Authentication / Authorization on windows

[CJHarmath]

Hi,

If I were need to setup multiple instances of Redis on Windows with authentication and authorization, what are my options ?

Few questions in my mind which I didn't see in the docs:

• can I have windows integrated authentication ?
• lock down to certain list of identities / ad groups ?
• control readers / writers ?

Thank you!

[enricogior]

Hi @csharmath Redis has a very simplified approach to security. Redis on Windows doesn't change any thing about it, so there aren't Windows-specific authentication/authorization features.

[CJHarmath]

I saw that Redis on Azure supports password and SSL at least. Is it using this version ? Would you by any chance have some recommendation for someone to implement an auth proxy in front of Redis ? i.e. only expose the auth proxy which does it's auth(z) then passes non authenticated requests to Redis ? I get that it would require a client modification as well, were just wondering...

Thanks

[CJHarmath]

"Redis is designed to be accessed by trusted clients inside trusted environments" This is not going to fly everywhere. i.e. for certain scenarios you can't treat your whole intranet as trusted, also you would want to isolate your non-prod environment from prod and make sure they can't interfere. I get that that's not your choice, but Redis's but still Msft chose to discontinue AppFabric and recommends Redis on Windows with no proper authentication/authorization it seems.... So I wonder if you would be open to work out the auth(z) part even if that means to add an extra proxy layer as a windows only extension ?

Thanks

[enricogior]

@csharmath Azure uses its own customized version of Redis.

[enricogior]

@csharmath currently there are no plans to add any security feature to the community edition of Redis on Windows.

[CJHarmath]

@enricogior do you think that custom Azure version can be also made public ? It could be useful if it solved the auth problem.

Thanks for the quick responses btw! appreciate it!

[enricogior]

@csharmath currently the Azure version is not publicly available, it may be made public in the future but that is just a personal hypotheses. Also consider that it has been designed specifically for Azure, therefore there might be issues trying to run it in a different environment.

[CJHarmath]

@enricogior thanks for the clarification. If by any chance you can ask around and/or raise awareness of this topic, that could be interesting I suppose for a few enterprise folks Even if there are pointers to third party extensions not supported by Microsoft....

Thanks again

[stevozilik]

+1 Lack of authentication/authorization makes it unusable for enterprise on-prem

[CJHarmath]

I was thinking about this and have an idea to run by the minds of open source if I am lucky enough that they are watching

Do you think it could be an option to run Redis bound to localhost only ? i.e. make it only visible to localhost via the loopback adapter

TcpListener localOnlyListener = new TcpListener(IPAddress.Loopback, port);

Then we could have a Kerberized TCP Server proxy which does auth / authz and forwards requests to the unauthenticated redis on localhost.

1. expose redis to localhost only
2. wrap it with a Kerberized Negotiate TCP Stream service - let's say call it Redis Kerberos Proxy
3. implement custom authorization logic in that service
4. client connection to be also wrapped to use the Redis Kerberos proxy with NegotiateStream

Reference for NegotiateStream: https://msdn.microsoft.com/en-us/library/system.net.security.negotiatestream(v=vs.110).aspx

Let me know if you have a better idea please or if you would think this can be a good option for auth/authz for those enterprise folks who can't just run with unauthenticated services

Thanks

[mountgellert]

@enricogior , is there an update on this issue, a change in direction, a news on releasing the version mentioned above?