NCache RESP Server Security

Security in Redis RESP Protocol Compatibility Server

NCache RESP Server provides enterprise-grade security for applications using the Redis RESP protocol. It integrates with NCache's existing LDAP/Active Directory security infrastructure to authenticate users, control access to individual caches, and protect client communication through TLS and mutual TLS (mTLS).

NCache RESP Server security includes:

LDAP-Based Authentication: Authenticate administrators and RESP clients against LDAP/Active Directory.
Administrative Security: Control who can configure and manage NCache servers and caches.
RESP Client Authentication: Validate application users before allowing access to a cache.
Cache-Level Authorization: Restrict access to each cache to explicitly authorized users.
TLS Encryption: Protect credentials, commands, and cached data during transmission.
Mutual TLS (mTLS): Require trusted client certificates for additional connection security.

Edition Comparison

Architecture

Schedule a Demo

Try NCache

NCache Administrative Security

NCache RESP Server uses the same administrative security infrastructure as NCache. Administrators are authenticated through LDAP/Active Directory and must have the appropriate permissions to manage NCache servers and caches.

LDAP-Based Administrator Authentication: Authenticate NCache administrators against centrally managed LDAP/Active Directory accounts.
NCache Admin Role: Grant authorized administrators the permission to configure and manage NCache servers and their caches.
RESP Server Configuration: Authorized administrators can enable RESP Server, configure RESP ports, manage security settings, and start or stop clustered caches.
Separate Administrative and Client Access: RESP client applications do not receive NCache administrative privileges simply because they are authorized to access a cache.

Administrative security is enforced independently of RESP client authentication and cache access.

User Security Docs

RESP Client Authentication

NCache RESP Server authenticates RESP client applications through LDAP/Active Directory. Applications provide user credentials when connecting, and NCache validates those credentials before granting access.

Client Provides Credentials: RESP applications supply a username and password using the authentication mechanisms supported by their RESP client libraries.
LDAP/Active Directory Authentication: NCache RESP Server validates the supplied credentials against the configured LDAP/Active Directory service.
Connection Authentication: After successful authentication, the RESP connection operates under the authenticated user's identity.
Existing RESP Client Libraries: Applications can use the authentication configuration provided by standard RESP client libraries without requiring an NCache-specific client SDK.

This allows organizations to use their existing enterprise identity infrastructure for RESP applications instead of managing a separate set of cache passwords.

RESP Server Security Docs

Cache-Level Authorization

NCache RESP Server provides cache-level authorization to ensure that authenticated users can access only the caches for which they have been explicitly granted permission.

Authorized Cache Users: Each NCache cache maintains its own list of authorized users.
Authentication Before Authorization: NCache first authenticates the user against LDAP/Active Directory and then verifies that the user is authorized to access the requested cache.
Cache-Specific Access Control: Users can be authorized for one cache without automatically receiving access to other caches.
Centralized User Management: User identities are managed through LDAP/Active Directory, while cache-specific access permissions are maintained by NCache.
Separation of Responsibilities: Administrative permissions and application cache access are managed independently.

A user with valid LDAP credentials cannot access a cache unless that user is also included in the cache's authorized-user list.

Cache-Level Authorization Docs

TLS Encryption

NCache RESP Server supports TLS encryption to secure communication between RESP client applications and NCache servers. TLS protects sensitive information transmitted over the network.

Encrypted RESP Communication: Encrypt RESP commands, keys, values, and responses between clients and NCache RESP Server.
Server Certificates: Configure a TLS server certificate on NCache RESP Server to establish secure connections.
Client TLS Configuration: Configure standard RESP client libraries to connect using TLS and validate the server certificate.
Credential Protection: Protect user credentials from exposure during transmission.
Enterprise Certificate Infrastructure: Use certificates issued by trusted enterprise or public certificate authorities.

TLS can be used with LDAP-based authentication and cache-level authorization to secure both client identity and network communication.

TLS Encryption Docs

Mutual TLS (mTLS)

NCache RESP Server also supports mutual TLS (mTLS) for organizations requiring stronger security. With mTLS, both the RESP client and NCache server present certificates and validate each other's identities.

Client Certificate Authentication: Require RESP clients to present valid client certificates when establishing a connection.
Server Certificate Validation: RESP clients validate the NCache server's certificate to verify the server's identity.
Trusted Client Certificates: NCache validates client certificates against configured trusted certificate authorities.
Additional Security Layer: mTLS establishes trust at the network connection level before application-level authentication.
Works with LDAP Authentication: Client certificates provide transport-level identity verification, while LDAP authenticates the application user.
Cache-Level Authorization: Authenticated users must still be authorized to access the target cache.

mTLS is especially useful in enterprise environments where only approved applications or machines should be allowed to connect to NCache RESP Server.

Mutual TLS (mTLS) Docs

How NCache RESP Server Security Works

NCache combines transport encryption, user authentication, and cache-level authorization to protect RESP client access.

Establish a Secure Connection: The RESP client establishes a TLS connection with NCache RESP Server. If mTLS is enabled, both sides validate each other's certificates.
Provide User Credentials: The RESP client sends its configured username and password.
Authenticate Against LDAP: NCache validates the user's credentials against LDAP/Active Directory.
Verify Cache Authorization: NCache checks whether the authenticated user is included in the target cache's authorized-user list.
Execute RESP Operations: Once authenticated and authorized, the client can execute supported RESP commands against the cache.

If authentication or authorization fails, NCache denies access to the protected cache.