Examkin

Question

Difficulty: HardImplement Azure Cache for Redis Configuration and Data Patterns

You are configuring a C# ASP.NET Core web application hosted in Azure App Service to connect to a Premium tier Azure Cache for Redis instance. To align with security best practices, you must eliminate the use of access keys and implement Microsoft Entra ID authentication using the system-assigned managed identity of the App Service.

Which sequence of steps should you perform to configure and establish this secure connection?

  1. 1Enable Microsoft Entra ID authentication on the Azure Cache for Redis instance.
  2. 2Create a Redis Access Policy assignment that associates the App Service's managed identity with a Redis Access Policy.
  3. 3In the web application, use the Azure Identity client library to acquire a Microsoft Entra ID access token for the Redis resource.
  4. 4Configure the StackExchange.Redis configuration options by setting the username to the Object ID of the managed identity and the password to the acquired token.
  5. 5Call ConnectionMultiplexer.Connect using the configured options to establish the connection.

Answer

To configure Microsoft Entra ID authentication using the system-assigned managed identity, first enable Microsoft Entra ID authentication on the Azure Cache for Redis instance. Second, assign a Redis Access Policy to the managed identity. Third, in the application code, acquire a Microsoft Entra ID token. Fourth, configure the StackExchange.Redis connection options using the Object ID of the managed identity as the username and the token as the password. Finally, establish the connection using the ConnectionMultiplexer.
Establishing a passwordless connection requires enabling Entra ID authentication on the Redis resource, configuring the appropriate Redis Access Policy for the managed identity, obtaining the JWT access token client-side, configuring the client to pass the Object ID and token, and finally establishing the connection.

Step-by-Step Solution

1
Enable Microsoft Entra ID authentication on the cache instance.
The Redis server is configured to accept token-based authentication connections.
By default, Azure Cache for Redis uses access keys. Entra ID authentication must be explicitly enabled.
2
Create a Redis Access Policy assignment linking the system-assigned managed identity to a role like Redis Data Reader or Redis Data Owner.
The identity is authorized to access the Redis data layer with specific permissions.
Authentication will fail if the identity does not have an active policy assignment mapping it to a permissions policy.
3
Acquire a token for the Redis resource inside the ASP.NET Core application using DefaultAzureCredential.
A short-lived JWT token is retrieved from Microsoft Entra ID representing the managed identity.
The client must present a valid Microsoft Entra token to Redis to authenticate.
4
Configure StackExchange.Redis ConnectionOptions, passing the Object ID as the username and the token as the password.
The connection metadata is set up to send the required credentials during the Redis AUTH call.
Redis protocol uses the AUTH command where the username must be the principal's Object ID and the password must be the token.
5
Call ConnectionMultiplexer.Connect.
A connection is successfully negotiated and opened.
This establishes the TCP connection and performs the handshake containing the AUTH command.

Key Concept

Microsoft Entra ID Authentication and Access Policies in Azure Cache for Redis
Estimated Time:2m 0s
Rate this question

Topics

Implement Azure Cache for Redis Configuration and Data Patterns

More questions from this topic