You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
In this challenge extension you'll add support for default user [Authentication][redis-authentication] to your Redis implementation.
207
+
208
+
Along the way, you'll learn about commands like [ACL WHOAMI][acl-whoami-command], [ACL GETUSER][acl-getuser-command], [ACL SETUSER][acl-setuser-command], and [AUTH][auth-command], and more.
In this stage, you'll add support for responding to the `ACL WHOAMI` command.
2
+
3
+
### The `ACL WHOAMI` command
4
+
5
+
The [`ACL WHOAMI`](https://redis.io/docs/latest/commands/acl-whoami/) command is used to return the username the current connection is authenticated with.
6
+
7
+
In Redis, every new connection is automatically authenticated using the `default` user. This feature can be turned off, making every new connection unauthenticated at first. We'll get to that in the later stages.
8
+
9
+
Example usage:
10
+
11
+
```bash
12
+
> ACL WHOAMI
13
+
"default"
14
+
```
15
+
16
+
It returns the username of currently authenticated user, encoded as a [RESP bulk string](https://redis.io/docs/latest/develop/reference/protocol-spec/#bulk-strings).
17
+
18
+
### Tests
19
+
20
+
The tester will execute your program like this:
21
+
22
+
```bash
23
+
$ ./your_program.sh
24
+
```
25
+
26
+
It'll then send an `ACL WHOAMI` command.
27
+
28
+
```bash
29
+
# Expect RESP bulk string: "default"
30
+
$ redis-cli
31
+
> ACL WHOAMI
32
+
"default"
33
+
```
34
+
35
+
The tester will validate that the response is the string `default`, which is RESP encoded as:
36
+
37
+
```
38
+
$7\r\n
39
+
default\r\n
40
+
```
41
+
42
+
### Notes
43
+
44
+
- In this stage, you can hardcode the response of the `ACL WHOAMI` command to be `default`. We'll get to enforcing authentication in the later stages.
In this stage, you'll add support for responding to the `ACL GETUSER` command.
2
+
3
+
### The `ACL GETUSER` command
4
+
5
+
The [`ACL GETUSER`](https://redis.io/docs/latest/commands/acl-getuser/) is used to retrieve the properties the specified user. In Redis, the `default` user is present from the start, without having to create it explicitly.
6
+
7
+
The `ACL GETUSER` returns multiple properties of the user, among which `flags` is one. In this stage, you'll add support for responding to the `ACL GETUSER` command with only the flags property.
8
+
9
+
Example usage:
10
+
```bash
11
+
> ACL GETUSER default
12
+
1) "flags"
13
+
2) (empty array)
14
+
```
15
+
16
+
The second element of the resposne is the flags array. This is because a user can have multiple flags associated with it. In this stage, you can hardcode the flags array to be an empty array.
17
+
18
+
### Tests
19
+
20
+
The tester will execute your program like this:
21
+
22
+
```bash
23
+
$ ./your_program.sh
24
+
```
25
+
26
+
It'll then send an `ACL GETUSER` command specifying the `default` user.
27
+
28
+
```bash
29
+
# Expect RESP array: ["flags", []]
30
+
$ redis-cli
31
+
> ACL GETUSER default
32
+
1) "flags"
33
+
2) (empty array)
34
+
```
35
+
36
+
The tester will validate the following for the response:
37
+
38
+
1. The first element of the array is the string `flags`, encoded as a RESP bulk string.
39
+
2. The second element of the array is a RESP array.
40
+
41
+
### Notes
42
+
43
+
- A user can have multiple flags. This is why the value of flags property is an array.
44
+
45
+
- The second element of the array is the flags array, which contains the user flags. We'll get to this in the later stages.
In this stage, you'll add support for responding to the `ACL GETUSER` command with the `nopass` flag set.
2
+
3
+
### The `nopass` flag
4
+
5
+
The `nopass` flag is one of the user flags in Redis.
6
+
7
+
- If the `nopass` flag is set for a user, the authentication succeeds with an arbitrary password for the user.
8
+
- Setting the `nopass` flag clears the associated passwords for the given user.
9
+
- The default user has the `nopass` flag set. Due to this, new connections are automatically authenticated as the `default` user. (This behavior can be changed, and we'll get to this in the later stages.)
10
+
11
+
Example usage:
12
+
```bash
13
+
> ACL GETUSER default
14
+
1) "flags"
15
+
2) 1) "nopass"
16
+
```
17
+
18
+
The flags are encoded as a RESP array of bulk strings. Each flag is a bulk string (e.g., `nopass`). We'll get to enforcing the behavior of the `nopass` flag in later stages.
19
+
20
+
In this stage, you only need to respond to the `ACL GETUSER` command with the `nopass` flag set.
21
+
22
+
### Tests
23
+
24
+
The tester will execute your program like this:
25
+
26
+
```bash
27
+
$ ./your_program.sh
28
+
```
29
+
30
+
It'll then send an `ACL GETUSER` command specifying the `default` user.
31
+
32
+
```bash
33
+
# Expect RESP array: ["flags", ["nopass"]]
34
+
$ redis-cli
35
+
> ACL GETUSER default
36
+
1) "flags"
37
+
2) 1) "nopass"
38
+
```
39
+
40
+
The tester will validate the following for the response:
41
+
42
+
1. The first element of the array is the string `flags`, encoded as a RESP bulk string.
43
+
2. The second element of the array is a RESP array, and contains the `nopass` flag.
In this stage, you'll add support for responding to the `ACL GETUSER` command with the passwords property.
2
+
3
+
### The `passwords` property
4
+
5
+
A user in the Redis ACL system can have zero or more passwords associated with them. The `ACL GETUSER` command also returns the `passwords` property of the specified user.
6
+
7
+
Example usage:
8
+
```bash
9
+
> ACL GETUSER default
10
+
1) "flags"
11
+
2) 1) "nopass"
12
+
3) "passwords"
13
+
4) (empty array)
14
+
```
15
+
16
+
The fourth element of the response is the passwords array. The default user does not have any associated passwords unless explicitly configured. This is why the passwords array is empty for the default user.
17
+
18
+
### Tests
19
+
20
+
The tester will execute your program like this:
21
+
22
+
```bash
23
+
$ ./your_program.sh
24
+
```
25
+
26
+
It'll then send an `ACL GETUSER` command specifying the `default` user.
In this stage, you'll add support for setting the default user's password.
2
+
3
+
### The `ACL SETUSER` command
4
+
5
+
The [`ACL SETUSER`](https://redis.io/docs/latest/commands/acl-setuser/) command can be used to modify the properties of an existing user. If this command is used with the `>` rule, it is used to add a password for the given user. Adding a password also clears the `nopass` flag from the user.
The response to the `ACL SETUSER` command is a RESP simple string: `+OK\r\n`.
21
+
22
+
The password array in the response of `ACL GETUSER` command contains one element and is the SHA-256 hash of the password `mypassword`.
23
+
24
+
Redis does not store the raw password specified in the `ACL SETUSER` command. Instead, it stores the SHA-256 hash of the password. While validating the password during authentication, the SHA-256 hash of the input password is calculated and matched against the stored list of SHA-256 password hashes. This is done because storing raw passwords is a security vulnerability.
25
+
26
+
### Tests
27
+
28
+
The tester will execute your program like this:
29
+
30
+
```bash
31
+
$ ./your_program.sh
32
+
```
33
+
34
+
It'll then send a `ACL GETUSER` command, specifying the `default` user
0 commit comments