ACL users

See every ACL user and the recent access denials, and script reviewed ACL SETUSER / ACL DELUSER changes.

On a Redis connection, right-click a database and choose Tools → Security… (or run Security… from the command palette) to open the ACL page: every ACL user the server knows, and the server's recent access denials. It reads with ACL LIST and ACL LOG only; changes are scripted for you to review and run.

Users

One row per user from ACL LIST:

• enabled - whether the user can sign in (on / off)
• passwords - how many passwords it has, or none needed (nopass)
• keys - key patterns: ~pattern for read and write, %R~ read-only, %W~ write-only, allkeys
• channels - Pub/Sub channel patterns (&pattern, allchannels, resetchannels)
• commands - command and category rules such as +@read -@dangerous +set
• selectors - Redis 7 selectors, each in parentheses, for example (~cache:* +get): an extra set of key, channel and command rules the user may also use

Add, edit and delete

Add user… and Edit… (on the selected row) open a form with the user name, an optional new password, the key, channel and command rules, the selectors, and switches for enabled and nopass. Script to Query Tab writes one ACL SETUSER that starts with reset and then states every rule, so the script is the whole definition of the user, followed by ACL GETUSER to show the result. It opens in a new query tab on this connection; nothing changes until you run it there, and the tab's usual confirmation applies because ACL SETUSER is classed as destructive.

A new password is written as its SHA-256 hash (#…), so the clear text never appears in the tab, your query history or the server's logs. Editing keeps the user's existing password hashes unless you untick Keep the existing passwords.

Delete… scripts ACL DELUSER for the selected user in the same way. The default user cannot be deleted - disable it instead.

Users created with ACL SETUSER are lost when the server restarts unless it saves them: run ACL SAVE when the server uses an ACL file, or CONFIG REWRITE when the users live in redis.conf. Amazon ElastiCache and MemoryDB manage their users in the AWS console and refuse ACL SETUSER, so the page is not offered there. A user without the +acl permission sees the server's NOPERM error.

Recent denials

The second grid is ACL LOG 50: each refused sign-in, command, key or channel access with its reason, the user, the object it was refused on, how long ago, and the client that tried. Press Refresh to read both again.