Apache Software Foundation / SeaTunnel
Merged upstreamCorrectnessMerged Sep 21, 2026

Honor Redis named-user authentication

Replaced the standalone ACL mutation path with named-user authentication, added username support to cluster clients, and closed partially initialized resources on failure.

apache/seatunnel · #12402

Redis authentication correctness fix

SeaTunnel sources and sinks now authenticate named ACL users in both standalone and cluster modes without attempting to modify server ACLs.

Problem

Standalone connections authenticated with a password and then called ACL SETUSER, which changes server policy rather than authenticating the connection. Cluster clients omitted the username entirely. Valid named credentials could fail or operate as the default user, and failed setup could leak resources.

Approach

Uses Redis named-user AUTH when a username is configured in both deployment modes, preserves password-only behavior for the default user, and closes connections or clients when authentication, database selection, or initialization fails.

Impact and scope

  • Enables least-privilege Redis ACL identities for both SeaTunnel readers and writers across standalone and cluster deployments.
  • Avoids unintended ACL mutation during connector startup and ensures the authenticated identity matches configuration.
  • Preserves existing option names and default-user behavior; configurations that previously supplied an ignored username must now provide valid named-user credentials or remove it.

Validation

  • Real-server regressions reproduced the wrong standalone identity and failed cluster authentication before the fix, then passed with named users afterward.
  • Sixty-seven tests passed on both Java 8 and Java 11, including Redis 5 compatibility and Redis 7 named-user coverage.
  • A fresh 70-module Java 11 E2E build exercised named-user source-to-sink flows across seven Flink, Spark, and Zeta engine runs against Redis 7.4.11. All four hosted checks passed and the verified merge commit credits Goutam Adwant.
  • The reported runtime matrix used a single-node cluster with all slots; multi-node redirects, failover, and TLS were not covered.