system for user permissions

Start: Define Users and Roles

↓

Assign Permissions to Roles

↓

Assign Roles to Users

↓

User Requests Access

↓

Check User's Roles

↓

Check Permissions in Roles

↓

Allow or Deny Access

The ACL system starts by defining users and roles, assigning permissions to roles, then roles to users. When a user requests access, the system checks their roles and permissions to allow or deny access.

Execution Sample

Redis

ACL SETUSER alice on >password ~* +GET +SET
ACL SETUSER bob on >bobpass ~* +GET
ACL CAT alice
ACL WHOAMI

This code creates two users with different permissions, lists alice's permissions, and checks the current user.

Execution Table

Step	Command	Action	Result	Notes
1	ACL SETUSER alice on >password ~* +GET +SET	Create user alice with GET and SET permissions	User alice created and enabled	User alice can GET and SET
2	ACL SETUSER bob on >bobpass ~* +GET	Create user bob with GET permission only	User bob created and enabled	User bob can only GET
3	ACL CAT alice	List alice's permissions	Permissions: GET, SET	Shows alice's allowed commands
4	ACL WHOAMI	Show current user	Output: default	No user authenticated yet
5	AUTH alice password	Authenticate as alice	Authentication successful	User alice logged in
6	ACL WHOAMI	Show current user	Output: alice	Now commands run as alice
7	EXECUTE SET command	Check if alice can SET	Allowed	alice has +SET permission
8	AUTH bob bobpass	Authenticate as bob	Authentication successful	User bob logged in
9	EXECUTE SET command	Check if bob can SET	Denied	bob lacks +SET permission
10	EXECUTE GET command	Check if bob can GET	Allowed	bob has +GET permission
11	AUTH wronguser wrongpass	Authenticate with wrong credentials	Authentication failed	Access denied
12	EXECUTE any command	Without authentication	Allowed	Default user has full access
13	ACL DELUSER alice	Delete user alice	User alice deleted	alice no longer exists
14	ACL LIST	List all users	Users: bob	Only bob remains

💡 Execution stops after all commands processed and users managed

Variable Tracker

Variable	Start	After Step 1	After Step 2	After Step 5	After Step 8	After Step 13	Final
Users	{}	{"alice": {"permissions": ["GET", "SET"], "enabled": true}}	{"alice": {...}, "bob": {"permissions": ["GET"], "enabled": true}}	{"alice": {...}, "bob": {...}, "current_user": "alice"}	{"alice": {...}, "bob": {...}, "current_user": "bob"}	{"bob": {"permissions": ["GET"], "enabled": true}, "current_user": "bob"}	{"bob": {"permissions": ["GET"], "enabled": true}, "current_user": "bob"}
Current User	none	none	none	alice	bob	bob	bob

Key Moments - 3 Insights

Why does bob get denied when trying to execute a SET command?

Because in the execution_table at step 9, bob lacks the +SET permission, so the ACL denies the command.

What happens if a user tries to run commands without authenticating?

As shown in step 12, without authentication, default user is used with full access.

After deleting alice, can she still run commands?

No, step 13 deletes alice, so she no longer exists in the Users list and cannot authenticate or run commands.

Visual Quiz - 3 Questions

Look at the execution_table at step 6. What is the current user after authenticating as alice?

A bob

B default

C alice

D none

💡 Hint

Check the 'Result' column at step 6 in the execution_table.

At which step does bob get denied permission to SET?

A Step 7

B Step 9

C Step 10

D Step 12

💡 Hint

Look for the step where bob tries to execute a SET command and is denied.

If we remove +GET permission from bob at step 2, what would happen at step 10?

A bob is denied GET command

B bob can still GET

C bob can SET

D bob is deleted

💡 Hint

Refer to variable_tracker and execution_table steps 2 and 10 about bob's permissions.

Concept Snapshot

ACL system in Redis:
- Define users with ACL SETUSER
- Assign permissions (+GET, +SET) and keys (~*)
- Authenticate users with AUTH
- Check current user with ACL WHOAMI
- Permissions control command access
- Delete users with ACL DELUSER

Full Transcript

This visual execution trace shows how Redis ACL system manages user permissions. First, users alice and bob are created with different permissions. Alice has GET and SET, bob only GET. When users authenticate, the system sets the current user. Commands are allowed or denied based on the user's permissions. Without authentication, commands run as default user. Deleting a user removes their access. This step-by-step trace helps beginners see how ACL commands affect user permissions and access control.

Practice

1. What is the main purpose of Redis ACL (Access Control List)?

easy

A. To speed up Redis database queries

B. To control which users can perform specific commands and access keys

C. To backup Redis data automatically

D. To monitor Redis server performance

Solution

1. Step 1: Understand ACL purpose

   ACL in Redis is designed to manage user permissions, controlling what commands and keys users can access.

2. Step 2: Compare options

   Options B, C, and D describe unrelated Redis features like performance and backup, not ACL.

3. Final Answer:

   To control which users can perform specific commands and access keys -> Option B

4. Quick Check:

   ACL controls permissions = A [OK]

Hint: ACL is about permissions, not performance or backups [OK]

Common Mistakes:

• Confusing ACL with performance tuning
• Thinking ACL manages backups
• Assuming ACL monitors server stats

2. Which of the following is the correct Redis command to create or update a user with specific permissions?

easy

A. ACL CREATEUSER username on >password ~keys +commands

B. ACL UPDATEUSER username on >password ~keys +commands

C. ACL ADDUSER username on >password ~keys +commands

D. ACL SETUSER username on >password ~keys +commands

Solution

1. Step 1: Recall Redis ACL command syntax

   The correct command to create or update a user is ACL SETUSER followed by username and permissions.

2. Step 2: Check options

   Only ACL SETUSER username on >password ~keys +commands uses ACL SETUSER. Others use invalid commands like CREATEUSER, ADDUSER, UPDATEUSER which do not exist in Redis ACL.

3. Final Answer:

   ACL SETUSER username on >password ~keys +commands -> Option D

4. Quick Check:

   Use ACL SETUSER to set permissions [OK]

Hint: Remember: ACL SETUSER sets or updates users [OK]

Common Mistakes:

• Using non-existent ACL commands like CREATEUSER
• Confusing SETUSER with other verbs
• Missing required syntax parts like 'on' or '>'

3. Given the command ACL SETUSER alice on >mypassword ~cache:* +get +set, what permissions does user 'alice' have?

medium

A. User 'alice' is disabled and cannot run any commands

B. User 'alice' can run all commands on all keys

C. User 'alice' can only run GET and SET commands on keys starting with 'cache:'

D. User 'alice' can run GET and SET commands on all keys

Solution

1. Step 1: Analyze ACL SETUSER command parts

   'on' enables the user, '>mypassword' sets password, '~cache:*' limits keys to those starting with 'cache:', '+get +set' allows only GET and SET commands.

2. Step 2: Interpret permissions

   User 'alice' can only run GET and SET commands on keys matching 'cache:*'. Other commands or keys are denied.

3. Final Answer:

   User 'alice' can only run GET and SET commands on keys starting with 'cache:' -> Option C

4. Quick Check:

   Commands + keys limited = A [OK]

Hint: Check '+' for commands and '~' for key patterns [OK]

Common Mistakes:

• Assuming all commands are allowed
• Ignoring key pattern restrictions
• Thinking user is disabled without 'off'

4. You run ACL SETUSER bob on >secret +@all but Bob still cannot execute commands. What is the likely problem?

medium

A. Bob's client did not authenticate with the password

B. Bob's password was not set correctly

C. The command '+@all' is invalid syntax

D. Bob's user is disabled because 'on' was not set

Solution

1. Step 1: Check user status and permissions

   'on' enables Bob, '+@all' grants all command categories, and '>secret' sets password correctly.

2. Step 2: Identify why commands fail

   If Bob cannot run commands, likely he did not authenticate with the password, so Redis denies access despite permissions.

3. Final Answer:

   Bob's client did not authenticate with the password -> Option A

4. Quick Check:

   Authentication required after ACL SETUSER [OK]

Hint: Set password and authenticate client to enable commands [OK]

Common Mistakes:

• Forgetting to authenticate after setting password
• Assuming 'on' disables user if missing
• Thinking '+@all' is invalid

5. You want to create a Redis user 'reporter' who can only run the INFO command and read keys starting with stats:. Which command correctly sets this up?

hard

A. ACL SETUSER reporter on >pass123 ~stats:* +info

B. ACL SETUSER reporter on >pass123 ~stats:* +@read

C. ACL SETUSER reporter on >pass123 ~stats:* +get +info

D. ACL SETUSER reporter on >pass123 ~stats:* +get

Solution

1. Step 1: Understand command requirements

   User 'reporter' needs only the INFO command and access to keys starting with 'stats:'.

2. Step 2: Evaluate options

   ACL SETUSER reporter on >pass123 ~stats:* +info: ACL SETUSER reporter on >pass123 ~stats:* +info grants only the INFO command on keys starting with 'stats:'. ACL SETUSER reporter on >pass123 ~stats:* +get +info incorrectly grants +get which is not required. ACL SETUSER reporter on >pass123 ~stats:* +@read grants all read commands (+@read), which is too broad. ACL SETUSER reporter on >pass123 ~stats:* +get misses +info, so cannot run INFO command.

3. Final Answer:

   ACL SETUSER reporter on >pass123 ~stats:* +info -> Option A

4. Quick Check:

   Only INFO command + key permissions = C [OK]

Hint: Grant only needed commands with '+' and keys with '~' [OK]

Common Mistakes:

• Granting command categories instead of specific commands
• Missing +info for INFO command
• Forgetting to enable user with 'on'