VMware GemFire for Redis Apps security includes support for TLS, including mutual TLS, and Authentication and Authorization. The implementation and support varies depending on the VMware GemFire deployment that you use.
To enable TLS on a cluster, follow the documentation for the corresponding deployment type:
Additionally, you must use a Redis client that supports TLS.
VMware GemFire for Redis Apps uses VMware GemFire’s Security Manager to enforce authentication. You must configure this Security Manager based on the VMware GemFire deployment that you use. For more information about the VMware GemFire Security Manager, see Enable Security with Property Definitions in the VMware GemFire Documentation.
VMware GemFire’s Security Manager authenticates the AUTH <password>
command and the AUTH <username> <password>
command. When users send the AUTH <password>
command without a username, the system uses the default username default
. This behavior is similar to the behavior in Open Source Redis.
You can set a custom default username using the gemfire-for-redis-username
parameter when starting the server as described in Configuration and Settings. This custom default username will be used when the AUTH <password>
command is sent without a <username>
.
To enable security, you must create a Security Manager. A Security Manager allows you to create custom implementations that can integrate with your existing security systems, such as OAuth and LDAP. Once created, you must configure the Security Manager on the locator and all servers or all AUTH
requests will fail.
To create a VMware GemFire Security Manager, follow the instructions Enable Security with Property Definitions in the VMware GemFire documentation.
For information about configuring a Security Manager for authentication, see Implementing Authentication in the VMware GemFire documentation.
In addition to authentication, each command is authorized according to VMware GemFire’s security model. For more information about this, see Implementing Authentication in the VMware GemFire documentation in the VMware GemFire documentation.
Commands are divided into READ
operations and WRITE
operations. READ
operations require DATA:READ
resource permissions and WRITE
operations require DATA:WRITE
resource permissions. See the list below for more information about which commands fall into each category.
To restrict users to interacting with only the VMware GemFire for Redis Apps region, set the resource permissions to DATA:READ:GEMFIRE_FOR_REDIS
and DATA:WRITE:GEMFIRE_FOR_REDIS
. This specificity restricts users to only being able to READ
and WRITE
data to the GEMFIRE_FOR_REDIS
region.
DATA:READ
DATA:WRITE