Feat: use username and passport for Redis Sentinel auth

irma/cmd/config.go

@@ -87,6 +87,8 @@ func configureIRMAServer() (*server.Configuration, error) {
 		if conf.RedisSettings.Password = viper.GetString("redis_pw"); conf.RedisSettings.Password == "" && !viper.GetBool("redis_allow_empty_password") {
 			return nil, errors.New("When Redis is used as session data store, a non-empty Redis password must be specified with the --redis-pw flag. This restriction can be relaxed by setting the --redis-allow-empty-password flag to true.")
 		}
+		conf.RedisSettings.SentinelUsername = viper.GetString("redis_sentinel_username")
+		conf.RedisSettings.SentinelPassword = viper.GetString("redis_sentinel_pw")
 		conf.RedisSettings.ACLUseKeyPrefixes = viper.GetBool("redis_acl_use_key_prefixes")
 
 		conf.RedisSettings.DB = viper.GetInt("redis_db")

irma/cmd/keyshare-myirma.go

@@ -68,6 +68,8 @@ func init() {
 	flags.Bool("redis-accept-inconsistency-risk", false, "accept the risk of inconsistent session state when using Redis Sentinel")
 	flags.String("redis-username", "", "Redis server username (when using ACLs)")
 	flags.String("redis-pw", "", "Redis server password")
+	flags.String("redis-sentinel-username", "", "Redis Sentinel username (when using ACLs)")
+	flags.String("redis-sentinel-pw", "", "Redis Sentinel password")
 	flags.Bool("redis-allow-empty-password", false, "explicitly allow an empty string as Redis password")
 	flags.Bool("redis-acl-use-key-prefixes", false, "if enabled all Redis keys will be prefixed with the username for ACLs (username:key)")
 	flags.Int("redis-db", 0, "database to be selected after connecting to the server (default 0)")

irma/cmd/keyshare-server.go

@@ -65,6 +65,8 @@ func init() {
 	flags.Bool("redis-accept-inconsistency-risk", false, "accept the risk of inconsistent session state when using Redis Sentinel")
 	flags.String("redis-username", "", "Redis server username (when using ACLs)")
 	flags.String("redis-pw", "", "Redis server password")
+	flags.String("redis-sentinel-username", "", "Redis Sentinel username (when using ACLs)")
+	flags.String("redis-sentinel-pw", "", "Redis Sentinel password")
 	flags.Bool("redis-allow-empty-password", false, "explicitly allow an empty string as Redis password")
 	flags.Bool("redis-acl-use-key-prefixes", false, "if enabled all Redis keys will be prefixed with the username for ACLs (username:key)")
 	flags.Int("redis-db", 0, "database to be selected after connecting to the server (default 0)")

irma/cmd/server.go

@@ -129,6 +129,8 @@ func setFlags(cmd *cobra.Command, production bool) error {
 	flags.Bool("redis-accept-inconsistency-risk", false, "accept the risk of inconsistent session state when using Redis Sentinel")
 	flags.String("redis-username", "", "Redis server username (when using ACLs)")
 	flags.String("redis-pw", "", "Redis server password")
+	flags.String("redis-sentinel-username", "", "Redis Sentinel username (when using ACLs)")
+	flags.String("redis-sentinel-pw", "", "Redis Sentinel password")
 	flags.Bool("redis-allow-empty-password", false, "explicitly allow an empty string as Redis password")
 	flags.Bool("redis-acl-use-key-prefixes", false, "if enabled all Redis keys will be prefixed with the username for ACLs (username:key)")
 	flags.Int("redis-db", 0, "database to be selected after connecting to the server (default 0)")

server/conf.go

@@ -122,6 +122,11 @@ type RedisSettings struct {
 	// This can be used for key permissions in the Redis ACL system. If ACLUseKeyPrefixes is false, no prefix is used.
 	ACLUseKeyPrefixes bool `json:"acl_use_key_prefixes,omitempty" mapstructure:"acl_use_key_prefixes"`
 
+	// SentinelUsername for Redis Sentinel authentication. If sentinel_username is empty, the default user is used.
+	SentinelUsername string `json:"sentinel_username,omitempty" mapstructure:"sentinel_username"`
+	// SentinelPassword for Redis Sentinel authentication.
+	SentinelPassword string `json:"sentinel_password,omitempty" mapstructure:"sentinel_password"`
+
 	DB int `json:"db,omitempty" mapstructure:"db"`
 
 	TLSCertificate     string `json:"tls_cert,omitempty" mapstructure:"tls_cert"`
@@ -454,15 +459,19 @@ func (conf *Configuration) RedisClient() (*RedisClient, error) {
 	var cl *redis.Client
 	if len(conf.RedisSettings.SentinelAddrs) > 0 {
 		cl = redis.NewFailoverClient(&redis.FailoverOptions{
-			MasterName:    conf.RedisSettings.SentinelMasterName,
-			SentinelAddrs: conf.RedisSettings.SentinelAddrs,
-			Password:      conf.RedisSettings.Password,
-			DB:            conf.RedisSettings.DB,
-			TLSConfig:     tlsConfig,
+			MasterName:       conf.RedisSettings.SentinelMasterName,
+			SentinelAddrs:    conf.RedisSettings.SentinelAddrs,
+			Username:         conf.RedisSettings.Username,
+			Password:         conf.RedisSettings.Password,
+			SentinelUsername: conf.RedisSettings.SentinelUsername,
+			SentinelPassword: conf.RedisSettings.SentinelPassword,
+			DB:               conf.RedisSettings.DB,
+			TLSConfig:        tlsConfig,
 		})
 	} else {
 		cl = redis.NewClient(&redis.Options{
 			Addr:      conf.RedisSettings.Addr,
+			Username:  conf.RedisSettings.Username,
 			Password:  conf.RedisSettings.Password,
 			DB:        conf.RedisSettings.DB,
 			TLSConfig: tlsConfig,