redis config_error ai_generated true

ERR ACL categories 'write' and 'readonly' cannot be combined for user 'myuser'

ID: redis/acl-category-inheritance-conflict

Also available as: JSON · Markdown · 中文
95%Fix Rate
88%Confidence
1Evidence
2024-07-10First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
Redis 7.0.0 active — — —
Redis 7.2.0 active — — —
Redis 7.4.0 active — — —

Root Cause

User configuration contains conflicting ACL category permissions; 'write' allows write commands while 'readonly' restricts to read-only, causing an invalid state.

generic

中文

用户配置包含冲突的 ACL 类别权限；'write' 允许写入命令，而 'readonly' 限制为只读，导致无效状态。

Official Documentation

https://redis.io/docs/latest/operate/oss_and_stack/management/security/acl/

Workarounds

  1. 95% success Remove the conflicting category using ACL SETUSER myuser -readonly (or -write) to ensure only one set of permissions is active. 
    Remove the conflicting category using ACL SETUSER myuser -readonly (or -write) to ensure only one set of permissions is active.
  2. 90% success Recreate the user with a single category: ACL SETUSER myuser on >password +@readonly ~* to grant read-only access without write permissions. 
    Recreate the user with a single category: ACL SETUSER myuser on >password +@readonly ~* to grant read-only access without write permissions.
  3. 85% success Audit the ACL rules file (e.g., users.acl) and manually edit to remove the conflicting line, then reload with ACL LOAD. 
    Audit the ACL rules file (e.g., users.acl) and manually edit to remove the conflicting line, then reload with ACL LOAD.

中文步骤

  1. 使用 ACL SETUSER myuser -readonly（或 -write）移除冲突的类别，确保只有一组权限处于活动状态。
  2. 使用单一类别重新创建用户：ACL SETUSER myuser on >password +@readonly ~* 授予只读访问权限，不包含写入权限。
  3. 审计 ACL 规则文件（例如 users.acl）并手动编辑以移除冲突行，然后使用 ACL LOAD 重新加载。

Dead Ends

Common approaches that don't work:

  1. 90% fail

    Adding more conflicting categories (e.g., both 'admin' and 'restricted') only exacerbates the conflict without resolving it.

  2. 95% fail

    Deleting the user and recreating with the same conflicting categories will reproduce the same error.

  3. 70% fail

    Ignoring the error and proceeding with other operations may leave the user in an inconsistent state, causing unpredictable behavior.