Skip to content

[mod_hiredis] Add username support for Redis ACL authentication - #3146

Open
dmalgarise wants to merge 1 commit into
signalwire:masterfrom
dmalgarise:feature/mod-hiredis-acl-username
Open

[mod_hiredis] Add username support for Redis ACL authentication#3146
dmalgarise wants to merge 1 commit into
signalwire:masterfrom
dmalgarise:feature/mod-hiredis-acl-username

Conversation

@dmalgarise

@dmalgarise dmalgarise commented Sep 7, 2026

Copy link
Copy Markdown

Description

This pull request adds optional Redis ACL username support to mod_hiredis.

Redis 6 introduced ACL authentication using:
AUTH username password

mod_hiredis currently supports only the password, which implicitly authenticates the Redis default user. This prevents FreeSWITCH deployments from using a dedicated least-privilege Redis ACL user.

The new optional username connection parameter changes the authentication behavior as follows:

  • When both username and password are configured, the module sends AUTH username password.
  • When only the password is configured, the module preserves the existing AUTH password behavior.
  • When no password is configured, the module does not send AUTH.

The change is backward compatible with existing configurations.

Type of Change

  • Bug fix
  • New feature
  • Breaking change
  • Documentation update
  • Code cleanup / refactor

Related Issues

Closes #3145

Testing

  • Added/updated unit tests
  • Tested manually
  • Tested with live SignalWire credentials (if applicable)

Manual integration testing was performed in an isolated Docker environment using:

  • FreeSWITCH 1.11.3
  • hiredis 0.14.1
  • Redis 7.4.11

The patched mod_hiredis module was compiled from commit 9230f7e and loaded successfully by FreeSWITCH.

The following scenarios were verified:

  1. Redis ACL authentication with username and password
  • A named Redis ACL user was configured.
  • The Redis default user was disabled.
  • An unauthenticated PING returned NOAUTH Authentication required.
  • hiredis_raw acl PING returned PONG.
  1. Backward-compatible password-only authentication
  • A separate Redis instance was configured with requirepass.
  • The FreeSWITCH profile contained a password but no username.
  • hiredis_raw legacy PING returned PONG.
  1. Reconnection and re-authentication
  • The active FreeSWITCH connection was terminated from the Redis server.
  • A subsequent hiredis_raw acl PING returned PONG, confirming successful reconnection and ACL re-authentication.

(Live SignalWire credentials are not applicable to this change).

Checklist

  • I have read the CONTRIBUTING guidelines
  • My code follows the project's style guidelines
  • I have added tests for my changes (if applicable)
  • I have updated documentation (if applicable)
  • All existing tests pass

Additional Notes

The optional username is stored per Redis connection and is applied during both initial authentication and reconnection of pooled connections.

The shipped hiredis.conf.xml example documents the new parameter without enabling it by default, preserving compatibility with Redis versions earlier than 6.

@dmalgarise
dmalgarise marked this pull request as ready for review September 8, 2026 07:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[mod_hiredis] Add username support for Redis ACL authentication

1 participant